{ "Event": { "published": true, "date": "2026-04-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-22", "timestamp": 1776902582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f81883ca-45a6-42da-bb43-1b8743918a70", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991b0f6e-3e3b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776856111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776856111, "uuid": "5c9e3717-ae8a-4b61-8672-af4caf184651", "comment": "Malware payload", "value": "799cfbbba792bc1ef820f5f3c96cdf97", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776856111, "uuid": "e44b45a2-1447-4f03-88aa-62b9f825455b", "comment": "Malware payload", "value": "0064ef4fe6b957fd795577150a89317c5e59fd53454a6ce69b37ae5917a8f3b6", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776856111, "uuid": "d9e6f378-8c87-4fb9-83e1-57261d2be885", "comment": "Malware payload", "value": "89976669999c2d54d44458cf410f2ddb5f791018", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776856111, "uuid": "cf5c0a64-5b68-4509-addb-3efdd579521f", "comment": "Malware payload", "value": "2fc45f74a67e8e3711d7569902a229fad9a178afbac088f9168c1cf213f7718f7a0b29c41957afc1eb27576099b13461", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776856111, "uuid": "d11cd58f-d2c0-49a9-83b7-c556a6f2eb17", "value": "T11EB56C42389105BDC0A9B73149F27682BA75B8180B3637D32F95AA783F37BE01D76746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776856111, "uuid": "b50c52e1-3452-4d71-919e-e97a456fd496", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776856111, "uuid": "d8779a36-a109-4f6b-a7d2-749febd26500", "value": "49152:dczheuPy5+6QQmZfP7SfYA9CEqU1EQKGUq+Az41hsqbpvtAOjzd:dWbr+/jUq+28smpTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776856111, "uuid": "c64e1086-dd80-4ece-a7f7-9d1d8af7fa66", "value": 2376392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776856111, "uuid": "b23feacf-22fb-47f8-9aca-9726565aa517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776856111, "uuid": "5530a496-9ae9-458b-8c93-580c5c0b389f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d5d953-3e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776855272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855272, "uuid": "03555c96-d798-473c-b5cd-357f4fc7eb2a", "comment": "Malware payload", "value": "291a753cea7113e245858b55d03c716d", "object_relation": "md5", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855272, "uuid": "26f3005d-be35-4971-b85c-9cf544c81891", "comment": "Malware payload", "value": "00d7f42ce14bc4c20a5d8d79433a36b2a5ba251af63e7fab41cd23d8cd5fb138", "object_relation": "sha256", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855272, "uuid": "519fdd78-1871-4b51-8562-113e02d6e2d1", "comment": "Malware payload", "value": "e7d53e01203ecb8f2f07aa1b1fe5153168738aa3", "object_relation": "sha1", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855272, "uuid": "ba08b80d-9e17-42fb-ad54-0fa292eb80df", "comment": "Malware payload", "value": "d04c44df0d62f6faa38a4d6b0944fdf23073b1b81505fe8ee865672951655092ff65a4071b92e228574d3c5323335b82", "object_relation": "sha3-384", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855272, "uuid": "c33b6a47-f8f7-4e92-a944-1ade3dca54cb", "value": "T1EDF4B4486EF721559263B07D9F6FA0067234E40B2909DE087E1C97E05F8963897F6FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855272, "uuid": "163713bc-4f68-4ce5-822e-7c1856ec88a0", "value": "12288:UEkjHaYhu/UwoxFBJvtpuL2BBR1AnUhsv6uIFTLCNAuKSwY:IHaYhu/UNxFBNBn1AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776855272, "uuid": "b0af153b-5df8-4989-8ca6-7824e264ca8d", "value": 773773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776855272, "uuid": "512eb419-88a8-4f1f-90e8-df02e4503ae5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855272, "uuid": "d89f73f4-df29-4331-b1e8-1d12cd99163b", "value": "51_cal2_win32.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58771e2-3e08-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776834281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776834281, "uuid": "fb6b3883-6e93-4c01-b2a8-7982ae569438", "comment": "Malware payload (AgentTesla)", "value": "a8ca665e12ad552aeba62d548f64355f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776834281, "uuid": "ac4c6c78-3be5-477c-8e3f-3eae29a0189b", "comment": "Malware payload (AgentTesla)", "value": "00f5a50925c01840f0555aa65bd96d77026d7b2c93d9694b26eab0f47f05b46a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776834281, "uuid": "a37aa835-c273-48be-b7f8-7b19f4376458", "comment": "Malware payload (AgentTesla)", "value": "2d4d36b233a5ba48d41c0feb5722d820468634e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776834281, "uuid": "e4551d50-2326-4524-b5f4-70148ed7ad45", "comment": "Malware payload (AgentTesla)", "value": "546fc383b6750ff2972aefb611c6b46b3fe069730a5849c2bdf1fea08af4e1a89ef651626a58067ff00332903f2e04a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776834281, "uuid": "aa03d592-c0d9-4acb-bd0c-0cfcf697a3bb", "value": "T1DC3512586658EA03D8655BB91A72F27117B82EEEB641D3164FDEBCEFB521F004C48283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776834281, "uuid": "a9b8d3c5-a9dd-4f13-aa1b-584e88ab5946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776834281, "uuid": "92e63975-c20f-41f1-89e9-045b41b830b6", "value": "24576:t48mkqMvMGDxcPL1I7QDu+iS+0wBWY0Qg:tlmkDUMmZD1iS+tW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776834281, "uuid": "8a0a6804-4b45-4a9b-b6ba-f118f69ff399", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776834281, "uuid": "25ec2da6-be12-4b24-bfd1-5701dba0ea89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776834281, "uuid": "b1b177bc-8d5b-4a30-b786-6bfd83620ab5", "value": "\u00d6deme Bildirimi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856ed0ad-3e47-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776861232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861232, "uuid": "00667e54-a878-4d6e-b253-cbddb0430f47", "comment": "Malware payload (Gafgyt)", "value": "618fe9f41e609a4b0637ab7c90beb610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861232, "uuid": "7ec6f1a5-4271-4b9d-99b5-ace1ae609d4f", "comment": "Malware payload (Gafgyt)", "value": "0102ad7582030c74bd584fdb409ea73260df147dcf45117bead522f4036bf95c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861232, "uuid": "2f1ef23d-ac96-4da9-bfd7-a19306d2303c", "comment": "Malware payload (Gafgyt)", "value": "baff605eb22f0a2ab6351bb5e6e5cb6bb42e097f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861232, "uuid": "2d932df5-f4e9-48ba-96f2-ab332cf99eb1", "comment": "Malware payload (Gafgyt)", "value": "18816703d6c5d9e9a89e7aea9028951bfecd1632f5031a63c332fd7a538480e96e83a5bffd577d367bbba5f0305ddc69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861232, "uuid": "514dedd3-2ea4-422f-8c5b-5b94ca1c58c3", "value": "T168F2E100413AD98FD57C55715EAF291A2C241F0CC948A9BD4F48E46BF9B8C3AFD287A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861232, "uuid": "43876db3-9989-4442-bb92-ba07dc798476", "value": "768:VL5PeOg/1f6ub4MzTMegyIfAmZjB1ztZRf4nbcuyD7Uryq8:zeZ/1i04WTrTedT4nouy8mq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776861232, "uuid": "b1a76d26-729e-496f-ba68-0fea55791bc2", "value": 36588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776861232, "uuid": "2910048f-950f-4514-8c25-27ffa3803c2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861232, "uuid": "19e8f808-ec0f-4320-812d-807398cf1d78", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a370979-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875011, "uuid": "eedf52e4-f856-4786-89a0-d842273a4449", "comment": "Malware payload (Mirai)", "value": "104605ce5e80368ee1b18b5f6144c4c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875011, "uuid": "f14040d6-74a0-42bd-8b67-16567f86ca2b", "comment": "Malware payload (Mirai)", "value": "01105c759ffb07de1dbf522a19ccb51746274fddc66661275ca83772c9c0320d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875011, "uuid": "91eed9e1-b3da-480b-a01d-1833a4bf029c", "comment": "Malware payload (Mirai)", "value": "36c40c1f6c97290b7e5e2c8706078107efd08d0f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875011, "uuid": "752f5e0f-5de3-4e82-818e-1948d2f923d9", "comment": "Malware payload (Mirai)", "value": "3a56aad3d3cca0f2b1dca9a20170b23009000ebd0575295b67bb2bfa4ce93a41501c80962e6b5b78707d641fb8ce3ac4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875011, "uuid": "eeb75d23-1f22-4941-8042-409f4fd7bed4", "value": "T195C30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875011, "uuid": "78695be3-846a-45aa-ac69-1a64944dcd26", "value": "3072:fWD7YhjFMX+maR8TcDeRqQV3tNQYciYTG1S:fWD76aX9aKTcRQVnoiYq1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875011, "uuid": "8170dda5-213c-4ebb-9ebb-d8c1c4ac9ad2", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875011, "uuid": "186a8b8a-724a-4a38-8c57-ad182ad5c14f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875011, "uuid": "af4c1585-e3d9-4183-84e0-1a30151e6e9c", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6218a2-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848330, "uuid": "e09e1dd1-8da5-4a0f-a774-882b3b875ba2", "comment": "Malware payload (Mirai)", "value": "54c410688f303ac2e22008b87034b1d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848330, "uuid": "0d41ef66-53bf-48a8-b3dc-748266d5d84f", "comment": "Malware payload (Mirai)", "value": "021fd03b7656c09426ca8876dcfa06cc99aebfb1f8da163a98d20cb64e785b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848330, "uuid": "cc1ef83a-dec4-4b86-8f5e-59e3e0bcf6c5", "comment": "Malware payload (Mirai)", "value": "bda4d9563fdd59b76ded898780143126a9da7b68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848330, "uuid": "3869eef6-48cf-476c-adbd-f103520dcb12", "comment": "Malware payload (Mirai)", "value": "2d846d0dceeb0df5edf5d2a0cb181ec54645a1d75dfda6009351bcd059b229aa9772f3d83875c63844eafff7b88a2e16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848330, "uuid": "ef2f735c-fe1a-4b99-9a2b-eae9106ddd76", "value": "T13AA32A46FC814A21C5D512BEFA1E318E331357BCE2DE73129E14AF2173865AB0E7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848330, "uuid": "70e2159e-71bf-401a-8527-0ac988c3b70d", "value": "1536:AAnTSlOS7kf5J7ZLBpqppcGBgdQxmQ3k7/axrlOXzD4RidpSxfVwv7fh5GYWMq:ylNbppc0U+k7/axMpSxfVgbhULMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848330, "uuid": "563ba1b3-45c7-4063-bf01-2e9b19a3c861", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848330, "uuid": "4d02493f-ac6c-4806-ac89-57059abfb546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848330, "uuid": "6a7cd86a-74cb-47b8-9256-980efd96fec4", "value": "luxzz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad9668d-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895011, "uuid": "0fc958a0-b55f-4c0c-861d-4d9f25d19537", "comment": "Malware payload", "value": "d5b0b61802828673484844d1b0c39f40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895011, "uuid": "dd77bd52-37a6-46cf-a1b8-2c86871715ca", "comment": "Malware payload", "value": "02c4f3901b5338019734ce9af0dd62ad049cbe712796c2cbbf6ba0b5bac4427c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895011, "uuid": "f5ae98f1-0c0b-43cd-8512-c299be4ad3af", "comment": "Malware payload", "value": "183092f6bf4aee2adacbe78c7b5aa8a49419bceb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895011, "uuid": "9ced699c-2c27-49a2-bd22-40496afa2851", "comment": "Malware payload", "value": "a305d0900645376a8e1c62dc6df15bbd067ce0b18fc2f9783799de267e0ba6f96ce39867a33e40748feee27e33650807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895011, "uuid": "b517b710-3c75-42a5-a222-0e2a3e7e8870", "value": "T112766C90F748A176DA4A0A3248630B70B3A06D46C2F4CD6B4719F72F15F2AF6695FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895011, "uuid": "c10499f6-e760-4bd3-b7e1-a1bca419bde3", "value": "49152:1D+Nj/ziGMrAhL+UYsA377MMj3328m0KnoljehJ8nKssG8I0KiIbCGbkoKqHxvtx:ar88L+Ufs77zK0n62iIb6oKqRvjE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895011, "uuid": "fe146885-ed46-442d-b751-bb8954de754c", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895011, "uuid": "7e1cd635-a761-4317-8406-d388171029a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895011, "uuid": "d0f13e24-3801-4a62-aa9d-53fa7a015a0f", "value": "h3flood.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8064f288-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884417, "uuid": "fa411c42-8d95-4eb6-a658-eb653fea2b01", "comment": "Malware payload", "value": "173c54079b719f6a731fa296260bdf4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884417, "uuid": "23e023e2-2496-4905-b116-078b0d9502c3", "comment": "Malware payload", "value": "0383995467c4dabd74033b3d1850ed4dc1f34034c0117d8ab84a9bcd31c87e45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884417, "uuid": "14a83f9f-3787-4d84-be1b-37b715aa4cdf", "comment": "Malware payload", "value": "3b1603bd82803722b23a2d858104e7b4bbac4dc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884417, "uuid": "26f4bd4f-9c44-46eb-981a-987da3a079da", "comment": "Malware payload", "value": "87971dd0a1877f434f3d716e39539a4b7762919e36c94b83b3a438a951a612e914eb76c75f50ed7ba5a617bef8d07ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884417, "uuid": "3aa63d47-dfb6-45f4-8f70-d3e7585287bd", "value": "T16055E09BFE6E3C43D2D6E33E9F8AC3A1532BB191C31351537981432CE5CAA9C8BA1551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884417, "uuid": "d16c440b-0d92-4c57-a198-a5d3df33e53b", "value": "24576:dJ9uTMBCNwyCeThYVf+QcNkBsrEVMsthY5/FXA8k9/mM:tr+of++BswuyY5kOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884417, "uuid": "3dcd8847-1474-444c-b88d-269d5217b273", "value": 1359327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884417, "uuid": "5093afa9-d96a-4234-b5e2-b1c2f5b69916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884417, "uuid": "ebb1ff6e-6be1-4b0d-9d9e-6f3dbd5677ae", "value": "bot.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2c524e-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876172, "uuid": "80e24fa8-7fd9-4c4c-829b-a4456d422190", "comment": "Malware payload (Mirai)", "value": "1a12044f3a08ed36d44362a6f66f9ff3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876172, "uuid": "8e01df24-ce82-4ec0-8863-dbefddd6a6c2", "comment": "Malware payload (Mirai)", "value": "03df9ba296d451df918024114009f9d57ebd205d327f9b650f494c26c2e1a571", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876172, "uuid": "46aa8132-ca29-4914-8eb5-faab6ca0664b", "comment": "Malware payload (Mirai)", "value": "befb2737ae5e36419eb276585749ee0fd314c6dc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876172, "uuid": "f18c670a-6afe-4af3-a540-180f10e07073", "comment": "Malware payload (Mirai)", "value": "a2214b7fabf21b2b0b18eb291699a39d20ec9c65aaede5dd11e00f9b0f35b4661dd5d49e78bca74f2186de6793c0384f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876172, "uuid": "ceebc5b9-6862-4e1c-aead-504b0b2f5203", "value": "T10B92E06101B0C33FDC6B40BAA79E0E1564F3692A993E5B950CF7EA8970F75C14E34D62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876172, "uuid": "5f7f6a6f-0232-44b1-8709-1657a92a3e8b", "value": "384:Mqeru1/8mbYIaih4EQlzgY+EOj8JqTCSKfRVrTAKB+Of+sjKKPUWp:9eAkcHaih4Ek0SA8JZSm0K8a+sVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876172, "uuid": "e48174f8-7947-48eb-8fcb-946792421d01", "value": 20216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876172, "uuid": "99d76212-70ae-406e-9ef2-92c61e9eae9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876172, "uuid": "4cc08a0b-3325-4e1c-9d40-cf580306334f", "value": "boatnet.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2390a417-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876959, "uuid": "4c26b969-3a2f-4c71-b43a-47d7651ca0f3", "comment": "Malware payload (Mirai)", "value": "adede6012fd54bcbc945e730e422f58e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876959, "uuid": "e9212302-fad6-4432-a7f3-868f74757547", "comment": "Malware payload (Mirai)", "value": "03fbe36d24a44b2ee5da58626dbdc851ab78f85f5a475f51604f2bcbd77be114", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876959, "uuid": "33ca1ccd-96de-4c89-868c-a99d206e1945", "comment": "Malware payload (Mirai)", "value": "7ab1f517d862101dfc706a71ba982f8997a084b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876959, "uuid": "cee78aee-8ad6-421a-849f-9cf3592f6c74", "comment": "Malware payload (Mirai)", "value": "b17da623b29ae37211d6fdc24194bd126278f500ce15858710903bad4af8188ab8c80a644b0c70be48b61ab609fcad1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876959, "uuid": "7efdc3de-7743-4b98-8530-c96baa3ef836", "value": "T1CC539C73C8296E54D19582B4B871CB781B63B48482471FFA5BD9C2BA9083DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876959, "uuid": "8c452e94-78ad-4dcb-8e33-48f7ab2e4286", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYP2gpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYOgQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876959, "uuid": "e486c1db-a993-45fd-b47b-2d42f1e61360", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876959, "uuid": "804568f1-2138-4dd6-ae6f-72e53a2d6832", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876959, "uuid": "8ce6432a-368a-4e70-bd22-05816ff3b67d", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc11d2d-3e95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894938, "uuid": "b71553ae-22dd-465f-bb6f-7df0756b0fe8", "comment": "Malware payload", "value": "5606ab172dad396d908157f8efdfe719", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894938, "uuid": "696a6b53-24ff-4443-837c-86dc789c619f", "comment": "Malware payload", "value": "04d07d956d97986fae22892325fd2a38c11387a29e570ab7c39a6cf6b54d1bbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894938, "uuid": "c080b2ac-0fa5-4582-a346-ba6d51f47f96", "comment": "Malware payload", "value": "acdc1fd473c2b96f4791896786771c3e44744eb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894938, "uuid": "e447ecdd-f1ca-4823-8b63-180ff63dfc32", "comment": "Malware payload", "value": "64905d8e2bf65dd3c8c2a2b7f86a5297aad33aea9304bd4ec5d11008e86713f5319dcc18bb9d9f1676b92da04d41200b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894938, "uuid": "22f1546e-0a5f-4fdc-bf50-d078ebbc13c0", "value": "T19C567C81FB089226D94A0E324CA30F74B3606D82C2E4CD6F5609F76F55B1AF65A4FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894938, "uuid": "b06067c8-aa88-4987-b5ee-c0cd63b37697", "value": "98304:NlAnAa1mUah55/mGAPD82tkXyr9K08sERjs6BP2RvjEs:RZL/4r8nPj3h2R4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894938, "uuid": "e0f15e20-4bff-4758-a18b-14281f41a6ca", "value": 6029496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894938, "uuid": "b5414eff-4caa-441c-9601-d4370b5c89f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894938, "uuid": "07ea4b1e-0666-4a81-827f-b594087be1bf", "value": "h2rapidreset.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a466618-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897694, "uuid": "8c7ee737-f139-41be-80c8-4e76f48cf441", "comment": "Malware payload", "value": "2c0dfcab5e72dd6abf4d006e7bc19687", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897694, "uuid": "a2ebf3dc-74b3-484c-b069-1362f065b938", "comment": "Malware payload", "value": "0504f632fc4e419fe376ce623cd1a1fd8e37ba611bc981e21117578a164263e2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897694, "uuid": "f3f4e9de-02ec-49f1-9a26-c18ebcbf9efe", "comment": "Malware payload", "value": "6c771d2492aa6109dc353c596c98ca40873431bb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897694, "uuid": "7bd83731-a285-49e4-b229-5653c9ea05ca", "comment": "Malware payload", "value": "a820521cbd2e6819a03cfa0cf9defab6122aaec178edac7d979b557e40fa88e1a2d225b52a748aa83dedec262eb3e3f1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897694, "uuid": "42b39f6a-8d2c-45e7-bc48-866e119aadf2", "value": "T1B6B2CF10F5065E11D84ADE3458261EF92FBA35C36D06743F1CBC09AAE4125EEFB89536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897694, "uuid": "e113cbb8-5ff6-4577-848d-ee4d5319e220", "value": "768:fhN9n+qNVuTT2jEoDxp/pyOZlEUgjHbMGQ93e:9VyloH/pyOo3MtJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897694, "uuid": "91787d62-b1d4-4d85-874b-1a74f70806a5", "value": 25681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897694, "uuid": "a22afd65-eacd-4a65-906e-36f48f09bf3d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897694, "uuid": "92a39d4a-54db-49f0-b632-a2473a8602b8", "value": "sub2gooberV2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaf9617-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848336, "uuid": "51a5c84d-f9bc-4d2a-a7f1-4f23cda203ac", "comment": "Malware payload (Mirai)", "value": "67c09decd206be69aa6ecbc725657092", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848336, "uuid": "e1e694b6-2b4d-40e4-927c-0ba81835cf06", "comment": "Malware payload (Mirai)", "value": "0519f09668666a6b312a20be13e9ebb66001b9cd83a4e1ad94b2ee9fc45c8a23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848336, "uuid": "bde7b7f9-9348-4f1c-a31f-469389533464", "comment": "Malware payload (Mirai)", "value": "f2e7f54d918e1e25a38177463836659205b6bb2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848336, "uuid": "c73f9285-5ecf-4e64-9867-87bc7cecc4a8", "comment": "Malware payload (Mirai)", "value": "4ea0bf839a9d988e948dce91997b63fb9c20d13a229d3c3877270a862f6b8f0b8a9da2171073767a2d8696397ff69d6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848336, "uuid": "f4e4d44e-38ed-4913-8831-f72fa3590a86", "value": "T1F08329C1FA8BC0F1D91B88304067F63FDB31E8695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848336, "uuid": "48678679-a399-4b58-aa2f-9445a836e651", "value": "1536:iLDwDhVtcU4xiUWaqH3FsOvpeIgWtyCKjfTsv4gz9F7vi:QDWKzQLH3FRxTkCKjfTc4gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848336, "uuid": "a9a834eb-6139-4de7-a0be-40bce697d795", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848336, "uuid": "bf228f0c-6f1f-4fd7-95a7-bde4ff474b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848336, "uuid": "a6d1c8bf-602e-4fd9-b3ef-bd354251c543", "value": "luxzz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae4282d-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876166, "uuid": "023b2adf-1cc1-4e34-b3cb-0735cf40e556", "comment": "Malware payload (Mirai)", "value": "d0b3bd1437704888b717bdc777c8d80f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876166, "uuid": "494a7de2-70ec-4069-951e-cca82d92138d", "comment": "Malware payload (Mirai)", "value": "06c7eb0eaaffbd56fbad19a6ef7d4b31b641a25833ed76e0a91db93167061486", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876166, "uuid": "e258eced-7e3b-4402-a565-9a638f52524b", "comment": "Malware payload (Mirai)", "value": "7c1a6f1cb4c3861d7827a87e8e182495e60eae84", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876166, "uuid": "9ab2bf41-494a-408b-8dbb-1a0886b69e88", "comment": "Malware payload (Mirai)", "value": "5ab7763f285530af544da11402e8b2f756ab9d1a23fd5f4ceefd5dc7ca97e00bf88f3c63bf436d5abd026361b56a9696", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876166, "uuid": "5b3b87cf-c89d-45ef-b4c6-781802e3be1e", "value": "T16DD2D05157880731E9E47C75D9BE8303E362E2B585EEB09336342AE18C608D296FC657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876166, "uuid": "30ce2b5a-bb9b-4c29-9497-c0942a251a63", "value": "768:Kc1vYY2Y2lOsbeWcgtJShEBR7qVtnyTq3UirCM:KWE4sbeWckmEP7L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876166, "uuid": "808749d3-4a6d-4e43-a5c2-71a06761af01", "value": 28468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876166, "uuid": "fbe0a5e8-a2ab-4c37-be97-d12e0d824570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876166, "uuid": "2902639a-54d0-45b4-b6b2-a15d172facbb", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fed2ce-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776851007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851007, "uuid": "7cb2f7ba-8455-4be3-a926-42dbd4f4f644", "comment": "Malware payload (Mirai)", "value": "8a5346806de1ad1dc3ea8427f5864660", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851007, "uuid": "8d1b7e6a-43ee-4fb9-89c8-c3e939619a28", "comment": "Malware payload (Mirai)", "value": "07182e54689bd12a3216f7718bcf1697ff590cbcbfa356b6fca487447cfd99d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851007, "uuid": "fe90bccc-4bc4-4c3d-a2f2-caa36e0f1faf", "comment": "Malware payload (Mirai)", "value": "fc01ffbd383cd489455510ce63947374815da246", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851007, "uuid": "3062c67e-5351-4c77-931c-78bdb48d6274", "comment": "Malware payload (Mirai)", "value": "51cabaf492c136176eb5826d5c65791bb31f25b660ee663a7e24a61513a1dcf66209ba64875348e537cf238e7c5f5726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851007, "uuid": "5783705a-5d65-4b5f-966c-7c56d9e42a10", "value": "T1DA836DC5EAC3C8F5ED2209351272BB2759B2D03E2268EA83C3A9D975EC125C0F556B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851007, "uuid": "b2c1b2dd-3ed9-4c38-88a7-7e4f3f2f3e97", "value": "1536:NWOLMM5Md2noJlFrmfWz3tAjw19KHVdxYQ5FBP:jLxMdqmbrIWbti+9IYQvBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776851007, "uuid": "853722a3-cf82-4b0f-aade-e69d8681852f", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776851007, "uuid": "1ddddd48-0237-48de-b486-033207ab05c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851007, "uuid": "dc756886-6231-451c-ad5a-ba204d2dce43", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e5618a-3e06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776833400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776833400, "uuid": "59e2e7f2-8a25-4ecb-9a48-d5f29fb1470c", "comment": "Malware payload", "value": "2ab1e5b7375d904318a4c6c922cb9867", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776833400, "uuid": "9564cb98-5cfd-400e-b2aa-9c2a2761bee7", "comment": "Malware payload", "value": "071fdcf0650be6922b0d6795aabffc151eb2480d9f9f3114dd5446b17e54a04e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776833400, "uuid": "8777ad13-3037-46a6-8660-83e7710db6e2", "comment": "Malware payload", "value": "a036eadd702eb67b3cddd7b6927db47a041976ad", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776833400, "uuid": "f13916d2-c4da-4a41-b753-950194d58799", "comment": "Malware payload", "value": "2783398990d59d2b5fc0678b2298ca4047d31f638dfdbdf6242309dc7d40eb63ed287671f53e0ab1349d3955c03e37fe", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776833400, "uuid": "f74e9a3d-8359-49cd-8f76-3744b043924d", "value": "T107D332AD059F04F48B13256546EB5C17EF65A6230A1CC6D0BBADFDE03F20A65A0FB6C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776833400, "uuid": "77755c2e-06ba-4f0a-a8ba-70ad8cd5b495", "value": "768:LJpunvEb3HjWTZ5FP3uljFkQ36mBOWjc+nCvzPPgxX9FbDkUGOvljV0cTOvlx9eE:LqXZnnbYxX9FbDkUGGDYx9eTsDp8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776833400, "uuid": "12fbbf8d-983e-4151-aeb3-451e866cc8f6", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776833400, "uuid": "eac0449d-c0f0-440c-967f-923122bb1d7d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776833400, "uuid": "a803aa53-1147-437e-bc34-b4342a479c72", "value": "Global_Images_Beta_9879.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ac8d73-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880050, "uuid": "917cb823-fe8b-4d55-9dfd-eb71c28f1952", "comment": "Malware payload", "value": "48f228c30c8af1b68ab93509a433e7f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880050, "uuid": "3957c726-3e98-43a0-8fca-20ca5c635d95", "comment": "Malware payload", "value": "07b655eebd2932f45ee16e8c28150f8c5e46afdcb544039e14e573a5b83244f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880050, "uuid": "8a446a19-7770-4656-a183-65a6835f50b4", "comment": "Malware payload", "value": "f4214b8ff3900d04ebc656e7d5562973155d8013", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880050, "uuid": "4500dc3a-d62d-4d6b-a7d8-208e46233098", "comment": "Malware payload", "value": "f1d08c42de8a26c8f0d5ca23eabcd8385afd788f712cf030dd9703821aaabadcf125f2091606d3aceecc163c77ab7f58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880050, "uuid": "c4ac9548-a222-4a87-9e0b-85f2ab9bb81d", "value": "T146A68C41FDCB50FAEA030A3005ABB27F63315D0A4F65DBD7EA107B29F97B5920936249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880050, "uuid": "85925ef3-926a-4e55-b4a6-7bc257ef37d8", "value": "98304:1XNvYclFYHEZ5UG5+1JGh35SEqXZf4n9Wrd9V9BwRZdG8xU:1uoYkZ5H+1w/0Z6CdERPt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880050, "uuid": "b37a498b-9f31-462b-b4a6-ecd18b21c5cb", "value": 10234135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880050, "uuid": "436e406e-0b41-4fd5-830c-d44e308a120b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880050, "uuid": "273b2714-c5bc-482b-8c6c-d109df3c6dfe", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d974fa7c-3e34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776853213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776853213, "uuid": "37b5b838-1232-479b-a068-0082f8200066", "comment": "Malware payload", "value": "eb89f018e6c3a8e9de0a0452acb16e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Operational Technology", "colour": "#B88140", "exportable": true, "hide_tag": false }, { "name": "OT", "colour": "#FA7F30", "exportable": true, "hide_tag": false }, { "name": "ZionSiphon", "colour": "#2948C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776853213, "uuid": "e4aa18e0-e899-4a6a-9d01-75aa012698f2", "comment": "Malware payload", "value": "07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Operational Technology", "colour": "#B88140", "exportable": true, "hide_tag": false }, { "name": "OT", "colour": "#FA7F30", "exportable": true, "hide_tag": false }, { "name": "ZionSiphon", "colour": "#2948C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776853213, "uuid": "67968fff-1618-43d0-8e34-38d47f6c71ba", "comment": "Malware payload", "value": "7cdcb8f372ceb7f5d3c178d9649080106a932f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Operational Technology", "colour": "#B88140", "exportable": true, "hide_tag": false }, { "name": "OT", "colour": "#FA7F30", "exportable": true, "hide_tag": false }, { "name": "ZionSiphon", "colour": "#2948C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776853213, "uuid": "7e20af7c-2d20-4011-84b3-7b8582226166", "comment": "Malware payload", "value": "c7e9ddd54f193417cf1058fc9b3b86e7a88226fb883178103187734ecc99c500f88d63a5361bbf41b69368e63c18beee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Operational Technology", "colour": "#B88140", "exportable": true, "hide_tag": false }, { "name": "OT", "colour": "#FA7F30", "exportable": true, "hide_tag": false }, { "name": "ZionSiphon", "colour": "#2948C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776853213, "uuid": "66af3567-2c1d-4045-8da5-69d61b26685e", "value": "T174A37BE736D4305BF1AA8EF306BD70F2C66D53127EC1975DA809060BBE6210F9D89938", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776853213, "uuid": "32e83e61-2bc5-4838-85c9-8e65d747b60b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776853213, "uuid": "ab70493e-e468-4189-bf7e-37364736470e", "value": "1536:xs44pt0oN4wRdv1s/P5KvTlB1ICt0Qep/oG8gSTBVfYdd+9MWNniBg:xsD1dqpKLlXFPc/oG8gSTf5/niBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776853213, "uuid": "045ce842-0223-4c4b-8273-5e43e7ccef8d", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776853213, "uuid": "bacfd6b9-9b68-4638-b82d-9bc10eaae8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776853213, "uuid": "8cb9c98e-45c2-4dd3-b1cc-c397c1b26c8f", "value": "07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6604b95-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776851060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851060, "uuid": "42753e6e-cfaf-4c85-8a37-f2bf48b11240", "comment": "Malware payload (Mirai)", "value": "a3214236e26193d635524affdd27e31d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851060, "uuid": "846610f9-4ad4-4b16-82db-d06fa056691e", "comment": "Malware payload (Mirai)", "value": "08249bcf25470f56e93a76e7e203ceaa797e215e86c091a279bf1ffc7ff04376", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851060, "uuid": "14d39fab-9f64-445c-b9af-b960759ba032", "comment": "Malware payload (Mirai)", "value": "b0df7321dad06f9d56679185a40de76b6f1b47a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851060, "uuid": "23d2a385-0f6c-4603-a3f6-28cb10eb0eb1", "comment": "Malware payload (Mirai)", "value": "6f8b2517d3539170f498b6a72bc79cba7679aae0735632e46f8f99759480a860a69ad1f8fae0bba163c37489400d96c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851060, "uuid": "e1ea60fc-95bb-4f02-863a-e8a2e6019ae1", "value": "T174D0A7E6D1332BC304198E08F5E1CCB0A192D08C0283BFDC6FFC281F027D8043A10A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851060, "uuid": "683d2d50-4b71-4c2c-9252-6d60d2b65fdf", "value": "6:L6FGoFdihd0XnD6FGaxAjFdihrNI4jD6FG3GjFdih7FaKLK5:qsWXnmAjsrNIQhGjs7cKLK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776851060, "uuid": "bb494602-499e-4fb2-974a-b367532b267e", "value": 243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776851060, "uuid": "2f74c647-79e6-4156-b4f1-8578bee90ba6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851060, "uuid": "0b4e3777-cfa3-44a2-a2c0-b0a2e02d2385", "value": "d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a7162a-3de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776817134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776817134, "uuid": "b51b60a3-5964-4eb9-88f5-74cc9b052b98", "comment": "Malware payload", "value": "b39d75e546527e7d0f7518126a2a43bf", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776817134, "uuid": "b871b82d-23fe-40b7-b06d-2e539fe06870", "comment": "Malware payload", "value": "0a378805dfbf7609769486a8fe5dcdfae2c47db86690e6159f61b39b9299200a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776817134, "uuid": "e96e5835-7c1d-482f-8199-766df864711b", "comment": "Malware payload", "value": "b1091d69f210effb344cb593903ccfcf90e252e6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776817134, "uuid": "1776ef2e-6ae2-450b-be23-18fd5ba6bcaf", "comment": "Malware payload", "value": "51349db4929dd5c0c3996464f4d97dd4faa58c189af47f996469bef2db9572336799782a67e15c93617a243322c7a92a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776817134, "uuid": "30b256e4-0279-4575-b950-a46933511d79", "value": "T10C511992329FEB469A6E2453E30DBD659FF412245050F980D3CDEB06B94FC32A53B1C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776817134, "uuid": "1bb2524c-fccf-43c5-bf7d-f7454146d73f", "value": "48:13XWpka13UF7ZrA15IwtZo9X8diOGxW8N406EOLaD/uGjKxT1gRuinmtCKCVVYWX:tsUA15xi9XKiO1C9huBT1gRabC7YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776817134, "uuid": "51166d91-2dd9-48c7-996a-c7a90b19872c", "value": 2716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776817134, "uuid": "b42ff2ee-1fcc-4c85-b8bb-9b4db54f2f17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776817134, "uuid": "e1f6cf85-426b-4853-bd2b-25c40f5b99cb", "value": "run.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a19479-3e7c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776883920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776883920, "uuid": "0bc2a0e8-2d03-4e44-aea8-a779c06b5732", "comment": "Malware payload", "value": "910f594f9f2510f8b7ab1fea5000a3b4", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776883920, "uuid": "c68765f7-c960-4a62-ae81-7206303065a5", "comment": "Malware payload", "value": "0a4cbf5ec04c110ad64ed20a278e09de966c414995960aa65a8ca4925be43959", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776883920, "uuid": "d86b9bbd-c9b4-4249-aff6-8ff5d7b2c68b", "comment": "Malware payload", "value": "44e844f16315e47da4023c56e67343a83bebc354", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776883920, "uuid": "e963755b-1a17-4ef0-9b3c-b05ecb200d96", "comment": "Malware payload", "value": "d83f4adba2ee71eb52dc23ce102399fcc56515d6e9dfa8bed1e2f2c9d6448e865c971ca16af0b0dba02def949fe02538", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776883920, "uuid": "da674562-c30c-4cf7-af7f-a71004356bb5", "value": "T177836C43B5D18876E9720E3118B1D9B4593FBE110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776883920, "uuid": "77261466-ceb9-4732-a476-8d68c9901551", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776883920, "uuid": "686b65ef-56e8-487c-8bec-15de97f5a7a3", "value": "1536:SxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYD7DJno:wenkyfPAwiMq0RqRfbaWZJYYDJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776883920, "uuid": "864303b0-9817-4b3d-b3d6-85ee9bfcae2c", "value": 83176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776883920, "uuid": "e4083187-9f67-4234-8356-6acd6bc6b15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776883920, "uuid": "6d25c160-4145-4cb5-b2d4-3b78ced56c7b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5879bdc7-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848272, "uuid": "c8e39e1b-af4d-4541-8db9-4cfdf2ba915b", "comment": "Malware payload (Mirai)", "value": "fba6b785b5148befb8606420bd2b290e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848272, "uuid": "37263581-5d9f-4a46-aec0-6a51716ec4f3", "comment": "Malware payload (Mirai)", "value": "0b2998c06a58ece81ec8303ab81f7ae61fd74a1d7639e09e9742a1cb90528580", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848272, "uuid": "c1103bc5-fe00-4c3d-90e9-f28dc1868842", "comment": "Malware payload (Mirai)", "value": "f5a8d9355e50ca8d6756a083fa8f207ec85720d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848272, "uuid": "2fd014e6-cd77-45c9-9aba-59a796bf7004", "comment": "Malware payload (Mirai)", "value": "983fa3629a1860fac7db91df6b57f1e2a32034a4c6970c14015aed60fdd6aa2ddbe802eaa877467ca852d96c208f53e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848272, "uuid": "19071538-6dea-4164-a066-03de5fb22ed3", "value": "T19723F120E0215A2EA1710CFF15B565B7B315EB78ADF8708F3B6674A34D26E4EF2A1810", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848272, "uuid": "161d2d77-f559-42d7-b808-ab03d55014ea", "value": "768:rvIaeg11UR7jw33sixFm8ja5ZQkp4SNQC/WOofcMU3HgLjhfSuXDothGndR5:TUE3si3Zja2SNB+7HU3qhqrcdR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848272, "uuid": "dfaf5655-eede-43bf-8bf0-9efa904c7760", "value": 46748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848272, "uuid": "46ed840d-3d36-478b-9324-2fe54675d8b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848272, "uuid": "6d4ba165-0640-4f2d-be7a-840f89f7fe67", "value": "luxzz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cbdc3d-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826412, "uuid": "35912300-c07b-4cf2-8fe0-fd620c573a14", "comment": "Malware payload (Mirai)", "value": "fb09643bbe3453e9f6ca4d20905e4c10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826412, "uuid": "d34d8011-5eaa-47b2-8e9b-47a08c686d97", "comment": "Malware payload (Mirai)", "value": "0bc0133a8ac281452011f7b9b36a6ab61bba67b288b1ef98fb5fb51ab9faa093", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826412, "uuid": "ff154973-fad3-47a4-9a1f-de4d0d47470e", "comment": "Malware payload (Mirai)", "value": "9efc2c0b03090c3b3127d4d00d6fe45ccb828f54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826412, "uuid": "99575670-f2a8-4639-bd56-1ce13d74b1d3", "comment": "Malware payload (Mirai)", "value": "e471b7e40b2169fdfa94edb923c37932e24fac9eeab84b4cd60370fed8435e82aee6dec24f1a95be6c164281a88bcee3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826412, "uuid": "48e62cf4-d939-405d-ad4b-b645fe7b5ee5", "value": "T191E30A46F8819B12D5D111BEFE1E128E33231B78E2DE72029D246F64778A97F0E3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826412, "uuid": "1d48e5df-22c2-487e-8b2c-447507511c89", "value": "3072:tWJgI11Uf0sI5XyJS9sA2aGcYhrkxx2/+R:ob11s25XCKsPa68x2/+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826412, "uuid": "83cb00d9-27f0-49b8-8a3a-77dca7b349b8", "value": 150620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826412, "uuid": "10cc7e9b-3703-4491-94fb-760d7bffec5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826412, "uuid": "01cc7647-1c74-4c76-b5b7-02c573d16846", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c62306-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880293, "uuid": "10233e5c-3e18-40d0-8304-7094ca371c9f", "comment": "Malware payload", "value": "8808168abb94d968bb6669d993468af6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880293, "uuid": "52cfadbe-5bbb-4c30-b0bf-6bed407867b4", "comment": "Malware payload", "value": "0c1c03ee4d70b87237612090574bf33aaac484aa79e32cf0cd8c7c2ae9447da8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880293, "uuid": "dd58fae3-ce99-426f-b6b7-d11c19d298e0", "comment": "Malware payload", "value": "ad44791f9ebbe02ac228326461f2137e4d378324", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880293, "uuid": "c2bb109e-3d6f-4c68-ba51-8717a7bbb8e3", "comment": "Malware payload", "value": "58f2b8c5e608cd19143d75b9c348aeabdcb818e37f150ea78da8c7a887b18fd9c7d819134b9652ab75b9b19df719f317", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880293, "uuid": "2f2e1aa0-64f4-44e5-9b67-6001f5d69050", "value": "T10131855FEE9CE17E88B6C152ABFF7E4CEF41222712449098BC5CC451A348639CE460DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880293, "uuid": "c52ce9ef-6b6d-4ce3-a15e-ee86b4fef6cf", "value": "48:gDpKGm7P/tp3ymUXgZc9WAjSRdbnXuqQV0/A2AVtk:gOrQQCW4geD6/A2Ctk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880293, "uuid": "8afc4b1b-3e51-4525-8acd-591aa0e3dc39", "value": 1797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880293, "uuid": "56cfec81-853d-47d8-ad24-98a78ec6f73d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880293, "uuid": "73ad68b9-f5b0-4646-877c-dd732d6b221c", "value": "5795_openfodrIV.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf9dcfb-3e51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776865485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865485, "uuid": "f5c234ca-9af7-4200-abab-42ac18db80c6", "comment": "Malware payload", "value": "55c4ed68a88d9d844a7f8605e41a19b8", "object_relation": "md5", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865485, "uuid": "27014dd4-f81a-4b5c-b4a7-3a031742a7a4", "comment": "Malware payload", "value": "0c3f66d05810388ce93b53f053564be29f4cacaf65eda7f323d99b81782bf563", "object_relation": "sha256", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865485, "uuid": "12081062-425b-41d1-9785-c3958f34a4cd", "comment": "Malware payload", "value": "a45545d2522fd278ae167b3b697a075b94c28b1a", "object_relation": "sha1", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865485, "uuid": "6a501dac-177b-48e1-9285-7507a36eba1c", "comment": "Malware payload", "value": "2ee3216a0865962f8f186d98567c537c42752342f69ab7fa145b6a8fef6d017c5814a9d3907bb358c4aff124f1d0318d", "object_relation": "sha3-384", "Tag": [ { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865485, "uuid": "9022f20d-deab-402e-a550-74f6519a6d7f", "value": "T1F20833BC60E33C46CC7B312ACA46DC61567EF3F509B74A51FE6A6AC5B82736C8519083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865485, "uuid": "920b058b-330b-4e70-8c85-3280d71850c9", "value": "1572864:syvn94sOcE38wB3wLUXgV2RghzbVdgwlCApN9ev17YdnziYrLAf74mBTLyB:sMn94ZUgwIPRSbTFlCARe9c5xrkfrBT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776865485, "uuid": "8143b4e2-e8d4-4341-8387-ddd46fc61539", "value": 77554876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776865485, "uuid": "92130bfe-32db-4053-acdc-6a1efd9bbb0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865485, "uuid": "4a017a24-ed5e-4960-a9f5-adfbf62a3610", "value": "Unlock ALL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6812e2c7-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874068, "uuid": "14feadc1-7514-4d26-9b11-46bb7b439d65", "comment": "Malware payload (Mirai)", "value": "f9c91552a6ed99cc410f917c83b203c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874068, "uuid": "cc677886-02e9-4338-8094-2f64680747ad", "comment": "Malware payload (Mirai)", "value": "0cc67b0dc8890bb9bb2980f02a1e575009b3d1216e559dde2348dece458c8a13", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874068, "uuid": "4181ab76-95ad-4ca6-becd-39aac40d34c2", "comment": "Malware payload (Mirai)", "value": "dc97429a68ed0c7a43d50e82e3e40ca80b1648b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874068, "uuid": "b26bc368-4b84-49cd-b18d-341c06dd1137", "comment": "Malware payload (Mirai)", "value": "d4fd24adbd78d367532abcd240863227db962420eac4fae4fa47c8152bd770b9dc107ab8f2095e212a4fde19efc05ba2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874068, "uuid": "1ec6fb8d-5f89-4f2d-8204-ad9f4c99a2c1", "value": "T196E52B156F900EF7EC6FCD3356AA4B02258DA40622D53F36B878D914FA5B60F4AD3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874068, "uuid": "b2aeddbf-cc7e-47f2-b6da-1e237471afd5", "value": "49152:BE2tJjFn98+8bAPOg560fJj5uy32MPZNYy+BEzR1pOvPB7:xJ9qgICHJpOB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874068, "uuid": "6a24133a-e44a-4c45-9196-05de29de68ce", "value": 3164444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874068, "uuid": "8799e4aa-20f6-4ea9-bc68-a0d552bc3255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874068, "uuid": "92b75e92-80ba-4057-8db9-527d69a4f957", "value": "ciubuc_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551ccf3b-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895081, "uuid": "ebc6c984-ec8e-4ae4-bccb-1dc65f5b935b", "comment": "Malware payload", "value": "eb14a0a2f90c2376fbe1ef70b659e46e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895081, "uuid": "27383518-c3f1-48d1-bfc2-e56395e7af27", "comment": "Malware payload", "value": "0d133a5a234367b850f889f18be508da82e5c9e8732f27c91f8cfe5817c2e96a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895081, "uuid": "26dd1ee4-9516-43a1-ae33-3bae50599b9d", "comment": "Malware payload", "value": "5d4b0f127987736036a608dc223eb659294569c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895081, "uuid": "60a860e0-98cf-420e-844b-4e722bf350d5", "comment": "Malware payload", "value": "1014d9353e901869db0a645b4b538f28ffe9c59a3cc7b76585b651a47b90c5385fb1cdf15cc883bc9bcd85ee49c8f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895081, "uuid": "4441e5a6-3ef3-46ad-aa30-05076b1ec748", "value": "T1A95618C1E991D24AC63D6D31EFD6EFD8E26B3E315C885A4AC9C8F33E1DB214580B55A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895081, "uuid": "8f85d652-e811-4aa2-bd3e-f933d84efc69", "value": "49152:Mem1oH4T8Ote0PivDfieyZgDfByPF+8jPhnGP8BHxwt5E4:Mem1oH4TRtjyDKiE7RwjE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895081, "uuid": "7b32b18c-3179-4924-8731-fd8d0ebb886a", "value": 6422712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895081, "uuid": "36025bff-07e4-4836-9d1c-a7c2b5159634", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895081, "uuid": "fc20c5ed-830d-46ee-a76a-9d75da62c3d1", "value": "h2stream.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7940ea11-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826423, "uuid": "1acdae84-1c51-49f6-af8b-8a468bcf3ab5", "comment": "Malware payload (Mirai)", "value": "9caa641bd4a4e9780a7e37b452d85b00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826423, "uuid": "c5449d30-5e91-4f27-ab99-70e8ed795ac4", "comment": "Malware payload (Mirai)", "value": "0e3382a7937d78421802120f14d6c712b8cf452d7e2fe18d30cfe6cbced8373a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826423, "uuid": "0166dae3-5a57-4253-9fbe-381ebc614850", "comment": "Malware payload (Mirai)", "value": "764c8286d2b78639a689656a6f6b46501227d6c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826423, "uuid": "580bd502-71b2-414e-800f-6fc06ea306c7", "comment": "Malware payload (Mirai)", "value": "1e6e227b1d0452b2e50837efdcfb5ae4df13c71ceef60c2d350e4d1eb89f3f828c2bc1d035a0571a013bd3c5dd8aa7bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826423, "uuid": "b3c6b1ac-dc4c-4bfd-b1c5-22b60795cad2", "value": "T1F3D33A06731C0A47D2632EF43A3F27E083EFDA8121F4F644655F9A8A91B1E361586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826423, "uuid": "1d7950d2-f58f-45d5-bea0-7fdd9f30a263", "value": "1536:5WM4Crntg3uZVoBZgQMxfa1qITG5HGXmY+0KXc9f8vATpEX9lejtSqqVoLSG1A0g:5WMtgoVegQMxxIgpY+7c9pTCG1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826423, "uuid": "f153ef7b-34d0-4219-a74d-80b5f94a4db2", "value": 142228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826423, "uuid": "e22ab136-294b-4710-820b-eaf04a01f16c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826423, "uuid": "6c01a0ed-fe73-40dd-9f76-ca0e00bac2eb", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94704cba-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876290, "uuid": "1a4a05f1-76f1-4536-8cfe-9fe60098fae7", "comment": "Malware payload (Mirai)", "value": "f33dd729e9ffe1209211315891cc1843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876290, "uuid": "53728a26-af2a-466a-9c56-808dd221caf2", "comment": "Malware payload (Mirai)", "value": "0e71566703ef25d0f54eda02d137176c15e6d639d20a1ce9e0dd1d72ca34262d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876290, "uuid": "94717162-9980-432c-bd2b-4cd7e75bf19b", "comment": "Malware payload (Mirai)", "value": "92d922e9bffc421fe1a770ad86e818ae0cadff3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876290, "uuid": "3cd87130-6ce8-49a4-8b73-0765a146bb8f", "comment": "Malware payload (Mirai)", "value": "f6e3031961a49b53b4a0068cbc23774221a895291379fa4c6cafebfee451b399bf047046f5ec4de5f89c1b3b150845fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876290, "uuid": "33b49340-9504-42bd-9d2b-da4d3e67eb3e", "value": "T115033B41F30C0943D1B76DF0363B37D1939EE99121E4EB89761E9B46A2B2D324296FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876290, "uuid": "69ead784-1b58-4499-bf44-2eb6252673f3", "value": "768:ZQB9UY+XKT8NLF3XtILUUSJtgwwtyDVCG7IH:ZSUpXKTstXKLUUOgwwtyV37c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876290, "uuid": "d516db7a-aba5-4ac0-9bf7-976ecd25bb99", "value": 38752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876290, "uuid": "05432f21-e756-4669-bef9-c9ac64a942e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876290, "uuid": "02c50857-de8e-48d5-8deb-6a34d8582e82", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9106896-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776888887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888887, "uuid": "407c3598-72ab-47ee-b12b-c53120bc020a", "comment": "Malware payload", "value": "ce5b18115e05fce8852a0957055f9844", "object_relation": "md5", "Tag": [ { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888887, "uuid": "3575deef-b92c-4f9f-ab62-f53f27cdc16e", "comment": "Malware payload", "value": "0e7aac46dd29f5977cc77003fe93d38c12fae76ae177d933195bf93682849c2b", "object_relation": "sha256", "Tag": [ { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888887, "uuid": "0185ed5d-0fc7-4a50-b1a2-4e96dafddab2", "comment": "Malware payload", "value": "d41458c25675b56a21e8ed71d62e180b40830dd9", "object_relation": "sha1", "Tag": [ { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888887, "uuid": "d44063d3-732f-4324-a00e-f73cbd3abdd4", "comment": "Malware payload", "value": "f7a41065ad9383b9ea846435d400040f1b1630ebe8d01f699617ce8c06cd23346aaff230c420fdbfd265a2080c2efe19", "object_relation": "sha3-384", "Tag": [ { "name": "bladabindi", "colour": "#D041A5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888887, "uuid": "0c78d8c6-0472-4cc5-b68b-a124f1fda5b9", "value": "T181E2094D73648923CABE47B88E70864247F1D14B5612EBAF8EC550D61DA7BE41E00EF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888887, "uuid": "1243d1df-05c8-46c3-8d1d-d9d491933741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888887, "uuid": "2cb77560-095a-4d0a-a465-6f5509ee1c7e", "value": "384:EtpwNvZFwRm0owmMeuDSwRtpCU4wHNwku0SwoZ3B6J9Z/8xHVkw3ccNwifGIyLsK:E3wNvZFwRyYc7wHNwkH84w3ccrfLu6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888887, "uuid": "d22eaa7a-a505-487d-ae3f-94414ef626fe", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888887, "uuid": "4a617bad-d656-428c-9bad-585add5f34bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888887, "uuid": "31022140-3bae-4519-bb26-4faf914ad898", "value": "cdo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3aed22-3e28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776848089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848089, "uuid": "51e2c07f-6668-4dcb-a3fb-7310d6b8d467", "comment": "Malware payload", "value": "265344b26341449d2bb33ccffb165a12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848089, "uuid": "f8b995b8-7b07-4f1f-aee8-e42941880838", "comment": "Malware payload", "value": "0e899af91c628891d209be429a246e847f27fe59b5ae6e36f701392fb4147ef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848089, "uuid": "e6777d17-ffa5-4f71-af55-7242bd906c38", "comment": "Malware payload", "value": "07dccee8f6e8f92f12fd1d120321a97f4b58c359", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848089, "uuid": "47fbe5aa-8a75-43c6-a25c-da1b4d90822d", "comment": "Malware payload", "value": "5aa1aa77de1a89f9a1faddd92ce04b189f5366ce7ab8711e6b58d2c11e9e0e2e9c8a0b22d168cc7ad605af4e94ea3e2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848089, "uuid": "e61a6a26-b0ab-4fd5-83a0-5d07da7f2ffc", "value": "T1D113F025EA8E2C41C22D5E3D8C6E23266E2400E0E36E87DE27085F505F07E5EF56D8A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848089, "uuid": "6ad7c790-e65b-4c3f-b0e8-7d1c0ac07c21", "value": "768:4SWyDQUS72wGcBA8oOqVX4jFh46NMhEpPIE1tZyA00qHvMDNAM955sXnWRy90Bn:4SWuS7BXKOV2ajT0ZY75mAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848089, "uuid": "fe8d922c-3231-4997-b13f-974a3c1d8987", "value": 41552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848089, "uuid": "a86c2769-1623-4a7e-9efb-c274c441037f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848089, "uuid": "b4d7ac41-db2d-41c5-9d00-b6d632a6d02e", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7840c0-3e1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776842640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842640, "uuid": "d1e3c128-feaa-4835-98d5-3c66b46d56dc", "comment": "Malware payload", "value": "8ad3164710760f3b48301d4be894a825", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842640, "uuid": "2cd1e02c-c936-4eea-8541-bafca040e0fc", "comment": "Malware payload", "value": "0ed12a92d4d5697ab3978471d290a0c1574549106b90f3e378ee6cd3f9e530e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842640, "uuid": "3d80b575-88a8-4476-8799-99d3e1580f7b", "comment": "Malware payload", "value": "b0ff2a736c4d857d162c6c7679e8d8196d710d8c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842640, "uuid": "3b15148c-9bc2-4427-ae65-d2b84c06ab34", "comment": "Malware payload", "value": "5925d9344d4fd5855348e01fd99eb48bf9844df4517469990f9e8aef62ae78808ff588ad6f675f5ab804abc22cb416bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842640, "uuid": "0cf87bd6-8e0e-4655-a72f-6b1fdd7a5687", "value": "T152E45B7B91686589DC9B72B46BC73AB3FC11BD393360D5D65E03032C9DF06369A2821B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842640, "uuid": "794019ce-723c-4527-9c41-34c6a7c7ea2c", "value": "6144:rU7HX6JxtMMy/Oj174Kfiu7n0EZGSpo4D6t/JPCBs5YNGj9TXaoJ5uS:rULutW/Oj174KfiuL0IpE/JaBs5WGdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776842640, "uuid": "876e028d-4301-4046-a6e7-efb012c629c4", "value": 690528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776842640, "uuid": "74403113-4f03-4982-abe1-fd37849f09cc", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842640, "uuid": "a68b2216-5b5f-48fa-a3e9-5fea42d613a0", "value": "APPLEexport", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c35fe5d-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875820, "uuid": "48094e17-bc41-4e34-a170-1c1c8fc6ac4c", "comment": "Malware payload", "value": "9120138a97d9e481f0a5761a6c6d751b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875820, "uuid": "1fa7d0e2-bdda-4de8-b542-a75520f39df8", "comment": "Malware payload", "value": "0edc6016136f7d89f28e3014a30a0f948d14e5b5b6c15d66064d0e6392c0fdf3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875820, "uuid": "1ae9c1dc-de9e-421b-81a4-9c9c9618468d", "comment": "Malware payload", "value": "08c091146cbadb71a43a7b03b6dc2548aa907178", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875820, "uuid": "be77b782-6344-433d-bcfb-f10ae4b1ab48", "comment": "Malware payload", "value": "ea807c4a69147c0080d9b829817836f8c1abeb52303a4e8d4c6545eb299df9f15c05e70350454094a88f0c46ff915a50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875820, "uuid": "479b4676-adf3-4084-8f4d-328b2b3c7786", "value": "T15221ADFF64E31432908D4028DFBF621454C70A23A884D91FB54C74383FB4764A953F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875820, "uuid": "21deba47-eca1-4647-a304-39155eae892a", "value": "24:72bvcDWv5ny77tFbmJt70d/m4IOnvLzQ4TXcNcUbrpECUTCU9z80sUpgQ:7ecKVy77bbmJt70d/m4IOnvLkQ6L/mC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875820, "uuid": "d52392e8-ebd2-4454-a169-32fa16e47185", "value": 1211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875820, "uuid": "cc54dc7c-ecd3-437d-b6e8-b13110dbae7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875820, "uuid": "affacbcb-e942-4033-8a91-1549f3ac8e6b", "value": "hb8ipc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373741a5-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897608, "uuid": "32fb3d28-03da-4a3e-a391-9a54b3da6b61", "comment": "Malware payload", "value": "2fdcf9b2f93d7b8e24a7cd425804dc3d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897608, "uuid": "46aaa509-bd6a-4135-9583-54cb6bbea5c8", "comment": "Malware payload", "value": "0f2f00a779258eb774ff4eb9608b9560cd2b5fb0b28464bbd5d40e1e264c0c71", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897608, "uuid": "3f32849d-6146-4552-a7f6-dfbca4893d22", "comment": "Malware payload", "value": "b9eadf82cd3654a5002c0be477b8a1af8181cf3d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897608, "uuid": "e742ae2e-6cb1-4532-abae-42d89d16daed", "comment": "Malware payload", "value": "4b5d8a8c905da5eb5f0c6be22aff8e92495d8811663a0eeeb3c9c51274cac442fdf1046c9156d9383c6325099d07891e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897608, "uuid": "9fea9999-4bec-4e31-a2f5-b34cbe84c4b6", "value": "T1A69533CA6358385A5B1D545DA3AD6594475F01A2E3F4AB8F89BCBF0FE19221FD100CF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897608, "uuid": "db2d3319-08e9-4d47-84aa-8c9ab9478f16", "value": "49152:7SrhguoeEZyQmpNSObiKHhFiRyMv1Mnm+szq9E6DKmPpWkY8gcwWvZ9P:7yHE/mpNrzHmIuwRvPNY8LwWvZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897608, "uuid": "4b723756-eef2-4e35-bc3c-57b48f5800f0", "value": 2043666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897608, "uuid": "2b32304c-fbc1-482e-a869-67ed6b25e8f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897608, "uuid": "b3004e17-bd2a-4ea8-85e9-5bbf4672afd9", "value": "kryptoncrackby5ltq-2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e282102b-3e28-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776848074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848074, "uuid": "ab1e7f52-925d-4ade-ae51-d03669b7c13e", "comment": "Malware payload (Gafgyt)", "value": "00f39c7c2af999e59209fd73825c0a33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848074, "uuid": "7e50f325-d1a1-48b1-9481-98b65f982a18", "comment": "Malware payload (Gafgyt)", "value": "0f70443956f8340ec3a31ca44c34619a2ea1db1b07b68c06c5f4e72ae8581df8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848074, "uuid": "e6d05d95-60e3-4c4c-981d-39d07ebceebd", "comment": "Malware payload (Gafgyt)", "value": "f1dc8a97a05519c36ae5a8d1bb8649a2b1c96e8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848074, "uuid": "38e23789-eca7-4206-836c-65ce7e97b58d", "comment": "Malware payload (Gafgyt)", "value": "8080328181f4c2d30451c4e1c31721ad66cd598169281f88c8b56ab782f251a52afe9d93a76799f9f1b7e4a697c6aabe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848074, "uuid": "6fe68443-6e3a-4459-948c-0d04611fa941", "value": "T1A2F2E195822E8D62C42D66BB1A3BFA0E9524E30C5F388E9A7D9424324DF1DF5461F707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848074, "uuid": "cfec365b-4d32-47f4-afd0-e47bf36e9e58", "value": "768:exanFcsYB6qPln6z4LMBFmcY0TbAnbcuyD7UWyqcg:RcB6m6z4LoTTsnouy8Nqcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848074, "uuid": "23ee93de-f155-4eb0-a03b-741d69f09d9f", "value": 36852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848074, "uuid": "7af5dc57-82f1-4913-b5d9-33eefe1c939e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848074, "uuid": "3233d034-dcb1-4b09-8a97-6621578fe4d3", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fee8542-3e4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776863639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776863639, "uuid": "8501c17c-225d-4fd6-a2f2-5aaf9a549d4c", "comment": "Malware payload", "value": "a33798b8d2d931526b822399fd73640f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776863639, "uuid": "2d790c35-4d2f-405e-9c4e-5b78bacc209e", "comment": "Malware payload", "value": "0f85c4a2d65aac01de34898b7f23623c341341bab542b051720f7a715630808e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776863639, "uuid": "2572e37a-ec82-4633-8b7b-a8e17c0cf556", "comment": "Malware payload", "value": "63dfe66a44c03e9fba6d7eea8db1e045a4ff52ff", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776863639, "uuid": "6d4c81f4-f2dc-4c69-841c-8a958798f3cd", "comment": "Malware payload", "value": "294501acc01c1c5a657b1a56b7cdb1515c97de9078bc754f3d534220721387401ce8b8750ac7b25001c935b1fce30c3c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "s", "colour": "#C623EA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "soft", "colour": "#7A0DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776863639, "uuid": "3dbccf74-1d20-45d4-84f0-a41372a4eff7", "value": "T12AE533633BC68572D0D44BB8D7D66B7325BAE6464F38C5838ED444236FE86D0533A2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776863639, "uuid": "5706768a-b67f-4881-9880-8a7e6b0c2673", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776863639, "uuid": "f7754792-19b4-4ab0-b7c3-69000cda2f92", "value": "49152:Hh5hstvCSNrQ5cj2GrT54KNlajfaYMyWhm+mtLKS2kEu3hFu8pZen6XIeVM0JGSO:Hh5atKS5+JGrmKGeY7im+aLDle6/VjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776863639, "uuid": "48f23e94-52c6-4ff8-a6b3-87250c7b26a4", "value": 3238888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776863639, "uuid": "98f9847e-9edf-4857-ae36-c64836338e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776863639, "uuid": "4ca281e6-d649-422c-bc51-6c967686f3cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b1ee4a-3e1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776843994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843994, "uuid": "e4b09fb5-5467-4e28-9fa9-83f456dbbdaa", "comment": "Malware payload", "value": "eb39e66e6a08ca5e2fdee8e0c712c555", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843994, "uuid": "4a96244e-6d76-471d-b04c-81cd9c480a53", "comment": "Malware payload", "value": "1086fb4d7c6def17ee03d43e614092b2559141435097311d4f2f0035d67a118d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843994, "uuid": "cb9b522d-257c-4e16-a927-b7122fa5f4e5", "comment": "Malware payload", "value": "e7a5d57f56c19492dce13a33d3c75da70baa5bca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843994, "uuid": "dc92c0f4-08f7-4038-bcac-ed1cda898f0e", "comment": "Malware payload", "value": "5ac8e29a17c051c08aa1c011e873d9112aba51a06cc8bf64d69d6277018ab15c95d1a983ac99850b2a51179ceea00860", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843994, "uuid": "ee286d61-8548-454a-97f4-716b94ab356b", "value": "T1FE12F1487D81A06446B2F3775B6F844DF279893B09188941F88DD5D22F74B2883BEEBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843994, "uuid": "05504634-8fae-4911-a030-0b499b760cad", "value": "192:DS/8RYLJkM9EvMTXemCA1/ZkL81eSllS/V:G/YYtmGyj81eSls/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776843994, "uuid": "95320246-a288-4af0-9086-9983c5d79412", "value": 9143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776843994, "uuid": "5ddaeaa9-bc20-42b9-8f2a-30c450566c4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843994, "uuid": "597ab98b-4185-49d7-bcc8-99eb54cbafc5", "value": "dwg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac65bbd-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882287, "uuid": "33b66c75-a43b-4a96-a2e5-157b93cc2f90", "comment": "Malware payload (Mirai)", "value": "2149d8e10f9570cd5f64510d52eea942", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882287, "uuid": "233e44b2-810c-47c8-9ca1-d40676542e9b", "comment": "Malware payload (Mirai)", "value": "10d31706ddc67d7a7a398b09da17354b7118211e084c876329f548534fd6ad29", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882287, "uuid": "f66dbaca-91e7-4ace-81c0-75a36bbb8c00", "comment": "Malware payload (Mirai)", "value": "7313d5668802a908eabf29e93f64fed98ce21e3b", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882287, "uuid": "3615322c-9bbb-4eb8-bf6d-905fce86b4c6", "comment": "Malware payload (Mirai)", "value": "2c7de28a123c4a62675cec248edfb02085e45da2c9e64e130adec28659bd9d3e3e9807cedc0c3815996da614b4b8831e", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882287, "uuid": "bab6ad43-4f0a-4dd9-89ac-cdfb3a98f16c", "value": "T1E4757C2EB2B2B17CE04BC03457DFC6A25531B0B536323D7B37859A712E66CE16359B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882287, "uuid": "ab4f0250-285e-49e4-b873-fdcb5f71f3d9", "value": "24576:Nj2/rKjTnwaWPMz55NgES8bSyTgQLdVGSLh9ecUaqvqRzFu38yJuw4oIOTV5:x2GjTnwPPMF5NgnQguVtb38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882287, "uuid": "1247b79a-d1c9-4dd4-bb63-5b562a98f3da", "value": 1624464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882287, "uuid": "62892bb5-9e2d-4133-bda5-39964a04061e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882287, "uuid": "51e10324-aab5-4b44-9b1f-f51f3badba6e", "value": "bot_linux_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723506c8-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874085, "uuid": "5b9776d3-2aa6-4859-aae6-97d086630537", "comment": "Malware payload (Mirai)", "value": "9e7fcdc4561faed3f88fea71501556ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874085, "uuid": "57c31920-9a0a-4dda-8fc9-a35ad023cea2", "comment": "Malware payload (Mirai)", "value": "11101abc98f29e46cd16022395274c302260c69cdafdd9138bf025e24c3493ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874085, "uuid": "f7ed6134-673f-4789-89af-d84c3856085a", "comment": "Malware payload (Mirai)", "value": "8f7122bf7a897d7a487ce41dc0e8458c2cfa46fe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874085, "uuid": "af6d200e-a451-4e17-b792-67e8ec8b41ce", "comment": "Malware payload (Mirai)", "value": "4b30f47c0d60557d145e0fd8fc05acd89c01a8a56417e1547a3c2c688ef178e09333269ced5deac59efaa9b0b6701e75", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874085, "uuid": "b7c43bee-549f-4d7e-9bc3-7bb238be58e7", "value": "T1A9C56D027B1D09C7F1A71DB0263F17E9C7AE8AD631F8F186254EA9CA1375E3012467DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874085, "uuid": "5fc0dd97-933c-429e-ba3e-d0030bbccc7c", "value": "49152:sT2jc7PrVfnM2R/ejhTZQZpprBZ6TW51GukHrHqdaYZzrJvP1Lw3Z:sT2jcDrVfM2R/ejhTZGrB0TW51GukHrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874085, "uuid": "d60b5249-1953-4d38-8f33-3e651f0c6b39", "value": 2728204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874085, "uuid": "d08f7df5-e105-4b21-b59c-4c9c22ad99c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874085, "uuid": "a5b0832d-79d4-4758-9930-1a2b169a6b65", "value": "ciubuc_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93dec266-3e8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776891321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891321, "uuid": "f33cd3db-e487-4607-ad8a-5be04759e81f", "comment": "Malware payload", "value": "6d19860eeacd344b7a262a7575d64ad8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891321, "uuid": "8fb9f8b6-f987-4989-a450-4090553ac7d2", "comment": "Malware payload", "value": "11243a758410be8374c080e86cc3f737cb333bd3615219266ae44f3b3b166881", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891321, "uuid": "918d0b1b-73ca-44f5-9b7d-5438191e08da", "comment": "Malware payload", "value": "9df20290d8634e11113dfcf0cf4581bffae2a95b", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891321, "uuid": "6a97f920-c126-43ff-af37-1a70dae71659", "comment": "Malware payload", "value": "bbb90229c33d0ec219aebcff4cf221ba96e1c1224eb2e0e82eec2bbf5befcdc4d62adee280e0ebbd2f8b98e9ccee76be", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891321, "uuid": "2d822958-ef41-43ad-9c38-088f28f94ce3", "value": "T1B575220D6BE05183F5361B74ACF58365A339B970AB394A9F05489179CE133DA6E32BCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891321, "uuid": "50253244-4bad-4bef-bb38-454f749449cf", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891321, "uuid": "9192efe7-2198-4019-9fc2-f7e22231adc0", "value": "49152:wjuzVhRcKOZWtx/qGjoKJGbB2bs7J7ytz35:t2KqWtxjWH78z35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776891321, "uuid": "92f56114-99e6-4001-b5db-59a27b421711", "value": 1701968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776891321, "uuid": "f152a966-3a5f-4398-b2c3-0b22f4cf9b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891321, "uuid": "f8ed826e-dc48-41c0-bf0e-bac7e64a3767", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973ad618-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888750, "uuid": "66bef9dc-3d26-4eac-824d-ec8f3fee1e0f", "comment": "Malware payload (Gafgyt)", "value": "e1279fc04521ffd49cbedec8d8b08ff7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888750, "uuid": "3ac234f5-1b18-497e-a5f2-f51d0502072f", "comment": "Malware payload (Gafgyt)", "value": "11796c78b7b2949e19a9fac1e3b47fce2d65dcf4eb37b7acd8266929f164f843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888750, "uuid": "9e94380d-4093-4112-8fd2-31279f33594f", "comment": "Malware payload (Gafgyt)", "value": "7d9a430fef0af0229ea6af8e1b5d9dec9c57e4b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888750, "uuid": "ad42a94f-7529-446f-ba1e-868585fa7883", "comment": "Malware payload (Gafgyt)", "value": "639a06d91779f8c834cf9e0ac7dd3f19a2678fbb30fd50b86d5ed26c67c0f33a2c57b9c3466cb15be922b2d13e82bbf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888750, "uuid": "2cae15df-6870-4065-b993-37e5ace4728d", "value": "T115A32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888750, "uuid": "04e08f08-a9cf-491f-b605-ac7b3347bbcc", "value": "3072:1Sd+e6mKaGP0N4D3PpShtKmZuqQ4DPwXXtse:C6mxGP04D3PiKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888750, "uuid": "9e982166-232c-4fd6-9ea9-6c0521796150", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888750, "uuid": "5c576559-cc7d-4614-9619-41ca3ee930b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888750, "uuid": "b4f71101-9d27-4c88-ade4-49d071893b86", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d60c81-3e79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776882891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882891, "uuid": "c15be5be-704b-4ef8-8a54-24f6f16fba82", "comment": "Malware payload", "value": "6b58a030b69a9e19760cfc030c3af25c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882891, "uuid": "8223d2fc-9dc5-4741-8695-edaf88e156c9", "comment": "Malware payload", "value": "11f7d56dc27f17aa6cb8951934c6f9bc3b9c8033c3d411995c61e349845e8905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882891, "uuid": "06c4fcd1-a9fe-48f9-a77f-5b8049a2712a", "comment": "Malware payload", "value": "3f60b8ae077b4c1fbd721088481cd028ee3eda78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882891, "uuid": "7928f76a-ab3d-466e-8c35-c8f24403967d", "comment": "Malware payload", "value": "ee1ebcfb077839355b728fe4e1286ead2bf911de933381edcd83ad34ce654b312ebaeebf0817b78666dba01bad4f7791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882891, "uuid": "9956ddd7-e735-4ee7-9d6f-aeb1d31bad81", "value": "T18A83A84C23AC4A43FA7F9E7D647056178B72B522BD64FB4D088C91F824B2B91C614F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882891, "uuid": "bd61e198-1dcb-4688-99cb-057da6a8655a", "value": "1536:1I0QNeS4wWnclRLFA5vZ8ckR+vmymmXYD/rHMTFysPeYYm6avv16mc49/+CCrfBC:1I0QNeSMARLFA5vZ8ckR+vmymmXYD/Te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882891, "uuid": "492f2516-fe6d-48c6-87bf-ef1c2f37a393", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882891, "uuid": "294e60c3-bc39-4009-9b7a-d980c17b6a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882891, "uuid": "6a013318-7347-40a5-9cf8-936e90af1d35", "value": "Discord rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd95a14-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821892, "uuid": "8ce82c59-4258-431d-ab85-c5b2bb738e04", "comment": "Malware payload (Mirai)", "value": "3c620508896da2225bdc54b20777609e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821892, "uuid": "21ccb561-2a42-47b8-b87f-e1d93238c2fc", "comment": "Malware payload (Mirai)", "value": "121c4c8c0ae58e61e988bcce2c42b769ed3d2c440a1546e4642dcec8e75b5a74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821892, "uuid": "21551e0f-742d-4b91-83a4-16283193d6fe", "comment": "Malware payload (Mirai)", "value": "393819bd420ef8ec6a0368e48748edfa3f9f0cd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821892, "uuid": "566fd7ad-e4cb-451b-96aa-be617284a3cc", "comment": "Malware payload (Mirai)", "value": "042d2b4d5e14e401be7d59c11abc8af9a1c06e16e0234778cfe7f22080ced46807d42ba422dc025cb9008db9e14c241f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821892, "uuid": "e1f2e217-afe9-4410-be3b-02c651026cd0", "value": "T126837016BF611FF7EC9ACC338AA81745289D611E21A93B75B930D428F25F25F15E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821892, "uuid": "9f538bdf-fa60-4308-9f99-3b586a277e19", "value": "1536:FwRpHZ4tqJrQVw2HKW0Znwju4aLGZzLq0xd42+5:Fwf54t6Ow4KW+LGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821892, "uuid": "e94a7b27-8706-40aa-8592-17c908ab4b67", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821892, "uuid": "1ac4679b-98da-4072-93a0-13eb05e1c2f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821892, "uuid": "618bda8b-660e-40e1-b123-c1c7a7dfdc3c", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caed3b7c-3e8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776890125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890125, "uuid": "ac07f94a-e5f1-469d-949c-83340134a85e", "comment": "Malware payload", "value": "442d34ddf53b0e07461ea9882a40fd14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890125, "uuid": "38de6eae-a5c9-40f9-aca2-ae8d60a14237", "comment": "Malware payload", "value": "12d8bdc3c7e1a412a28d7ec917753bf4604bca164d450fd09c97bd7bd86273bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890125, "uuid": "4511df2d-ee7b-499d-97d5-06be0b5b8fac", "comment": "Malware payload", "value": "9015a27d3f059679f473fbc8b96919c81f9c67ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890125, "uuid": "a41628cd-5bc1-431a-86b9-77cc07feae3a", "comment": "Malware payload", "value": "0c9474a86b9b15a513376769d2bb2b9191fab4295187da74eb99faf5f9f819f6245d2e10b8a752fcae7633923f447ccc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890125, "uuid": "4ca0e9a6-6fcd-419c-8040-c888f4c67dad", "value": "T146352A57E66348ADC5BAC170835B9B72FD71F8255234A92F1B54CF362F21E60222EB34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890125, "uuid": "906255c8-80b1-46d0-aeee-43ad9c7572d5", "value": "c22836e71f653b8ba2a618f0cd86cf7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890125, "uuid": "fc844d7f-5d14-419e-8862-43ad788e4a1e", "value": "12288:pRtvEAPFeI42UPptlJ2hmg0E1mLZ6CmP1J:7tvEAPFexNPlJ2hmgpwmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776890125, "uuid": "6f57d491-ebef-4339-8fdc-6486da862e45", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776890125, "uuid": "406a526e-d594-45e3-9591-278def2ab61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890125, "uuid": "b5ffefb7-e6f7-4b9d-88c7-6ea59b803ed7", "value": "UMPDC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24008c0-3e14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776839510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839510, "uuid": "b08d1086-f2c7-4770-82b0-f92a8ff2df3d", "comment": "Malware payload", "value": "331768e73291d5c44cf46fe8150b57af", "object_relation": "md5", "Tag": [ { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839510, "uuid": "a8a751e4-b9f1-4463-a6bb-d82064adc338", "comment": "Malware payload", "value": "12f06298a5693988349a53aee9eb505060d5f69c622e7cb3f3970b38e6efbf62", "object_relation": "sha256", "Tag": [ { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839510, "uuid": "1eb22a5b-7dc0-44e0-a55b-5793f08c6b69", "comment": "Malware payload", "value": "97173d80926daec0741e20237c0501d52a79e746", "object_relation": "sha1", "Tag": [ { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839510, "uuid": "fa7a2200-9b41-45b8-8662-290c06b018e7", "comment": "Malware payload", "value": "b76275add5a54527691c1b32d70730ddef393ac2190d09e3752bfa1100ee8159109b7c9f38f0425ab892757840f1f48a", "object_relation": "sha3-384", "Tag": [ { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839510, "uuid": "5b4bc66b-da62-4c1c-b0a8-febbf9ebd34f", "value": "T17C23BF21B22F36CCCA6A77BD01B40693EA4DAD084933EB0B64D193342D579E91E1FB4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839510, "uuid": "33bde157-d5e7-4427-b583-0a6e769c13c6", "value": "768:0uXWrTdiV2ZA8XQ0nItejELLHKvjAFLJxM1iJZu9xwqpV4GJTs72IBP7:0cU0V2Zk0nIcjELcjAFVem8kigqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839510, "uuid": "be0aa27e-fd06-4fd1-9d28-135981514737", "value": 48871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839510, "uuid": "f04aa25a-a57f-464a-9377-c0c5fa5694e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839510, "uuid": "d0c32582-0636-4eea-8a51-1277bc3946f9", "value": "12f06298a5693988349a53aee9eb505060d5f69c622e7cb3f3970b38e6efbf62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952d3df0-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882304, "uuid": "fbcce796-9664-4654-ae67-10ba497ce26c", "comment": "Malware payload (Mirai)", "value": "c4244cb544d4d149d5925e98298cb51a", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882304, "uuid": "61815a15-e868-49ee-8488-e066d0157676", "comment": "Malware payload (Mirai)", "value": "13f39a2bf8277c15bfa776d66b0b18b817aab3218a489a9b668daf4d6023b380", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882304, "uuid": "fef729a3-2a6e-4c60-8919-82817bc2d6de", "comment": "Malware payload (Mirai)", "value": "99aac305cf3c68ee979f17718b0e286367ea031d", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882304, "uuid": "72435c63-1499-44ea-a62e-9d80af952292", "comment": "Malware payload (Mirai)", "value": "c0854e5c5637ca60b6e58d02c760a9ef7887eddd8670ca24a7555dffdde13ee812357bc8faa1d96428350eb36dca2f6d", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882304, "uuid": "8a222cc9-1b3c-4398-b49b-a8849a4b8f98", "value": "T129953A273348B785DF866C3BC59BFD103386758906524996BB40131FEBB5B2A8F4BA0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882304, "uuid": "d988180f-1ee6-4861-8f88-7bfbc4a19d45", "value": "24576:tB0ea2s4lDio6Ywrq4utuTpZBVaRwJFz9/veNovMs14PBMouodSwpyoUm7WsFKOL:tS2s4Nio6yIVN1/mNov2SwhSnbsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882304, "uuid": "d6b393ba-b29e-47d4-882f-89c94db0940e", "value": 1977704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882304, "uuid": "c2f98e1e-ea9b-4e3c-b029-d5b54e1d1b05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882304, "uuid": "39e51c80-df8a-4b84-99d3-720111a5b70e", "value": "bot_ppc64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5637e5-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897702, "uuid": "2763b118-3fcb-4635-b355-cc8cb3b2a7d9", "comment": "Malware payload", "value": "ba33808e650133bba8f903c42d21abda", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897702, "uuid": "9064148f-aed7-4121-b67a-681d9bb97070", "comment": "Malware payload", "value": "150e2a9f172ac5e9ef0426ee3739cfa58405e2fda778d1c7a6d4a9bf3fd22fa1", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897702, "uuid": "2e70dce9-7ec7-4d45-a14f-70009b9005ee", "comment": "Malware payload", "value": "245773abf01c7b4de4c8d32f5c76909263c7183d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897702, "uuid": "8db6960e-2c1a-4933-aaa7-800b44d4a050", "comment": "Malware payload", "value": "cf8ce9b2ec3e19d4982222b4675ed899274a661ea2fc6a937a35357dd5ecd6f857ad875ea8301425d9640e62497d1b53", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897702, "uuid": "9d6bb192-14a1-4411-bd3b-9554bad0f602", "value": "T18B45CF11F86F2878D8839731F2856931257D35C5DB1A3097BAEA8B0F6849BC4D34D3AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897702, "uuid": "bc447171-e185-4c0b-9f7d-ff932adc991a", "value": "24576:wfiX0WzVwnaSI/CfFRCyn7NuTWxdMtZDZTGXzEI6c+1dWX:wfiXVpwnaSIa9d7NKWMXDcnMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897702, "uuid": "fe67b1f0-cd9b-4652-9208-783b4ad5c242", "value": 1267197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897702, "uuid": "c35772cf-064a-4441-a389-6d9337e297f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897702, "uuid": "bec43a12-4966-4b4c-9055-1d0363622068", "value": "zbrV4-0.6.13mc1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074505eb-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875623, "uuid": "147077f5-6926-4377-82b1-832da566031b", "comment": "Malware payload (Mirai)", "value": "9ed0316ca1b6fa720cc0b1a86933b2f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875623, "uuid": "b2a05384-f4b0-46de-a863-a72959262697", "comment": "Malware payload (Mirai)", "value": "1561dbdb28eaccdb8c7829c72ad30752d6c368e2c3ac9967667f360042313528", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875623, "uuid": "5c3b33ba-1034-45c7-8dbe-7030eb619596", "comment": "Malware payload (Mirai)", "value": "5728c81969c9b01d451692da14d1913999a2b98b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875623, "uuid": "1388cd28-002d-4f1f-aec0-63ab66663244", "comment": "Malware payload (Mirai)", "value": "02b98a38d9bb8f0d6491e103d5ff78615bf377ef2d5a818728f091b55beb0df83c8ee083ede722f305f85762647a0b46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875623, "uuid": "4f747ad8-d8de-4425-8acb-e8b857d2cca0", "value": "T180930A45F9824F12C5D622BAFAAE018D33136BF9E3EA7102DD205F6437C559B0E73A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875623, "uuid": "e2ed81ac-32d3-49d6-8700-8ac68378cf5e", "value": "1536:CYnRJVNHuzPwJMwYN0P8an6v5M1crno2cCWPOt8CsrapgIbWlg6iiJjcw6bT:dnH0PfwIAfgymrno2/KOt8CsrapWdjcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875623, "uuid": "0366dc2b-597a-4501-825b-8e37ffd3b968", "value": 92948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875623, "uuid": "a1cbedae-f764-46b2-9974-59a1dd1da2b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875623, "uuid": "0c3296f2-5b8a-4a71-ba8a-5573ec0a6268", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa557a35-3e19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776841672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841672, "uuid": "f102a707-9cb7-42a4-b82a-2393495c74e9", "comment": "Malware payload", "value": "951fff0b670fb331a844bcba782e0c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841672, "uuid": "1d220682-f03d-408e-b8bc-343d90365ae1", "comment": "Malware payload", "value": "15715270d2827100b8baf79cd19cf824b18c650d8f83fdc271d4e999ac4174e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841672, "uuid": "d4710bb3-f482-4ebf-8caa-2cd3aebcfaff", "comment": "Malware payload", "value": "fa2622cb6686529e1b0030fb770a9f15fcbdcd84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841672, "uuid": "78d38885-5fe5-44c7-95a2-8d0f896bab81", "comment": "Malware payload", "value": "e10bce0310fafdc8b3f8a980f8c8d696a8dc06e4c1e748288745b6e8ec6b3b6e97f2969443c9ad74409c3eb029136987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841672, "uuid": "0bfa7cc8-23c7-4b92-840a-3ee9b4bbd97b", "value": "T1CA55027DE2E54F41D6A93E31C8EF1A1547B2F9A12233F70E261419AAFC437A59DC21E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841672, "uuid": "c2fa3c28-15ad-4e42-8b70-54d945768786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841672, "uuid": "52bda976-463c-4e9b-b28f-3d5c99a28067", "value": "24576:Bnpkc8YpBJHXNSCOfe3rFiAFPsrFvES6zezN6BOeLTczt23a:Bic3pz9SCz3wAFUL6zeZv8czF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776841672, "uuid": "86a290c8-046d-4013-8026-ba2d0a3c64a1", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776841672, "uuid": "ad18f134-535f-4d89-971e-ac075c3dfeef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841672, "uuid": "d542f2e9-a3ba-4951-a2ca-16a1c361831b", "value": "20260422_Price Request PWMT MY-Bhd.pdf(129KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23be11cd-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876960, "uuid": "45107a37-f0e3-4d4c-b118-ccd7741bd6e2", "comment": "Malware payload (Mirai)", "value": "9e8bce47127c726b52f5122ae10203d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876960, "uuid": "50f1cf28-bdc6-47cf-94da-5901998070e4", "comment": "Malware payload (Mirai)", "value": "158bb205f4bcadbe7a42806527e3b5ebe3f2e65991919d70dc7ce7c57b8d41aa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876960, "uuid": "919d087e-35d2-44a3-881e-fbfc1c610ea8", "comment": "Malware payload (Mirai)", "value": "97f46cffaa7d41c835521b60da58814ca2bdc4b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876960, "uuid": "44857ef4-6f0a-459d-9c68-e072868fffa4", "comment": "Malware payload (Mirai)", "value": "49ed7536739508bbca1e7f497f5bedce66e47569d4f1b945729b53f3bd6fcc5c5354efe948388f277337d97ec26acbd1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876960, "uuid": "9bbb415c-b99c-47e4-ac4a-8193cc97b4ff", "value": "T182735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876960, "uuid": "b4d8f216-8d2a-4c97-a4c8-aa655da35bbf", "value": "1536:jP+SbCGR18pspTH1mDQ2tXXUN95s0xwlWptCMR8/pW:zf4yVYpENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876960, "uuid": "5b41bb9d-325c-4a27-bca7-48b0f4fca2e2", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876960, "uuid": "a1aa45cc-06ad-44c9-890c-093d75caadd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876960, "uuid": "c4652267-e3e0-4de9-8a91-e1e196ae245e", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911a36f8-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874996, "uuid": "d1d97c6a-aa68-49bd-9d0f-349a2ef361c4", "comment": "Malware payload (Mirai)", "value": "1375ff444c167b642a6f7cc47ec2cd36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874996, "uuid": "4799af7f-51f4-44f6-81a7-79f25c28f556", "comment": "Malware payload (Mirai)", "value": "16d40bfe0ecd3cb3c2f7f93e1b5578b81be87ec349d065f174d8c9f01d5cb660", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874996, "uuid": "4da9ea9a-b1c0-4189-b041-d84569503877", "comment": "Malware payload (Mirai)", "value": "b1c82eeba8fef625618239171f8b8588f2351f4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874996, "uuid": "c7680522-c9fa-4197-92ea-1fc81c63694c", "comment": "Malware payload (Mirai)", "value": "4d468761a23a5216a53fea9960eda09431de6a63fc7c3af1538432f2d1b4b8d454156f9d753a619cd60f04acd8125625", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874996, "uuid": "4ca1ae6a-3a50-4618-960a-b52035544238", "value": "T1B714C70A3A228FEFF56D877147F34A30976976D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874996, "uuid": "f27f7eb6-1e69-4f14-9da0-4a1756b81a77", "value": "6144:456eQCbeoufx43df2dp06GtCqjYW8nY1j20WI:Dely43dfap06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874996, "uuid": "888c7cec-f672-475a-895a-34d414bfbe20", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874996, "uuid": "69ffdbf6-02d9-4466-ba60-458d25aed681", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874996, "uuid": "4fcc2ab3-af69-48b1-8406-87de3536db84", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3510469f-3e57-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776867969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867969, "uuid": "3bd78895-465a-48d0-b1db-4f46446be6de", "comment": "Malware payload", "value": "cb2d702aeb37410e71e09b314dd1cc7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867969, "uuid": "f9df8f86-49d2-466c-a19d-b27317b51a68", "comment": "Malware payload", "value": "16f75af75110e7a9aafe0bf5b6e3727c628edae8e131fbe23d87f9b1866d0be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867969, "uuid": "c5424a25-4565-40d3-b722-86020218546f", "comment": "Malware payload", "value": "0d53092ca23f71086769e710067d89e99579021e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867969, "uuid": "d37b862d-7275-4b3f-bef0-e3aed148056c", "comment": "Malware payload", "value": "d3bb1330466da6580a842f53b277490175207e84c04ec98d9c6a6e02961db5f5d7bbdb1a5a3f842d933b31a656f19a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867969, "uuid": "a71bd078-8704-4251-a0c5-305bb0dc2908", "value": "T1D7859F12B2C280B3C1261A344C6B63759939BF412F349A8B77E8FD5C5E367817D3A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867969, "uuid": "9840c745-b474-41ff-99a4-20f9ff4531a9", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867969, "uuid": "58c62a55-b982-4fc7-8b1c-32dc64dbee30", "value": "24576:jnsJ39LyjbJkQFMhmC+6GD9uKQG4IwQpOoPGtZW4WjKNS9cE5RkUNIFO:jnsHyjtk2MYC5GD/QVICoPGoQV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776867969, "uuid": "50a3f58b-6ee3-4988-86c3-c7fbeb30c551", "value": 1777664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776867969, "uuid": "a05d5061-1d83-442f-9c04-4f5d4b16c050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867969, "uuid": "c7d06676-d474-4d5c-8dc0-ee8554a9a1ad", "value": "\u5546\u5bb6\u7248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d6685a-3e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776855248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855248, "uuid": "a40afd18-fb03-45a1-b823-354e96e78a9a", "comment": "Malware payload", "value": "35aecdc039f326571a57f1878cae6a25", "object_relation": "md5", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855248, "uuid": "adb8e1b0-ba56-42f1-8908-840f56d829b3", "comment": "Malware payload", "value": "173e7420c9a9aa2ec9271c362a4c24b068e5bc8fceca5e036eb6abc88bd1ab0a", "object_relation": "sha256", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855248, "uuid": "ece96ead-d68f-4dc4-b69c-d053d05c1ebd", "comment": "Malware payload", "value": "b2840078c3e6d230987d2b3f81b4ec95566d00d2", "object_relation": "sha1", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855248, "uuid": "784ad530-c212-471b-99f8-0e26c3ca1c8b", "comment": "Malware payload", "value": "b892cb1d23c5b7f660daa0b89686faef8401ce74c59c311609a604ee94429629f875b8655f6b5a0ed9ec9c524583c913", "object_relation": "sha3-384", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855248, "uuid": "6f2d3b2b-9d3a-468f-83f2-2bfd348797dd", "value": "T114F4B5486EF721559263B07D9F6FA0067234E40B2909DE087E1C97E05F8963897F6FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855248, "uuid": "7b215229-0357-403f-ab1e-754aa459ef8c", "value": "12288:UEkjHaYhu/UwoxFBJvtpuL2BBC1A2Uhsv6uIFTLCNAuKS3X:IHaYhu/UNxFBNBI1A8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776855248, "uuid": "72e403c8-eb30-422d-a9ad-b9af2cfd9b15", "value": 773839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776855248, "uuid": "8544d07c-31d0-443a-9b49-b9f92cd04903", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855248, "uuid": "b6e23aa4-2608-4f5b-8dbd-6b4848606e54", "value": "251_cal3_darwin.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3497ac53-3e8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776890302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890302, "uuid": "efada565-b2be-4f02-a5be-c364e7352c50", "comment": "Malware payload", "value": "38f879740594383d28781920fd23e751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890302, "uuid": "c4c213dc-ae4f-4e5e-a4cb-a9d8fb4c96e3", "comment": "Malware payload", "value": "19841cf96f7974453b5aa09698f5d1884ec097c930340828abfd0d699b76b998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890302, "uuid": "494ef0e7-2167-4004-b6b8-3b87183bb2da", "comment": "Malware payload", "value": "8d2e61a63b08ab340e28945fd5460793472b9e5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890302, "uuid": "8afa9257-1045-43b0-835d-30b82ee6920e", "comment": "Malware payload", "value": "6a495acbcf4f64a4c6169f1bdb0b4080fd4fea7f3b9dbda4ea6dea4b323649cdf11d081a1a0309e0dc1ac1c3888f87a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890302, "uuid": "084184f0-38c2-47d9-9c72-61b19b47408f", "value": "T125B2862BFA63C8D9C686D3B5B1DBC975A470FDA508605A3803A043343E8B7589F7D6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890302, "uuid": "53a4d7e6-c2c0-432f-8c42-eeae2a8c4090", "value": "399764e258e0a1444004ed6b0b9164c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890302, "uuid": "cb1201aa-7b2d-41b3-b1aa-fc07c73a0352", "value": "384:v/Tooe4eZg0rAtQ+0KIztpOTkQn8U6cogei7:vLheC0UQ+0KS2Fn8Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776890302, "uuid": "59a647f7-8b8c-4bb7-ae7a-33ba80b52f37", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776890302, "uuid": "2309fa21-3aa7-46d2-8a0b-deafa3a10d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890302, "uuid": "ddcf47ce-2c10-4821-8ea8-0bd017c3fdad", "value": "stager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761ab893-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897714, "uuid": "c58d4c9a-8b43-457c-a592-55d360e1dae3", "comment": "Malware payload", "value": "9982a7e11d6ddd550d7ee346e8902a27", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897714, "uuid": "24081a47-51d9-49c1-983a-16eb46bdbc48", "comment": "Malware payload", "value": "19cd69a093a3e7dec7e6ae70460bc6d00ef76c59fc1f5928577fe5d443ad38fc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897714, "uuid": "0f1d4617-b671-44fb-a0cd-642b36db9be9", "comment": "Malware payload", "value": "a8c120faa95c93ad36fc45eb71ab4e2661b6cf13", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897714, "uuid": "cb1ee59c-d456-429f-9e6f-84b487b90782", "comment": "Malware payload", "value": "412463059db1e8393e71ab312bdd2f25285ba3f81660a8ffb261a232c80a051d35abf4d041a9ccbd2cfc6455b37efcaa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897714, "uuid": "f190bea4-6dca-4d9e-928b-c3fcc5dabe5e", "value": "T140E4022375B8113EDD3BE9B0F4A1C115E85CA0D5FC5F249790AD58DA6423EE6C3A238E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897714, "uuid": "b469c711-1a8f-47bd-8c29-c7effc7b77dc", "value": "12288:J3w2mldoOXanEk6Kb8llP34mmtXlmQh/ZHvLmAaSaSZEmIaMuh5O6QbfNkk8Hv8J:JAXdUx8MztUcvL0rCrIyh5i1kH85ThLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897714, "uuid": "0171fee8-02cc-42dc-b8fc-812017fb3442", "value": 693430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897714, "uuid": "492b4594-10ed-4fe3-9d60-78c49524558b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897714, "uuid": "8f1a7ebf-ab1b-4540-b30f-08ef608eef7f", "value": "zinc-1.21.4 4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06b9628-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876766, "uuid": "9c153101-3366-49f8-b139-69e7c00219f6", "comment": "Malware payload (Mirai)", "value": "546c045d2af72d5105de86151eec47f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876766, "uuid": "248b17ed-f299-4194-952b-f11780c9af78", "comment": "Malware payload (Mirai)", "value": "1ac91fd7f606aef934f93e9ddfd20c45fc2c9e26690efcc8b6399b8466a903df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876766, "uuid": "f78a1387-9be1-4b9d-b598-926726f665b9", "comment": "Malware payload (Mirai)", "value": "1b1982183d95a7a719d4f592a1737616dcb386fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876766, "uuid": "a94eeb7e-6a4b-4799-b538-0f8ab34fc5be", "comment": "Malware payload (Mirai)", "value": "426e388be408ae11c3c7ae4c99337ec97035858df2ce70105064b83c6da1dec384cf09a98824603959ac8a0daf395869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876766, "uuid": "9fb0f6e8-af0b-4cf7-9cbf-e2c4be172358", "value": "T1D2734B42731C0B47D0A35DF42E3F27D093BEAA9120E4FA85651E9B4692B5E331196FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876766, "uuid": "7f49a738-edec-4a39-b82b-f594d4fa7152", "value": "1536:fzAs6AEpRy5XGAkwYJzXah14IN7w+08WKF2Bs561d6ER:ftoRHk14I6+Rut9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876766, "uuid": "4910204e-2307-466d-9b8d-5031c77e3b32", "value": 77412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876766, "uuid": "3132b75d-d9cd-4219-99d7-f3c9c2fbb842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876766, "uuid": "52bee1c9-d372-4e3d-9da8-9bf55cc90bf1", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbbd667-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820870, "uuid": "3e8788bf-6671-4fbd-9c32-514160384435", "comment": "Malware payload (AgentTesla)", "value": "e93694c909deadfbd4897ada79f17cb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820870, "uuid": "d281df42-4f6a-41f7-ba44-0873350bb9e2", "comment": "Malware payload (AgentTesla)", "value": "1cc1bbe10193b91e4801e62e17662258d798d5942f21a098bac9ed32bfe31841", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820870, "uuid": "871b9ce1-50f1-4273-8be7-0bc1c35901e9", "comment": "Malware payload (AgentTesla)", "value": "9cc4c7983357d662dc52131090489a358ea1cd13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820870, "uuid": "8b4564f2-543b-4744-8065-2cdee6d98344", "comment": "Malware payload (AgentTesla)", "value": "7ce52ae7fd00720dc9edd96076b2d49e284fadaed35faa3943100d3267b672dea595eb2249b43f279168bd77a6194978", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820870, "uuid": "3311ba24-3141-4083-8a84-ca8ec55d1369", "value": "T1ABA280393AC46687C178B7B8E217E03C7F9279B9422461E6F3B2B593995C588DC61E30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820870, "uuid": "ea2c9bb5-5847-4c9e-8ef2-d9e771f36eac", "value": "384:DQQh5o6abUmeiaTLg9mEMRvd5n8KuRz7xlg3vsmggggggggggggggggggggggggt:DttoUXL8pMpd58Kig0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820870, "uuid": "f1df93bd-7a97-4520-9717-12db6de819f3", "value": 23290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820870, "uuid": "a4179e01-ed3d-4410-a54f-7dd89ef04529", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820870, "uuid": "9739c627-4496-40b2-8964-0b9d3efab42b", "value": "Nomina-20-04-2026.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b418685d-3e10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776837688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776837688, "uuid": "927d9ec7-ea34-4cc8-a51f-46d0f11df7eb", "comment": "Malware payload", "value": "dbb7dd9b2fdf0e041f3706366f529c3a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776837688, "uuid": "31a45554-f283-413d-9562-242af686c4ba", "comment": "Malware payload", "value": "1d083ffa4871913449aaac67b1195fa03dda6b366ca0e2061593f2aa8fbf9d5f", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776837688, "uuid": "1e4d6ccd-8be7-4211-bd4b-ab6c8984b69d", "comment": "Malware payload", "value": "0b747679b8293168ca0a3d4111fe04ca9ccb3bca", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776837688, "uuid": "507be562-381b-4c46-bfbe-7927c48b07b9", "comment": "Malware payload", "value": "193e7aa8349c045b2448585980a6e638b611df0b7558ce7a9bc9f49aa41481a9bb1163b39c558e48ef4c090d22d7f81c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776837688, "uuid": "b0cba1e0-fca8-46b5-a05d-151dd05cf96f", "value": "T1053309F07AC03854961753F4B95A58CAFA29DB47A33261368D8CE299BC4FC90DB831C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776837688, "uuid": "22095dc1-e358-4046-8b8a-08f125c5eb12", "value": "1536:pSZcBG8eGzbnBJ0ivakqtMlzU2E8AqJorAnofVDfyKlVRKrJdonfpah8iC67j2cX:MmS3jgM/hlps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776837688, "uuid": "a8b34260-81fa-4a9d-b331-50b373d48029", "value": 52694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776837688, "uuid": "4a25f1d7-8508-4257-b927-3a0e2fc1c57a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776837688, "uuid": "68a1b3c7-01a2-4c79-ae15-8340f10520c3", "value": "gskqf.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04ea229-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821871, "uuid": "0226e997-b300-4517-9c6d-89fe12909b38", "comment": "Malware payload (Mirai)", "value": "f38aeab75c3182a985a8fa74eabdc845", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821871, "uuid": "4ca66b89-f306-442a-9d72-3d6960add6f1", "comment": "Malware payload (Mirai)", "value": "1d08419e6618429b0d375278d23531aa9a71f5358a96e768dde04c018a6a30f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821871, "uuid": "856a6956-b383-4182-9e6b-5e1081f0e7f5", "comment": "Malware payload (Mirai)", "value": "88bb50540cbafea406e17cfd7aadb81451221e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821871, "uuid": "d90fbbd6-3fdf-469f-bfce-70601909dc4d", "comment": "Malware payload (Mirai)", "value": "bf938597b2b3fb292f1aab6a919dbbb54accca93b8b3c39b213965d50413086f84c9d3705c138985589408d161c5b995", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821871, "uuid": "d6704fb0-3936-4f3a-b932-aef9d9eb3a54", "value": "T1F0533A97B801AD3CFD1BE6BE80124A19FA22733015A31F2796A7FD835C731E56D1AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821871, "uuid": "6d66445f-3094-4bd7-871e-81bc7fef2631", "value": "768:mxerVdEc2FE/bove2wylzJ3Y95qysxWvmuN8pXPPC0qXxy1kXkAaEw:M4rEzhve2wW1K3lvPN8pXC0q81c3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821871, "uuid": "dda930d9-a857-4361-b44b-e4a43036c2e4", "value": 61760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821871, "uuid": "108d0d40-61c9-4458-9211-4b0b5e155053", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821871, "uuid": "c8dbd452-52a6-44b1-be2b-c3e525dd4d99", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c081ed70-3e44-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776860043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776860043, "uuid": "2a3af3c8-6edf-460f-ba26-460517d512ed", "comment": "Malware payload", "value": "b41d0cd22d5b3e3bdb795f81421a11cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LotusWiper", "colour": "#8022B5", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776860043, "uuid": "e24ef884-4736-4a58-8c25-ed1f9840da51", "comment": "Malware payload", "value": "1d6f374087087738b7699ebf91f1cfdb3b2a65c2e9be72e106ee7c9814be3274", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LotusWiper", "colour": "#8022B5", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776860043, "uuid": "93096afd-eb5f-4a70-98b2-3f905fcdf23d", "comment": "Malware payload", "value": "cadd0b1338bff0b09c932b2d52aca061bf38b188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LotusWiper", "colour": "#8022B5", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776860043, "uuid": "dde9a1da-b9c5-4097-8a01-8bf35c929786", "comment": "Malware payload", "value": "c6407f83f39c98c4c091c18fc8054980fb42364ba4ec0e0f46ddbf6f3d759031072f1100137642461f7aa019388fe062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LotusWiper", "colour": "#8022B5", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776860043, "uuid": "46d65369-758e-4916-ae93-8abde0e46036", "value": "T1E8A36B0178C1C476D57669320824CAB58B3EFD701F20AE6F77A8177E8F306D19A26D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776860043, "uuid": "b4d9b585-f646-49fb-bd67-0ee8026b5eb4", "value": "fe652d1bc5b478015cc82195b5b8e405", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776860043, "uuid": "3dbdfc40-60df-4efc-b566-60bac9ded4e8", "value": "3072:TWxaMkJlrXXpiE/Zbgg2C9yi50hpuftKpPf/moKX:6xMBXprGh4KsoKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776860043, "uuid": "9e14148d-07ae-406f-8f17-643756b72e88", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776860043, "uuid": "01f46f11-e5e6-4d4f-a568-7af4640a62c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776860043, "uuid": "603ccb61-9e59-49b5-83e2-84d12b0ed39c", "value": "1d6f374087087738b7699ebf91f1cfdb3b2a65c2e9be72e106ee7c9814be3274.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755686bd-3e47-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776861205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861205, "uuid": "33691945-9208-49ce-9339-bfca0f5b3539", "comment": "Malware payload", "value": "87d69899180ce536f88ad9c069950875", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861205, "uuid": "d0124023-b313-4bde-9a16-1f3427666e24", "comment": "Malware payload", "value": "1d738dd78140fdf699425380d9f5d2e02c333306c8819776d0ae5f1d07c2c055", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861205, "uuid": "b03f0f96-c318-48f3-8024-33b835496a7d", "comment": "Malware payload", "value": "310fc0cb5b2ded2e244efc5dc99544231f06cdb1", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861205, "uuid": "44f20ccb-0860-4f96-b7fe-ac4042437ac8", "comment": "Malware payload", "value": "13f757391776383019e7175f9efcc8b3a88dd016100c888548b16066eb1998fc1fbf5042089c73d54748a76456cae165", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861205, "uuid": "33b7fc15-6a79-4e54-a1ea-87e6a2128e13", "value": "T1AED31DC9498E84B9CBBF2828851F4D17CACEE22B020CC684BEDDAF553F2576575791E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861205, "uuid": "03053cf3-c4b4-43bf-821d-72bdbb0053de", "value": "3072:GmUO+UyYVesa1jjmr8w8df3tfRcx1YZLHbJKZZGQd9fVXCWFm5yUzxiNpcMNu9pY:GmUO7rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776861205, "uuid": "39f09d29-a617-4866-8704-3fb82a120d2e", "value": 134358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776861205, "uuid": "80945971-5bf8-48b7-9b14-94e5003631b8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861205, "uuid": "597d3957-46a2-4c22-a5c1-e7c29bc384f3", "value": "Edge_Logs_School_2620.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250085b9-3e9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776898007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776898007, "uuid": "705cbc3b-4148-4c72-8271-ef143ae44b9b", "comment": "Malware payload", "value": "0bd371db20011d28a29a453cab98c1fb", "object_relation": "md5", "Tag": [ { "name": "pw-8874", "colour": "#11D9BB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776898007, "uuid": "208389bc-6bcf-46ea-8efe-02556a46dcf2", "comment": "Malware payload", "value": "1e8ac46e8544859b660522bb6b69c8762cb4a92692d03cd1ae9f88b263095e28", "object_relation": "sha256", "Tag": [ { "name": "pw-8874", "colour": "#11D9BB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776898007, "uuid": "00fcad5e-4483-471d-bad7-b2f2d6954b67", "comment": "Malware payload", "value": "b6cdf1e619116bff378765bd23b463d02bc99b13", "object_relation": "sha1", "Tag": [ { "name": "pw-8874", "colour": "#11D9BB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776898007, "uuid": "df920c7e-5f39-4f55-a2ad-4aa847ef3aed", "comment": "Malware payload", "value": "1109dae026d2ff7b610908ac474cf2800c2face2366baded21ea88fa88923dbd9175c16e7d72a1de368403f7299bf9d7", "object_relation": "sha3-384", "Tag": [ { "name": "pw-8874", "colour": "#11D9BB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776898007, "uuid": "026e2da9-d29e-41df-bb0f-fe57522ffcde", "value": "T13707331B82356417DA774BCC0071F4AA7AAC64E7FD759CFC30396AD836C086A4E6D878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776898007, "uuid": "9f2a7a01-a703-4ca3-a4f4-6688dc976e88", "value": "393216:FnyNOaNQao5/aIjGWgXQQfDfotrATR+fFq2NaR2vBYQoh61:NOro5/cPzotrqR5P2pY5h61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776898007, "uuid": "08ae1670-7e9d-4ce6-86b1-4220687c1365", "value": 17768366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776898007, "uuid": "0c26ed53-d752-436c-887a-1189dd0677e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776898007, "uuid": "e04d7b06-c676-4c53-bc6f-76f10e22b958", "value": "Illustrator2026_31.0_x64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1292fd87-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894970, "uuid": "c8af02d8-fd48-46e3-8e9f-04658d4a1477", "comment": "Malware payload", "value": "cd95015edb17bb839a352ed614419fd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894970, "uuid": "808b5e9d-7e0e-4a8c-8540-73562acb65f7", "comment": "Malware payload", "value": "1e9440650545835ecf123987b6fbd13052dbda8d5d91f4a2790c1e021c9bf0e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894970, "uuid": "d232d92a-a0af-447b-9c6d-dc24888b5fec", "comment": "Malware payload", "value": "30097c4ac1a1e8639ccc1b3673844c97648e2905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894970, "uuid": "4a0999b4-3c22-4ff7-af3e-9d3668ba1619", "comment": "Malware payload", "value": "d221298c67c40dadfabca4c4d65ca807589f07f2bbc90096d419e5143072feb7d389f4e068116bf36cdda4c2265ac1a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894970, "uuid": "dc883404-a61d-4a02-bd2d-acbb81d623b0", "value": "T1C3660955BDC22F66C1DC137455FE625662603E458A92073323E4EBF83A7773CAF4A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894970, "uuid": "62dd60f2-6090-4773-b688-331e6f23dd4c", "value": "49152:pQUV2wIj4D4gRwl2RyU5vguYpZfuE5Y5Eh:pNUwi4DbevI+qEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894970, "uuid": "7e5b4048-0f11-4004-96e9-69fab2da27f5", "value": 6750392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894970, "uuid": "84c035c9-f48b-48c8-b6ae-23ad28bb394d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894970, "uuid": "97d3714a-23fb-46e1-bcb6-7b025a92fee9", "value": "h2rapidreset.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4794e11b-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876161, "uuid": "8fbee536-bcda-4cec-b706-0aafe19f7ddc", "comment": "Malware payload (Mirai)", "value": "9f2300e2789d7f0bcd2ad0b6efd5e029", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876161, "uuid": "238890fd-8a92-4450-9999-a1d1849375fc", "comment": "Malware payload (Mirai)", "value": "1eda520b3107b28579305cc1b00c99a61100f15ffef56a1c04ddad10e83ba117", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876161, "uuid": "0d352be6-58ee-4b56-9d13-61699dfe69cd", "comment": "Malware payload (Mirai)", "value": "e2d4baad479fe423bf91c69575a027a4af47b5f2", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876161, "uuid": "52f967cc-abe6-4e04-a93e-918fb41068e0", "comment": "Malware payload (Mirai)", "value": "a8d365c8374459a1729797e6439506e6f9850aad5934da1de89ddbed12b732a421ca8b18a147fde71c33b2dc07ea91ea", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876161, "uuid": "6a6f30e4-e458-4a03-b760-5e2d49fe7c9b", "value": "T1CCA2E117D562EC22DEF01277F41D93846BCB5B34D0FFF8DA8216C0182A425917A67159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876161, "uuid": "a22af12d-e042-4e8a-9628-61ece2217c63", "value": "384:TYrwtW123jsdYmXfu3UCamvODTi5f6LuhsKSbSTJ+7YeERN52WWwLaTmdGU57D+:YdjWJjGLuSpc/v5ewL83Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876161, "uuid": "3cd90b44-e2ef-4f0d-84f2-43a4067f78df", "value": 23272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876161, "uuid": "f665a362-9537-46ec-a138-7e217e0956ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876161, "uuid": "4a797d30-052b-4e00-ac12-66f33d74d7b7", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95b3967-3e5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776869882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869882, "uuid": "88449bf9-43ca-40f3-a78c-933d9fb510d4", "comment": "Malware payload", "value": "d22d0f4b9e9f1c86c98f3ce5701d1439", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869882, "uuid": "bf84dcaa-fcab-4991-8bd8-a7875c48b50d", "comment": "Malware payload", "value": "1feea0fb9e74f08c7954c3e438a1af857a3d394a397dba0b4534ed4edf4d8086", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869882, "uuid": "ab729e43-1163-4572-8cf7-e8c512a1003f", "comment": "Malware payload", "value": "45c7ea59cf05e977f83ecb398dfcbc4179a946ab", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869882, "uuid": "bf95a3a5-3da5-4cb4-bf97-92ddf5f0466e", "comment": "Malware payload", "value": "578add9b2f62f7f38526d0fd17cc073dc59b4ea2c7a4add2be6263be794d9fc4242dae00e9394c89c49f94875e52f66a", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869882, "uuid": "a40344c5-0348-4381-a65c-2cde3ddfe894", "value": "T180612AC4BB3C0A2CE15B42BB78E552E6656C06962E94CF4BA0A48EF35D1B322D493860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869882, "uuid": "cf72c3bb-795d-44da-9725-e440a49ac7f4", "value": "48:dn9othnooOT1/qVbqdGIVp4NWjORVFQ55AsybKpGbDtzD1thJYERaSuXWBZv:dnOn584VbqdTp4jZvsybKYb1lJYE5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776869882, "uuid": "90806223-6bcc-450e-ae4c-917fffb725d2", "value": 3272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776869882, "uuid": "820c1a90-5035-4341-a313-0cb888ee37f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869882, "uuid": "2bb3ef19-e5c9-4252-9ea6-9eb2e3176c72", "value": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d363f4a-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895041, "uuid": "72883945-e87d-407a-b58c-33ebf400a690", "comment": "Malware payload", "value": "2bfcb23455418494f7fef2df617fbbe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895041, "uuid": "78111bab-f455-4fb0-8ee2-c1b0b31ea409", "comment": "Malware payload", "value": "203e34c51743ea1a6cb6d6c85b39c36a560b20bd2feb7c07af708a404eeb687f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895041, "uuid": "5e1a069c-0d8a-4432-b8af-b3ef7b935193", "comment": "Malware payload", "value": "13755be585919f96f32f945847feb690bad19d49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895041, "uuid": "a0cd1d2a-b826-43e6-b8f8-6753c7dd533f", "comment": "Malware payload", "value": "59f1bf30501b28b4b21aa02ce9f591dbca307f5903104e042163ccea3281b58c774bcdf609636baad50783e86a9505de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895041, "uuid": "adce3c26-3af7-4a4e-b6da-386160c29a37", "value": "T149562987B8924942C4E43677BDBE81C433636EBA9B8752566D04FE383EBE1D90E35344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895041, "uuid": "9077205d-6783-4b95-a924-35fdeffe9d0e", "value": "49152:l68E/TD9dBey1UqWu+IwNu4bk6B+ibFv5r4n5Ed:l68wToy1UqBKtJF8Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895041, "uuid": "74553fc0-cc29-4e26-a8fc-f4b4f9911146", "value": 6029496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895041, "uuid": "e3dd1681-ee86-48c2-abac-5f43ddd83235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895041, "uuid": "378091c6-592d-4e70-bcd5-c5c041e9d59a", "value": "h2stream.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1c96d2-3e56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776867579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867579, "uuid": "116dd103-58f2-4fca-af57-e1c61ab58040", "comment": "Malware payload", "value": "338bbb92eac945166f7292c7856fdc55", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867579, "uuid": "99068017-46ef-411c-ad03-db4837e595ae", "comment": "Malware payload", "value": "21c07c68a32d37b4dfcdcf4d321e26105f7f41a079d7a6e9c66867737409a935", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867579, "uuid": "0b04b334-3bff-4691-ab84-7f55e6414b1c", "comment": "Malware payload", "value": "800fab454788ea11e6953f2c6b3ffa6b126110ec", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867579, "uuid": "b7dcdb5b-2489-4723-90bc-c1b7de4ea51f", "comment": "Malware payload", "value": "6bd5b19f8c6ec49529b6b3866348a046a6a916bceaaf330e6cdc2e37099abdef9afb3902b869a88bab868e1a5dd51ebf", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867579, "uuid": "e1ee19e6-c66d-4798-885d-d7b2d3f21c1e", "value": "T11392841AA91000169537C3B8DF63974EF73241178342866A7FEC52525FB6C94AAB3FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867579, "uuid": "4ab72651-322b-40be-b288-6bec64316ebe", "value": "384:8zLkP3SXZVG4YG+YIp3mJDwMsR5HsnF/jUk4iIiwiyiiiMk4i+Yivdin/ijiftQx:83A3SXZYzuXsRRsnhjUkVlNbLMkV+1vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776867579, "uuid": "5fd445f3-e703-40f6-948f-741719be0b74", "value": 20176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776867579, "uuid": "ae67d78b-3a19-4480-a34a-0bbd34316aca", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867579, "uuid": "d90e9c63-f9b3-4d99-9629-6609f5100580", "value": "21c07c68a32d37b4dfcdcf4d321e26105f7f41a079d7a6e9c66867737409a935.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1accc47b-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884676, "uuid": "1d9801a0-72a8-4205-92c4-e9262665e89c", "comment": "Malware payload", "value": "0a05f467a6cd5719343bc055a27e8c8e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884676, "uuid": "e35ad848-cfea-4255-a25b-69726a8bb85f", "comment": "Malware payload", "value": "228b0cc6406cf2f7d24aa3686cb6231c44134d0896bf7e11abddfa3c78f770b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884676, "uuid": "a3b37c5c-3fdd-42bb-a30a-1c8dbc3c46cc", "comment": "Malware payload", "value": "28e1c6be9ac7dab76ac2e824ca2771c9d7f45ba6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884676, "uuid": "4fb5b51c-300d-4295-8eba-db8700b986b2", "comment": "Malware payload", "value": "2af9b1f369052bc1b222e096c28d27b50b1cc439bffa62d58c0e7cbb9bce6bc2e7aa1517f3fc1adc7457c473cd9c9d89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884676, "uuid": "fdc93fe5-6659-4e2a-bdf5-2f464df3a49c", "value": "T127160933A59145E4C2EED574C6256213BEE0389B273423DB7BD0A6E11B76FE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884676, "uuid": "2e63a8e0-b00a-4c23-9a15-c6518aa96b4a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQj:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884676, "uuid": "67a0059b-e9b3-459f-8f6a-f7f69a33775d", "value": 4325376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884676, "uuid": "b7560439-e0b3-4e36-9cbf-1ccfcec25e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884676, "uuid": "f14f9e5c-f4e2-4a6c-94ef-57222ed089e2", "value": "228b0cc6406cf2f7d24aa3686cb6231c44134d0896bf7e11abddfa3c78f770b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a87edfe-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876622, "uuid": "029f0c78-7513-438a-ab7c-aeaa7c4c7571", "comment": "Malware payload (Mirai)", "value": "70d5e333c6cacf8605f91ce64a0a6533", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876622, "uuid": "79f255ca-4d85-420e-b3f0-8ccd054bbd94", "comment": "Malware payload (Mirai)", "value": "22eace6298be01df01409e74534c0fec22d6527a786f2a934a71f9ed5c1b6a58", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876622, "uuid": "2fb6e704-0e7a-40fd-a1ef-9c6f420b282e", "comment": "Malware payload (Mirai)", "value": "851694612a1d5f5d440938a537930e5da9fdd962", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876622, "uuid": "1897d9f6-7fd5-46c2-9b7b-ab73da46e3a9", "comment": "Malware payload (Mirai)", "value": "ab27a6716220cd8a9f7acad0952e0e1209cdab49ff45d2eda04fa6e04d77e10451e6b0d650dfd730fc178879a2d32993", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876622, "uuid": "f80c6bff-c40b-488f-a7c4-4af81c290e51", "value": "T11CF2F151A48298B3F5D16736F83D930562D93EF8D9E1712B29303B189789362A1FC3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876622, "uuid": "bf8df310-58da-4ee4-a2a1-5f53278efab6", "value": "768:dE0anU+dRP2QDd4gMCKkLqxsFK67RZa8D5RVzVSBViwm3aVZEs3Uoz1:dE0aUSR9DYClAwf7R5RVpHw/hz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876622, "uuid": "9f38aa4a-eea3-431d-b04b-70bee9b82164", "value": 37472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876622, "uuid": "dbb3a03f-7167-44ab-b71a-5b2d0eadf4ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876622, "uuid": "899cca57-5890-4607-b0e2-5b6a02e07923", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e502ef7-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1776884682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884682, "uuid": "2f39331f-57d5-4f3f-973f-3dadab8fcb10", "comment": "Malware payload (Prometei)", "value": "d42196effec0d82cd9a215c111e14742", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884682, "uuid": "96695734-d81c-4219-bdbc-e97330d2bb1b", "comment": "Malware payload (Prometei)", "value": "232bee8de476e68cb04df514bf349a5c4fa6507997f0a215804b44a81997a03b", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884682, "uuid": "f2b30af6-0fd2-4b87-8518-acae5a82c6e4", "comment": "Malware payload (Prometei)", "value": "9eddd66b82b53b6d5f9e180eb14306e3a5ba20fe", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884682, "uuid": "9236c046-6b8a-4e37-a814-a6bbc2f679b0", "comment": "Malware payload (Prometei)", "value": "5f69a15d2d881a197ea1355316ca83404b10544cc42e2c0ed2cebe8791499b82021614dc4c79d7e568e1079b63b2aa2f", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884682, "uuid": "c2508cc4-363a-457a-8e59-b36129719a6f", "value": "T125746D01335E9AD7F167187060583A735DBCD630E36F18B6F7C56C89346CAC0A6A8B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884682, "uuid": "bd8d002d-1cd7-4f33-a3f2-3e331189ba9e", "value": "11d7574f4124bae26b618543eea709ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884682, "uuid": "2c50a378-0dd0-473c-a5eb-0e2209fa70ef", "value": "6144:ZgMd4GJFql8YVyJKuwXDXDWmWdfjly2kjuC7h:n4B8YVyJKuwrSmWdRgrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884682, "uuid": "e4df56bc-0783-468f-a08d-a32558413f50", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884682, "uuid": "2f715d03-b026-43a9-b5f2-44ba4b890f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884682, "uuid": "c6c4e283-b629-4a22-a4df-85f9e99bb1d8", "value": "232bee8de476e68cb04df514bf349a5c4fa6507997f0a215804b44a81997a03b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14beb6db-3e38-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854601, "uuid": "16fa95cb-952c-4a49-978b-bc41053bc94a", "comment": "Malware payload", "value": "c6e1fccd34284b5c1d4d25966feebad4", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854601, "uuid": "be34b311-cc45-48ee-9d77-ae0774a59075", "comment": "Malware payload", "value": "24269ae7a306178f21a7e0b4502358d1d0931eded86c3a9caa5ea8471ba34ce3", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854601, "uuid": "a45628e1-04ca-4ae3-9043-61ddedf8fbdb", "comment": "Malware payload", "value": "13f49291e8b0f7fab61bba83333c5747a667683e", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854601, "uuid": "d23cd8ea-29fc-496b-882e-ab321f55d427", "comment": "Malware payload", "value": "19044b40c66f3a032b95f8e56d4a469d4849f1a709e62a10cdf45c4c5d65cd211de88e504a90f9804a6eacdf9ca31c77", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854601, "uuid": "e758d86c-737d-42a7-877f-d2f72d26de21", "value": "T1BE558E6D97A322C1DA7AA70426AA391D433E4C5F14F23A497F0D2FDD1F14A7A17B809C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854601, "uuid": "8de44d75-601f-4e49-a716-dad1206c45e4", "value": "24576:Frb7yxKk0/u/MjMRR+Athg+TOedbWums7yxKk0/u/MjMRR+Athg+TOedbWumR:FrVC0+JC0+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854601, "uuid": "81ff7ead-bec3-4e45-906b-310214d78e66", "value": 1354867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854601, "uuid": "9fce36b6-9b26-453a-808c-348ec4e2cb1c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854601, "uuid": "f9f6549c-6a78-4ab5-924c-2a5ca8f48a88", "value": "251_6yg_darwin.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a4e34a-3e7a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776883239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776883239, "uuid": "5b6fe5ad-77b8-47ca-932c-97b764306c60", "comment": "Malware payload", "value": "23e258e1c76fb021ba94b9d58f6388af", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776883239, "uuid": "32616327-a600-4316-8caf-29e5d44f65a2", "comment": "Malware payload", "value": "24345524cfaf21a4a31e842dc9977ae38bef48d54b162640716eff968ccbd2a7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776883239, "uuid": "1d6d76d9-863e-4039-9d03-bd3e5203ef23", "comment": "Malware payload", "value": "1f3f54bdebaee1c57b8a31364caf4044ca44cf4e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776883239, "uuid": "0082992e-d7d2-4b67-b478-191c9f4a0d0f", "comment": "Malware payload", "value": "ca3df520f4f798843ccfe98f01c5f1951e48c2ad7faf3540b92aac9e0b8c50fbedd0e34aad883d5fc2dda6bb66912a06", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776883239, "uuid": "3999bf6b-f1d4-421f-a51c-e1cee4baecd5", "value": "T16CA54931779AC12BD96215B06A2CCBDF6168BBB11F7250C793D81E6E04B48D29732E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776883239, "uuid": "4a6df990-0dc6-42ed-bea3-2f6094c318f3", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776883239, "uuid": "f29a5748-18c1-4b46-b3a7-03303ca933ef", "value": "49152:CfImZfi2k8XXSSRrHWaVFuHT8xyMdV9zCbo5UD/Va+FN/BJ9+mIY:iImZBk8XXSSRr2aVFuHIxbX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776883239, "uuid": "6dc02620-4abd-4e2c-8bf9-3a06033853e7", "value": 2189312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776883239, "uuid": "727e88de-7838-45ee-8342-0483c89c8ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776883239, "uuid": "d3674f19-cf32-4ac3-ae3b-82bc587dd8c1", "value": "ClaimingAlyssia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f60f45d-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876630, "uuid": "8bd37db2-f2b1-4cbd-9591-f6c8cb663016", "comment": "Malware payload (Mirai)", "value": "b71ce028693114e575a440e53f55fbfa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876630, "uuid": "0f1a7f40-3127-4198-81c0-f54f9b1363b7", "comment": "Malware payload (Mirai)", "value": "2459df010a422704aca659d62eca7ebcf37c4d6474c1c2bef6c7db09b5fea58b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876630, "uuid": "76d960fa-7014-43cd-830e-305199441fb4", "comment": "Malware payload (Mirai)", "value": "63e2e786f2e0f12958b80e078d1524e37f3cebeb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876630, "uuid": "312f09dc-e530-44ce-ac48-5e57c2b2a0ac", "comment": "Malware payload (Mirai)", "value": "8c4ef7cd7fc92776b7b9aca56d4209fb941c67c38cd7fdd5f2a3cde4e6085e86be097b22ecabb6c9c1acdc33cee0f78b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876630, "uuid": "444337b1-b01c-4809-a4c5-afbc414517cf", "value": "T13503E194C2318E73EAB11C79E29C4AC22D6713D920FFB383714962B4B756646F1FA943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876630, "uuid": "47a39b70-fa4d-4a67-8ab9-b91c45c314c4", "value": "768:f04CCQup1yJWpChh9y2J+pasa/B3FSxSC5s976hBIqp5nzEVjR98z9q3UELox:f0TupMJXhhnIYs6rClO97SIi5Y398yLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876630, "uuid": "60d55d0d-6bdb-4b24-b4a4-b64078e04877", "value": 40040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876630, "uuid": "2b06d982-2e69-454b-8b41-b712c0c35fe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876630, "uuid": "6b6fb106-fe14-4c29-b918-3f37001c2243", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4be7120-3e9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897443, "uuid": "9c302b69-0cad-46d0-aeb7-75e34934f655", "comment": "Malware payload", "value": "c272bb504020a7f12cbce21b7ab38c30", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897443, "uuid": "8d43661d-fe0a-4de3-b733-76689734e6e4", "comment": "Malware payload", "value": "246f4ebb058af0d43c4c3cd97df8d70c0ea7ad2cbddb4115e5e438762206efa5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897443, "uuid": "0e834f11-c0a8-4f91-9398-9152a7ad37a2", "comment": "Malware payload", "value": "ffe282f0c2724cc5c8b12e923c6b880e3672d639", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897443, "uuid": "0d016889-7bca-4e20-b7fc-85503b317886", "comment": "Malware payload", "value": "96e74df13c970878361a20ef52c2aaf82c2a24cde226731f296eba274bb7a355e411823c8aa0993d170e90337f9f1c1c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897443, "uuid": "628cd1bb-46f8-49ae-aea6-f0c804847701", "value": "T1A32533C9C1D6ED07E04E43A20EB89CE09861B4971C8E1DFA789C296D8D674E3967347F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897443, "uuid": "04f9cb17-101a-4628-ac8e-ca44c1d8bc81", "value": "24576:XTpwrpS7ZArhDx+UkeGmdIbuB/W6sfL2E1fet19LtH9JsZ:XT6rpS6FDdkHm+bM/Wf2Est19RHYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897443, "uuid": "0088e2e5-6cfb-485c-97ff-d2ddfd0eb8bf", "value": 1029645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897443, "uuid": "4944199f-7646-428e-b240-7b60ea886d6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897443, "uuid": "89f2f8fb-92b4-4d3f-b1d9-27b8d3f799a3", "value": "246f4ebb058af0d43c4c3cd97df8d70c0ea7ad2cbddb4115e5e438762206efa5.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8a7333-3e8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776889859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889859, "uuid": "b9ce0a50-e9e0-4a39-bf3f-a53ce9c31a25", "comment": "Malware payload", "value": "4e648c27528a70175c756f56a00900bc", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889859, "uuid": "5cba0cb9-8a9e-4841-8520-76be775f2ca4", "comment": "Malware payload", "value": "24e21c35c70f25c2b9dbb627f602805cf6f976df4f3a78f4f31e7b874fd3f1a0", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889859, "uuid": "8a46b8e5-7eb2-4f23-a574-9bf4f88cfcaf", "comment": "Malware payload", "value": "99d910e88368a912567f45a3002a70cbef7a79f6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889859, "uuid": "fc6bcd01-b97a-4a41-89d8-dab161b381f4", "comment": "Malware payload", "value": "7fc6fce6d0810d74247b63c68b62604785f8f49a44430d764f60d7972b7d66e169e4fb47b4bc18cc5219cb9ad8de6e7f", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889859, "uuid": "b6afbac7-dfa7-46a6-94be-87a7817d27ed", "value": "T11C762381BAD9CAF4C48F46E0670550EE708E219FD6BD467D3ECA8C11ABB0D5D446E3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889859, "uuid": "f1276d7a-adaa-40c1-b0b3-53476080a23d", "value": "f3201d8cf27e3b4846984664d5bfd984", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889859, "uuid": "4dfc2b5e-84ce-4a9f-9e67-1ea24086d782", "value": "196608:QUmGGWU2erkVFBIwWEKKkerrPk+t4nr8:xPeAVFB7FkgDtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776889859, "uuid": "37bf9f9e-74a0-4a7f-b8c5-1803f1d118e3", "value": 7563776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776889859, "uuid": "3706793d-e582-4c8e-8697-6c155cb9b279", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889859, "uuid": "c0e11740-44a7-437e-9659-98f338a780d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a60ccdf-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894956, "uuid": "eb033002-c16d-4a2d-8648-8cbd0093bc6c", "comment": "Malware payload", "value": "d56d2c0d849bac38f965266f8cfcd0cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894956, "uuid": "d72f8d1b-d575-49aa-8505-e126e3544a27", "comment": "Malware payload", "value": "24eebf16af67ad105c9aefa2d82a0ebbbd3ea0d3f0e313e15c6d294f7f1166f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894956, "uuid": "f29a4e19-35ed-463d-a01a-e8b6f9c7ae5a", "comment": "Malware payload", "value": "9234849b89167b25d480e2a6fbc8fb51a948d257", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894956, "uuid": "dc3ce19f-2f6a-40f9-95c7-95e109311869", "comment": "Malware payload", "value": "9b42699240c158aecace8cb0b243b5992a10bb4c236566bbb04523e5a9ceb74a121a87472ba24503fd6f68c93dc7542e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894956, "uuid": "9ab19da0-b126-450b-9e66-59f1426a019b", "value": "T155662862BF58DE4FD29632314AA6C23873D13D0481B021379756FB1D1EBE2A09D6BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894956, "uuid": "305b3f03-3412-48e1-b893-bd1711cfbd2c", "value": "49152:mHn+/I+svwYbBLgxx1Y4Z2CPoTHxvt5Eb:mTQjPyRvjEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894956, "uuid": "ba41739b-26e4-4f28-8b51-63da0c531f5a", "value": 6750392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894956, "uuid": "68f7f4c2-2ce3-4d7e-aa0c-40207aef7931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894956, "uuid": "21be957c-1533-43c0-85d2-4ce535ce37a5", "value": "h2stream.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ceb8de-3e15-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776839788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839788, "uuid": "06a2f5a2-7f78-4b77-89f0-05e2b40092cc", "comment": "Malware payload (AgentTesla)", "value": "abdd87514c16e520e1a741ad972f726a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839788, "uuid": "23392dcb-b3e6-4594-825b-f90891d7e74d", "comment": "Malware payload (AgentTesla)", "value": "25054755292895d7d738467d0a700a5a6514524bab6934c9dd4dd28fd761a10e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839788, "uuid": "d8856768-2428-4978-b140-6bb7d3276aca", "comment": "Malware payload (AgentTesla)", "value": "538cd1351d5513b470ab3122479deacb4167f2a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839788, "uuid": "6693cab1-7ec7-4d42-b2a2-681c364f5d0f", "comment": "Malware payload (AgentTesla)", "value": "b82ffe86efc4da3f399d944c10de444843b67000e79368423ae440e4e76c494b0008b7f3c35dd2c2e2b8263753cb5b53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839788, "uuid": "47ea0086-3ace-4cec-822d-caa85d19673e", "value": "T151071F037E48EB11E1A83E3B92EF6D2413B2B0C71633D20F6F49AB6618516525D7E72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839788, "uuid": "498d5d6a-8599-406d-a0ad-e2c8aa2e8a4d", "value": "3072:DlIja/OSw0wAWa93/9oWKc96YaLy5fRZjgCz:BIja/OSw0wAWa93/97KJYaLsj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839788, "uuid": "33f90151-691d-470a-b1ec-6b01e4e5cc70", "value": 17178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839788, "uuid": "f0a76f69-e6e5-409b-add6-3fcd7921376b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839788, "uuid": "6139f44a-cbad-4261-b2d3-eeeec98625d1", "value": "25054755292895d7d738467d0a700a5a6514524bab6934c9dd4dd28fd761a10e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafed0a5-3e49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776862262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862262, "uuid": "e83d6184-c78a-49d8-aa3a-bd0faadad2fb", "comment": "Malware payload", "value": "8bfd80556f162c0381167b55c24001f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862262, "uuid": "86b0bda8-f959-4bde-9f09-1440a675c5d8", "comment": "Malware payload", "value": "2541379f2b166a3f7de1926ddbe814311f1fc4869994f2d6f9712d2fa9476e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862262, "uuid": "ed299515-b4cc-4707-af9d-91b8ea14cb0c", "comment": "Malware payload", "value": "170a3a9b7cd9077f0e9f3eb34c532a5d5bb5c4b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862262, "uuid": "79b9ef34-954a-4bce-b259-bf28c0d1a2a6", "comment": "Malware payload", "value": "e7a9a891c21e848cd06dc59320fb31e998a7f9e5b5e3cf2c4e58a33a0647a7d7805e971820b433623df97ca65f0afd6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862262, "uuid": "3abbcbda-c1e8-4951-8e57-8b5397d3f2d0", "value": "T14703B81ACD1AA47FD35A8CB8C5134D06DE627CD7DBD1B5CF6B400DEA09A2E949B3D202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862262, "uuid": "20031e78-bfa6-4ba7-a293-df4c5d64d2af", "value": "123c0ab67bc4e623189ad913fcf2cd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862262, "uuid": "0884b798-1976-49c9-bc37-588baad0a7f5", "value": "384:KFimt6UPlRgFu3EconMCXjV4t0DLyWGLw8p8I/nWQoig8STRuZoijtBKYkOlCtN3:KzhgveUfcUQo+SKuu/yiAQU4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776862262, "uuid": "d09e28a5-b708-4207-a43f-ca99302a6b74", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776862262, "uuid": "cae78c55-d5ea-4c02-9b4f-6df1e51f85c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862262, "uuid": "8f5c8e89-dea2-4da5-990f-8e351a6cb200", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de8b8b5-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875661, "uuid": "3b91ae6a-d271-4e08-b138-cd851d23962e", "comment": "Malware payload", "value": "0f26d5a6ead856ef53fc4c705a9ddbd1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875661, "uuid": "8d4b2b72-6106-41fa-97f5-4f421e106ea5", "comment": "Malware payload", "value": "2627d0e6e3e0f073f4e93bdb0c6945c7f7b564232cec79454d828e8fd7269180", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875661, "uuid": "dd8606ec-9cea-42a6-911e-0445393ad27f", "comment": "Malware payload", "value": "5fa1bee0e16349db53137cf38378c10094b26771", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875661, "uuid": "fa9a6e14-b382-425b-acdc-3dc62daf6be7", "comment": "Malware payload", "value": "e3fe19fefe31807d9b603c04ddf27f20dc636d59fbbe92fd12a481f8d808a3807ddfd72a88b9b0ae1838f4670d38fc06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875661, "uuid": "71b5d52b-aaf2-4592-818b-9c212a1d41bd", "value": "T19DA67B47B8924956C4E43A37BCBE81C433634EB98BC7165B6D05FA387ABE1D90E39344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875661, "uuid": "a3f889d3-21a9-4a4d-93ed-2b97817f2d14", "value": "98304:7R4okRV31c4y5FhLWZZXZpT8KiExIuRsnXvzc1qJq0MMfwx3IL:7KV1c4y5FhwBZpT8MxIuRsbc3MfPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875661, "uuid": "2b9521b1-dc32-4103-9f2a-c29c47c797d5", "value": 10207801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875661, "uuid": "1d1e6638-3ce8-4f8d-b55b-3b07e5538b18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875661, "uuid": "1b53bbf4-6ded-4729-86ca-b131871716e5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e41865-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888692, "uuid": "5ba3fbd4-dd8c-41a1-a0f1-791f6e8bd669", "comment": "Malware payload (Gafgyt)", "value": "6cec28aa9c5ccf6b43738a78ed7b9f43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888692, "uuid": "9f731e45-b89e-41b9-81ea-05fcb92331d2", "comment": "Malware payload (Gafgyt)", "value": "267da67cb171033f8071bde68dd26e797455550452e28bb06a53bbcdb69a9a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888692, "uuid": "49f8ae8d-8ed3-48aa-9ddd-3af8456abcbd", "comment": "Malware payload (Gafgyt)", "value": "82e8dedc157c16253f12f1ea27d40dc38ef0a7cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888692, "uuid": "9e084a65-6a51-4bee-966b-5843c2d55bc8", "comment": "Malware payload (Gafgyt)", "value": "6ac77e2350130fdbf92c5a8ee22f33b434445d54e567efd358098f0a010a65377a2895f4c495bdab93e330e3539501da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888692, "uuid": "e7cb3945-dd9f-4b7f-bc89-f3a5234f2f96", "value": "T12E833B02E643C6B3CC8307B2029BAE661931BDAA5E2ADF49F31D7DF49B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888692, "uuid": "5505e985-abda-4692-b7e7-402c5066003e", "value": "1536:qr5b1ZU4d3J6lreu5r4hWj8LqGDloRmF+wVOz+sXcfW7k:wb1ZU4ZJ6liuq0YWGoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888692, "uuid": "def357e1-081a-4a78-9da3-34d58adf89a4", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888692, "uuid": "3537f95d-b2f7-4a7f-800a-372d802e39b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888692, "uuid": "feaae8e8-6c67-453f-b1ce-52ef5c812eba", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578bc778-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897662, "uuid": "951f771a-b8e2-462f-87c8-02f8b04420ba", "comment": "Malware payload", "value": "5e2d5161c0f864468c38f4f1c9d38210", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897662, "uuid": "4164e5d8-e12d-4e28-ace2-a1d75973fb55", "comment": "Malware payload", "value": "26828384f855db5877b6d5268745334be3eb42f8ab5aa9c8c354f18f02503b3b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897662, "uuid": "dfe1023f-6ed4-435f-b283-7a8f76ad9474", "comment": "Malware payload", "value": "4334cfefbee68114fa503ba3008ea3c0fd6b904b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897662, "uuid": "5bc09b1c-496d-4022-ab9a-0edece723fdf", "comment": "Malware payload", "value": "21c04d293661846853e6fbb8a6127bff9291d05101bdfe85b91112505d4662f221941b36c3374d045af1b0ac1c10c575", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897662, "uuid": "49f8b5cd-99d9-4c93-a497-0346fb7fe57f", "value": "T180853331F04D2DA4C4C7F6FA8242096C35F5F25531DC2D8615DB0EDDE16A8A7AB0CAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897662, "uuid": "8a73cd43-ea00-4ceb-9736-60addb507dc0", "value": "24576:kBuj5Q/jmG9pBSH+NV4jOvxzXSebT9KWRlPFz7pHmjXP0rDl25b2HY1mu:qE5QSUpWGVzvMc9KIlPFyXZDmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897662, "uuid": "7560431a-8d54-4404-ae50-d7ac7f3af5d8", "value": 1705510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897662, "uuid": "a712115f-7229-4a9e-bfe0-1a7f1fd42b2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897662, "uuid": "7d2d5b8e-cadc-4974-8ff6-82cd53d5a684", "value": "Prestige-1.21.11 (4).zip.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b4ab64-3e57-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776868019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868019, "uuid": "2749c7fd-612a-439a-a9f2-7026a5ab6d43", "comment": "Malware payload", "value": "9c256ee0d49b6d3d11ffb7199f1c4272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868019, "uuid": "7c1d493d-495f-4c47-a6e9-273122f476c1", "comment": "Malware payload", "value": "26d67030c87fe26194c0e77caaf0a4305d59081b25275af4d4b4b7f1c2403392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868019, "uuid": "47f6e16d-f31f-453a-a6c8-6af55108b86b", "comment": "Malware payload", "value": "acb0620e90d2c5c3f5a0167f89504e40c4fc4020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868019, "uuid": "5e4c8076-8f24-4fee-a84d-713068da84dc", "comment": "Malware payload", "value": "2e3d2f0f0e50d951619986a3aa485b82bce12b8bb8f8fc0b9e1a0d7be3c14354676da4135c545fe419d89b15d58cc5a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "XRedRAT", "colour": "#17F038", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868019, "uuid": "db1b270f-2987-498a-9c64-04d9aa980a94", "value": "T14E86F112B3C04472D1638D36483BEBB5F5BADE652A214967F7E8FD942D321A1E3121B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868019, "uuid": "8077cdc8-12f0-410d-a3bd-ad2cbfde4c03", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868019, "uuid": "03027539-9967-44c9-8194-b9cf25022b42", "value": "98304:znsmtk2amSzom3OstJBAUZLVf0jBCMu78PDoRE2fDkKfkQpLyYbj+vFo9rRk4RtC:LL8estJVmjsMu78roRrDkEBwvsXSf+b6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776868019, "uuid": "5e536202-71c5-439e-b7ba-431f05258afd", "value": 8097792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776868019, "uuid": "0eaa6cbd-98d8-40a8-a6c0-d986114a833d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868019, "uuid": "8598c794-2c81-4aa9-9794-961e93e29ff7", "value": "\u6700\u65b0\u7248\u6536\u83dc\u8f6f\u4ef6\u3010\u5185\u90e8\u7248\u3011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48c92ce-3e5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776869901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869901, "uuid": "b995bab0-c929-4e8a-af08-ee423ed6787b", "comment": "Malware payload", "value": "83c0c504b4d2ca6dd931f25edddf31c1", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869901, "uuid": "abcf27dd-15db-4e94-b2c7-a683947181c5", "comment": "Malware payload", "value": "286640beb0eae8359a4c78ac95b293392943088c60823f7fc269a4488316d885", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869901, "uuid": "4cd99dde-aaa8-43ad-89d0-c3d6061b026b", "comment": "Malware payload", "value": "0b098323c285dd18f3377c6766166f88e3729cc5", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869901, "uuid": "b09f8549-63b8-4f52-b3fd-84b5881286b5", "comment": "Malware payload", "value": "650ce6fda61b971ba02365bd327f7df26883b643bdd62e373935dfd10d4154a608fab735905423fcae8a5228859b7a1a", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869901, "uuid": "298276ff-fc14-43d1-ae04-1d9dd84ceb3d", "value": "T157D533909F667CBB05DC931931BFFE56A3B60B95808CC2E367D424DB00ADB06835BD99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869901, "uuid": "330173fe-8fe6-4c99-bf4b-44c5466d5634", "value": "24576:Qj9QklY1ig4vPwc7wVsNYMcTaAOXUDnhiXnMCGuupGAujoffYjn+2A3JqR3gkj9X:P9U7F+TIofgq2xFo+7WIQ6Dn3nQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776869901, "uuid": "637cdb0c-b73b-453f-95dd-bc605f0efc34", "value": 2985222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776869901, "uuid": "dfe70cd0-18af-42ed-9d2c-a1b1a45e7205", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869901, "uuid": "17321101-cc44-42cd-9b74-4064b1deffb8", "value": "286640beb0eae8359a4c78ac95b293392943088c60823f7fc269a4488316d885.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16413449-3e1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776841718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841718, "uuid": "1c71b148-2f8b-40c9-9893-da887e5a7f0b", "comment": "Malware payload", "value": "0d7d664772494a70097bf1a9e39a0452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841718, "uuid": "11e4febf-b06b-439e-8615-3f9b27905d81", "comment": "Malware payload", "value": "2979b071d06461137deeaf6c36c7fe9bd6c7cb4bc80c051c9450895f6dd78204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841718, "uuid": "ae28433b-a042-433d-a3bc-d90ac417e1f2", "comment": "Malware payload", "value": "fbc03317abb058f303f0f3636e3d3967245c7bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841718, "uuid": "be9c5f57-0749-44ca-a203-3e55f1b1135e", "comment": "Malware payload", "value": "470452cd536867ebe36dceb2f5ecfd028e3ff6b7b643f4c6699a3828855b7b4141fea8201517b184ca415cdf9acdec49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841718, "uuid": "326dd07f-732f-4472-839b-d53a71cb2d49", "value": "T1B475DF616BE81F50F1BF9B3984B44555CBF3BC07AF32DB8D7854358D2932A818662B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841718, "uuid": "be070305-d01b-4053-a84f-a4d20fa6e8e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841718, "uuid": "ee052153-51a3-4b14-907c-327d97df5eca", "value": "24576:iwnLGcXdMDC/eH9B+VOqIPr/G3nqc8Mci7:ZLzdM+/zVfIK3noMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776841718, "uuid": "a9ab2602-1f85-4c48-9cf0-59229418dbb4", "value": 1695232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776841718, "uuid": "f2c8267e-287c-49e2-94bd-5db10fca90b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841718, "uuid": "7ead8398-3b2c-4edd-8a43-108f271d5770", "value": "COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64366ba5-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895107, "uuid": "c6937cc7-a1a8-462a-bd78-622dcd72848f", "comment": "Malware payload", "value": "514d7cfc5034542c77afc25c7667e01c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895107, "uuid": "298f2a2a-0d6f-4ed4-9636-0989c2bdf701", "comment": "Malware payload", "value": "29b37e818a304fc002f404d2a230bb449f77d251a181f3c1933d52f59e06eaba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895107, "uuid": "c903ffe5-db0e-41ef-bf7e-b88c7481813e", "comment": "Malware payload", "value": "eb72e43851ab0e1cc1e3a4024ff36d4aaf65474d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895107, "uuid": "91092e5d-b9f3-4814-9734-d18d30a09313", "comment": "Malware payload", "value": "de633cb468ff1b36be6778ce11dfccb1ea535bd264a0377179f495e8010a40a4ac302be4efab7c2c3582089db3f676be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895107, "uuid": "7af28041-59be-4845-b122-4ea51ce4a8ef", "value": "T169765C09FD649FA1C6A402B689B412582370AC036FCB4717A235F73CFCB66D4EF86695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895107, "uuid": "817055af-2930-482a-8caa-3e716781fa0d", "value": "49152:LFTwHMOyvGHkAqiHewHkfKEyp3oyP6FXJ1wPssG8I0kdIf3uxAu30l9cYqEPUXyt:MMOyvWqiHewHkfKEypV3UEPjVKEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895107, "uuid": "a7d9e059-94bd-48de-8ed0-ea5d8a2a8095", "value": 7143608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895107, "uuid": "b70617fc-9a12-4142-9236-cc2db02b1ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895107, "uuid": "a5748756-c32a-41ca-8851-29de9dc3b84f", "value": "h3flood.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01179064-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776877331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877331, "uuid": "67413aa0-f7bb-46b3-ac1f-8dd9c577505f", "comment": "Malware payload", "value": "5596c14c8af9d1c178a4bd2a079f653c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877331, "uuid": "26cc7a59-e134-4f85-a51c-a8d5f2864f30", "comment": "Malware payload", "value": "29e2376d593762c4885badde243775bf7290ae975fd2dd7fed80447cc57bc9ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877331, "uuid": "f7e0c2fb-8c91-4ed8-b237-f55f5099efbf", "comment": "Malware payload", "value": "1c757604f7aee3866bb9a3b332ce68208f7c2751", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877331, "uuid": "ee6300d2-6a10-4777-9f67-9f67cb370c03", "comment": "Malware payload", "value": "c3debb6c2c84415de9e33aabf7bbd11bd4864eab7e8bb5d34d73e95c218564464bc0d9c1e00c249212eecf2078df1219", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877331, "uuid": "5ea2a937-9836-44f6-9add-53b8e1504a84", "value": "T186B6AE43E8A105E9C5A9D230C9B39253BE717C591B3263D32B90F3786F76BC46AB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877331, "uuid": "8f85747a-41c3-48df-9b3e-39f5e8a397cc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877331, "uuid": "eb1daa8b-d6d7-4e73-8e6d-f552a680e684", "value": "98304:bLy8W3DZT/03QQvrDicEPsYTdnAbGGsU4n5fWRBHC9xKVBM:bW84DZBQvCVEYTlUGbYRpCyVBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877331, "uuid": "dee37df2-3d7f-44c4-9248-6a9197cc3c97", "value": 10660352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877331, "uuid": "bad8970d-b4d1-4df8-b638-0627aa1b656f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877331, "uuid": "a9041273-dd9d-4af8-9617-e387da778362", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc5468d-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877322, "uuid": "473ce992-e62f-431d-a85d-32ca5559a5cc", "comment": "Malware payload (Mirai)", "value": "d4cc40aca32b9fd888819edcb1681673", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877322, "uuid": "8ac6946f-2e8d-4726-b318-b54fb14df60b", "comment": "Malware payload (Mirai)", "value": "2b4e02de815286946c55dd7ae2cd35fd2df2d93352110271f75a6b13d95c4047", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877322, "uuid": "ee628a8a-9bb3-4975-b842-9045cb780223", "comment": "Malware payload (Mirai)", "value": "f4ba1fae2afed65a01de99df74c40217a7139b61", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877322, "uuid": "dacc9440-1f5b-41a5-a22a-2676cd85ec19", "comment": "Malware payload (Mirai)", "value": "cf60e51eaacf471d5d437149146f05345ba924f6a203b28c94493bdf71ffe68fb643f4f4b19e98ac32761a1c1d01af5f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877322, "uuid": "daaeb32f-ab7c-4053-a4f3-3aaf34494715", "value": "T103F31B46F8818B11D5C111BAFE1E128E37131BB8E2DF72129D246F65778A97F0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877322, "uuid": "9a7ae373-f487-409d-af4a-972b4ae96586", "value": "3072:SFtcp03pPoPXJMU0X/nO0Xj3yETFaTJNPFB8PrPq5s:SFOO3toxMXPO0XbyExavkPrPq5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877322, "uuid": "d7ad5b08-65e3-4143-a5ac-817a85bece11", "value": 160828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877322, "uuid": "735a8ba6-ef5a-4cfb-989b-e70566f3ea92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877322, "uuid": "c577e3e5-09c3-49b0-850d-a4bd6539799f", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a496309-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875629, "uuid": "072713c2-6bbc-48ce-a719-9848391878fa", "comment": "Malware payload (Mirai)", "value": "741f58d7c3bd03d04be00011b1231b81", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875629, "uuid": "46231bc3-e5c9-4a94-a300-19a48868d6b3", "comment": "Malware payload (Mirai)", "value": "2bdfc74b900e086c6bb1278cdb72bd4de6b3aea855937f34bd729d21c9bdf512", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875629, "uuid": "af80ca6d-5630-4efb-be9b-5befd4490f15", "comment": "Malware payload (Mirai)", "value": "3e748efaaa30edc58cd909cf634bd3d00456dc2c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875629, "uuid": "5f483da8-76f5-4ba0-becf-cf97e88f4b35", "comment": "Malware payload (Mirai)", "value": "821b01068b342d37036a2d5997df17992c4bd70eebdd5218334666597de11d37b6d03b899c3864e106c2d25137c57349", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875629, "uuid": "a2de1b4f-1bbf-45e7-a861-6e946fd00a4e", "value": "T17B14961E6E228F7EF669837047F78E245B5837DA16E1D680E1ACD5101F202DE641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875629, "uuid": "7ffdd8bb-c668-442e-8a52-b4e40b4032e1", "value": "3072:xFwjJ/XEcjNQ6A2nrILykYQvPwTosD0jIypaTC5GS:xFwjdXEcvrILy+TsD1OaW5GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875629, "uuid": "96de8368-10d0-4ea7-a47d-227fd6874eaf", "value": 207120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875629, "uuid": "a8928e7d-8811-4e99-bb20-ab073b5625b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875629, "uuid": "91474dfd-5f48-46cd-9a89-b6c83979c79e", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee85ef2-3de3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776818379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776818379, "uuid": "f80c0db9-1851-4c68-988d-b24f79f22c23", "comment": "Malware payload", "value": "0d9c1f77b616713891cb0e49b5bc3aae", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776818379, "uuid": "25e680be-0935-4f8b-b5bd-0d04f4198b79", "comment": "Malware payload", "value": "2be571050cdcacd920c7f67a592f3c2454d5eec21163ffee62413add7c067c83", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776818379, "uuid": "63ccf70d-0501-401c-a062-338d9f5fe4a1", "comment": "Malware payload", "value": "eacbffcd359560e88c3081657d94bc05e6cebb0e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776818379, "uuid": "cd982774-f6b2-471c-9eca-933fb30b333e", "comment": "Malware payload", "value": "330650347cead7496a53a62a68037b0a8c3e68fb444222f4265cf6aa2702fc1fb5ad7be10c46f7e78dd48c4779856e30", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776818379, "uuid": "ba0a2476-d7d8-4d6f-821b-ec8e547fefb9", "value": "T1C5846C307A462EFF5BB820C248D6851C563C62B9C9282CE579CF0CA22F1D77627B7975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776818379, "uuid": "6a8ad747-b703-45c8-a36d-3b9e391d3689", "value": "6144:d6NX3LyKTgH+g4EGbm6WE0yI5LICLJlRAidFEG90csf0B0C:d6NryK0H+DWE0yWLICL1lLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776818379, "uuid": "cbb47f5d-46b9-4adc-a364-fac78713bb8a", "value": 380501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776818379, "uuid": "27b77bc5-1b6f-4d2b-9bbc-6fd551dccddc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776818379, "uuid": "1b117a40-0e5f-4069-bbbf-da9684edbadb", "value": "onedrive-sync.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fda958-3e56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776867843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867843, "uuid": "26d8f3b6-6976-4fab-ad66-89f2a72a8bda", "comment": "Malware payload", "value": "35956895c3e0e955a0e8f6b18e2c0e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867843, "uuid": "ad07e3d4-a047-4931-861f-4e5529d04a69", "comment": "Malware payload", "value": "2cae0bd8e9fc6d05239790712547a2e6b3a0eedc6b2e6e32282f44ff20b8da78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867843, "uuid": "c07dfd44-18fd-4e80-b83e-0326a630a97b", "comment": "Malware payload", "value": "9728c7c0be8136dfebae628b0c42684b6605782a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867843, "uuid": "951aa708-eda8-4a3a-9d47-5087cdc81e5d", "comment": "Malware payload", "value": "e4dd4c46cc7e0c577ed0b49b1e61f805f8a05dff1e5d0242f50db1fcbdaaf74f5427beb68ab87fbce9de1daec82c0f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867843, "uuid": "e9c94eab-9863-4eee-b193-7a93b741897c", "value": "T1EAD73353F245653DC89A67300277A90069FB7E58F172BE2921E4F9DDCB328C10E7AE16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867843, "uuid": "997495ce-d96d-4102-8b4d-b67b11903d0e", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867843, "uuid": "8474d9ef-fe02-4fff-b5d7-164816ea916a", "value": "1572864:ASjP/QthF70AAK2rOprWoSiehHcc/RDMHB:1UDlWoSieh8c/R4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776867843, "uuid": "b5db4a79-9145-4c42-9f48-811a3b76defc", "value": 58771018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776867843, "uuid": "fba73c4f-205a-4bbd-a00c-91bf0846ff2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867843, "uuid": "1aa78a5a-3310-49ee-bff5-1c48ef58fea1", "value": "Chormex33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ac5b38-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888727, "uuid": "f69bc437-ed11-4332-8cbb-3a42a085f037", "comment": "Malware payload (Gafgyt)", "value": "834a5478fa3f900d830c85c74e647871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888727, "uuid": "ab4d382e-ba43-4087-a419-ba5f856dc5f8", "comment": "Malware payload (Gafgyt)", "value": "2cf3d3fcdb6f2e131d07533a06bf0f1e867bb1c709d42848b084a770e2eb36d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888727, "uuid": "9019dc01-5e57-4c86-8d4c-bb8890fa8ba1", "comment": "Malware payload (Gafgyt)", "value": "0253ff4d5f6e07a0487217724fd3689dd0f61f1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888727, "uuid": "8eccb0cc-6d7f-4545-b709-dfff4ceb79ed", "comment": "Malware payload (Gafgyt)", "value": "3e651c3c20b89b31c460d3ea822b2b1f30c070b3a1a6cfe0eba715781168644285dbdcca2b69f02d54b64839d490fbc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888727, "uuid": "dec5ebf3-d776-4787-bf86-5009f1a8dc9d", "value": "T161B31845F8408727C3D327BAE78E478D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888727, "uuid": "dc2cea0b-b127-4369-acbb-63b67870dbe0", "value": "3072:MSk+U6m1qW/w8clPbiRq6AmkZrQAhPDCXFke:U6mgW/1clPXmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888727, "uuid": "24761715-2c58-4969-9c98-ac2cc4993057", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888727, "uuid": "d652bd7f-f9c5-4975-a3b4-a26c6169e8b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888727, "uuid": "2b1fdedd-7d15-41b1-a35b-3a09846dea58", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9f9341-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876196, "uuid": "33b3cf43-4f9c-43e1-b578-ffd49ad63ae8", "comment": "Malware payload (Mirai)", "value": "230df5cdbd9973889cda65c577b8cb08", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876196, "uuid": "f78f5b07-f8d1-4818-b447-f2a3e9a82af1", "comment": "Malware payload (Mirai)", "value": "2d087a3663d5c325e9884ace959da019ea2c51509389733a08602de18f41ff0e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876196, "uuid": "11d2d84e-4830-435d-ad96-5f7a6382736e", "comment": "Malware payload (Mirai)", "value": "34cb87e6f3c76a15eb65f262be4c65b93bd15dd9", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876196, "uuid": "a84a361a-8998-4634-bda3-ea1af38dbe7f", "comment": "Malware payload (Mirai)", "value": "4d5687809268f1b0ff0958f587f5b25c77c721f5a1364fd30e867d6ab5929bdfc1a1b6205af108bd251ff3cc1eaea9a1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876196, "uuid": "11df41ab-652b-477f-a212-07384d9bb486", "value": "T101A2D0635B782757E5E6C5B32CE3FBCC58A63441ECBE49276AA8B9A78113418C143C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876196, "uuid": "bdf06740-9e15-44d4-9bc0-cf1d7202369a", "value": "384:0w7yO5i9MOcClUMLQRx398wC0yT8j9sWIgc+e5xXoEkDwvMwl1QfQMo1v9:0ME/c0XLQjNdC0cDWIgcloBDXw3Eox9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876196, "uuid": "ac4087bd-6298-4e4e-b64f-b4b58c63a571", "value": 21628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876196, "uuid": "e15b86b2-0b67-489c-8cd6-c3f7b0c9d0e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876196, "uuid": "3e237c30-ab5e-46e9-8516-76196be61128", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2965a783-3e34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776852917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776852917, "uuid": "e566d13f-ec56-4c4b-8ecb-f33076fe98e4", "comment": "Malware payload", "value": "07e9f0b8627a95960e79e930fb099e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776852917, "uuid": "720ae99b-6c29-4c3c-a1ef-3ebc629072c3", "comment": "Malware payload", "value": "2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776852917, "uuid": "e14b7ff9-2376-49ca-822a-894e9704eb3d", "comment": "Malware payload", "value": "56bee9df5833a637f5c54d5911df98b0812fe643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776852917, "uuid": "a133e859-9aaf-4656-bd3d-e7f2cfef0bb9", "comment": "Malware payload", "value": "76472a8f17ca642137f8624f844fb7f0a00efcdcf3bb40dcfa80d7e7e8345a4f5d4908b5b2487a0e3b77c4a8679dc906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776852917, "uuid": "322720a3-40bd-4db2-97dc-7a84e18aa858", "value": "T1DA924BD9493850C6DDABA83182EAED677C3DB7C307114AEB01A4F4A81E877D5E734A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776852917, "uuid": "6cf58493-be41-4c93-b896-f50c8baf84bd", "value": "47c3554d0dee53d4f925ed52484bea12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776852917, "uuid": "e5890437-2195-495d-81af-1a6d25113b5a", "value": "192:NNp/y5vzVXpWlVHMEc+Pbp5GBe1VfNEwm1ahYCydn2O8xYqD0cSX01k9z3AT/ipe:NN85rVXcLr7GBJ1ah3yqvDyR9za/io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776852917, "uuid": "7e67a4b2-47d1-416f-a10d-8882f61f6d14", "value": 19672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776852917, "uuid": "d6310483-8ead-4cf6-98e6-91c43e39ff3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776852917, "uuid": "9d545db1-f33f-4798-b01c-d82e408b7532", "value": "l6o3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97325733-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884455, "uuid": "ec8ea48f-ec28-4142-bc5b-8ef792580475", "comment": "Malware payload", "value": "687af4d054311a9ff8c0cdcbeaa2e8bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884455, "uuid": "030f1915-9d36-433d-9b63-72ecad28fa08", "comment": "Malware payload", "value": "2df8db7486db8179a3a9ec7814f0c8188379c860ec071167336edbc6764bd5a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884455, "uuid": "640760c6-ea13-40bc-912b-032c173227e6", "comment": "Malware payload", "value": "75335fb3b0b6c1b03d0e798875cd45546b1f31bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884455, "uuid": "a07814b5-b967-4800-b72e-c78d3137428b", "comment": "Malware payload", "value": "43f5c22102693e7b654ff4d73bc574e27953a6c500939e3e33a662e0eb333206d8ea8284f74b6e93a98452de4432a8f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884455, "uuid": "2b4b4c0c-4d9c-49d8-916b-ddf78ece28b4", "value": "T1B095E147B2F375FDC067C030835BDB626936F46541226D7B21C4DA382EA6EB01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884455, "uuid": "cb09a8b6-f911-4ee1-8969-7ac2182f8f66", "value": "49152:A19DV6Ab6AGREzu2GAsy3P2YHmSMHDYKi59+:K9DV+RW0Asy3PnHKHDYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884455, "uuid": "23130f4a-fbb4-4925-948f-4fcaea739d59", "value": 1892243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884455, "uuid": "d478b5c2-1062-41c6-9b84-d7fd5912d4b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884455, "uuid": "32bea5ce-face-4ca7-90a6-577315fd01b6", "value": "bot.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5ca40a-3e62-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776872785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776872785, "uuid": "e7aff715-3502-4c2d-aac0-a0eabc70279c", "comment": "Malware payload", "value": "3857372a6e9bda05eed5db731b2205d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Shellcode", "colour": "#BEDE08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776872785, "uuid": "7bd1ff0e-56a2-4e0f-9b2f-855bc8051340", "comment": "Malware payload", "value": "2dfef0050dac212ceb9e8c91e31a7f6d229b2ccde1cf1d2eabc8d7d11d738324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Shellcode", "colour": "#BEDE08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776872785, "uuid": "7eaca35c-7e4d-4766-b803-0e59c3f8cfef", "comment": "Malware payload", "value": "533c89ec99c6a34c7bc7ee5137740847c7504856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Shellcode", "colour": "#BEDE08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776872785, "uuid": "f67a3c64-5270-41e6-b44a-5fa9e40062a7", "comment": "Malware payload", "value": "8fb1530bbc907b1cbcd14a0d3c78b96355ea71ef36346b2a1c4778691432579ae722a6eb3ab3cec928544a709fbdf52f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Shellcode", "colour": "#BEDE08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776872785, "uuid": "32f1a628-10ec-4bd8-98e2-7b024b030559", "value": "T1010833A8FCF1C09FF8AFD439F1311A359DE1CDBE064AA9083156B2B1889E746E85D50D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776872785, "uuid": "2877632b-9a1d-4179-b8a4-16b488cb7c40", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776872785, "uuid": "1e02b1ac-afa2-4c4c-89d4-c3bf48bee34e", "value": "1572864:STRtltSSSBTaUkcCJyLzYO2Bu2tsbwbZIrSVFeEQeDjQRxAwh1J1FM+EMs41:SlXtSSSxZLEO282tsYS4JQs0RxAwh1FZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776872785, "uuid": "3dedc70f-6b06-44e9-94b5-b49d1a5305cc", "value": 84072997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776872785, "uuid": "9b08dbda-9286-4ed7-9ddb-4288106bc92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776872785, "uuid": "c4bb0902-a370-4cfe-8c8c-5a30132ebe5a", "value": "ldplayer9_Installers_windos_x64.6.3.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789088ff-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848326, "uuid": "c84ac654-f6cb-40fa-99bd-5d2f8c8d931f", "comment": "Malware payload (Mirai)", "value": "65a38ad80462b24b35eb1237c021c1a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848326, "uuid": "4fa1b24f-d2e1-4160-bfdd-22177da78fdc", "comment": "Malware payload (Mirai)", "value": "2e42d976a86c2f79bda5f19fcf8335c3c29f5c7e712299bce36d429a4a2c6243", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848326, "uuid": "dc8a0bbe-d29f-43ac-a30e-d6cecb116349", "comment": "Malware payload (Mirai)", "value": "50e2cc2d96abb9e722016539babb54c9ec2ec3f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848326, "uuid": "96ac9e59-c85d-46be-acb0-66f8e5220d86", "comment": "Malware payload (Mirai)", "value": "a37c91f3944a7c5ee783e1781bf7bfabdc647e2beadb9182124224d09b4db4535c159003b6271b7ba37223b276897d03", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848326, "uuid": "f9cb551f-eee1-44f2-b550-69fbb505192a", "value": "T1222301CF8B5CE27BD242357ECB994976D103A84BF243F6282CE07B057D28009A66DB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848326, "uuid": "8a951381-6eb7-42d8-8735-99a9ae1235eb", "value": "1536:yI/naMIdNTH3gWf+DWfRSzxcFlxyCyqKZ95U:yVb3P+DYgccCyrv5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848326, "uuid": "8f6f8d31-90e9-427c-bbf7-c945486dad1e", "value": 49740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848326, "uuid": "171dfc31-6c06-4780-b647-94c78ae52dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848326, "uuid": "74a6850a-21a7-4b3c-b565-3f39595e4d4d", "value": "luxzz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87859568-3e21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776844915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844915, "uuid": "e72fd083-123f-4f3c-bf5e-e47424c12b3a", "comment": "Malware payload (Mirai)", "value": "19975cd129fa660713ec621c24ef2fb1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844915, "uuid": "b4349f61-84f3-4ff8-a98f-49ef0bf3e26d", "comment": "Malware payload (Mirai)", "value": "2ea0d31c3c95a87eb483e6444e1a3d8a9fefcbad95ce3375370ff4b6dccc87d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844915, "uuid": "332f03ba-9afc-41c8-9d5a-d3bb3486d51a", "comment": "Malware payload (Mirai)", "value": "b6e8d4ab6888754c765bc5d925e7c5d85d8960ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844915, "uuid": "6ad7d792-1655-4512-863d-7aae76e88f80", "comment": "Malware payload (Mirai)", "value": "b506c2caea68da1335f2f33e33c0153466df24958b6a6bc9f7922e971ca0e13900089a9dbce5cd02dab39f3e2d96433b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844915, "uuid": "ce726da8-47aa-4b1a-9ee0-153deed08f6d", "value": "T1D57301AA23E8F766F62717F260732AC03B5528D8500F8663B519798DC5DE142244BFBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844915, "uuid": "96aa31cd-7364-4af9-a2d2-bc0405747071", "value": "1536:7t/53cJDRHOOjK48HtwaY9PELOha/ny41DAAE9e5SZ9Yi9LAZBiodG:pxgRuOjKxwaY9PaOgyIDAAEeCmBikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776844915, "uuid": "5ba3efb3-c634-4f1a-ac42-3e63a1cd346e", "value": 77580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776844915, "uuid": "e1689a61-b4e4-4a04-95cb-e5c908959464", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844915, "uuid": "f8312d2a-5342-4bbc-9b66-5c39957b11b5", "value": "luxzz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549e6483-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877042, "uuid": "b1ef120a-8400-4540-9b17-7696546baae7", "comment": "Malware payload (Mirai)", "value": "f56dda57afaab2f4d68dc15eda2d1a52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877042, "uuid": "3f4ec801-80cd-4684-aed9-85800a4c17da", "comment": "Malware payload (Mirai)", "value": "2f10f2ecd5bc43a22eea8d843eee234c8ea3bac310b9b1eed0bd863b735f0ffe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877042, "uuid": "24027b50-7a7b-4baf-8b8d-ff45c5cdbede", "comment": "Malware payload (Mirai)", "value": "24c4d746ddcfca729d8022950d4e23efe3617823", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877042, "uuid": "f38fa09c-99a4-4cd5-a9fd-6e41646005fa", "comment": "Malware payload (Mirai)", "value": "635211869b78090f031a54e55d0f17931dfcf1ca61d153c8574773cbaffbd6077165e4e0f25e2b3a89064a9116cdf7c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877042, "uuid": "29f1f900-a287-43cc-8626-c7d81275ab17", "value": "T1AC631991BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877042, "uuid": "bd3639e3-a384-4403-98ae-c9911b264ec9", "value": "1536:XGBQnw68oqNi5Iwzv/GIw+D3ohyaRdWViEs/hX:XGBBa5fj1w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877042, "uuid": "99a67393-5eb7-4fcf-b367-67187795632f", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877042, "uuid": "816b5615-d66a-45cb-9469-97eea6c926ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877042, "uuid": "c1ef976a-2ad8-4b92-9152-5f5a8c830645", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abea07a-3dfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776828948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776828948, "uuid": "f12b16ec-a59a-4035-844d-023e5032db8a", "comment": "Malware payload (Phorpiex)", "value": "ae21331ae091c4aff18abf011653aa55", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776828948, "uuid": "b4c2c0f8-ca13-49fd-b84a-95ff7616a097", "comment": "Malware payload (Phorpiex)", "value": "30cd1dbd2a000503fd734ef2f4656ea46cd1ec0867ac8ec4b75378e88319c3b0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776828948, "uuid": "a3518646-306f-4cb6-bd58-701ce6485e92", "comment": "Malware payload (Phorpiex)", "value": "e654d0e2275b09578107fb282edc77a047643a39", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776828948, "uuid": "ea604297-b92d-4dc7-8147-596e3f41c33c", "comment": "Malware payload (Phorpiex)", "value": "548f119f36c4f08ab83531e4f85c6f69ca2e05da4291f9a88ace2c1df5c56b39d23fe4a8722c793200499147acabc810", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776828948, "uuid": "9068b1b4-5c0f-4acf-ae52-27fb4f6ee775", "value": "T122824B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776828948, "uuid": "5b6e703f-3e31-4f29-ad7e-cd5f7736e0ad", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776828948, "uuid": "741e27cb-665d-44d2-b3de-f89e9d465506", "value": "384:dI78VGQic1Kwvw077u9NHu/gBhav8U9ch:WAE0769Zha0UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776828948, "uuid": "fab7d840-278a-4c2a-9f95-d01376f66a8d", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776828948, "uuid": "17cb8daf-9270-4730-8ba1-0368c2cfa746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776828948, "uuid": "47795222-42e5-44c9-8057-00e047e4131e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d555970-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895068, "uuid": "6537f25c-fb28-4c7b-8e5c-02988175f524", "comment": "Malware payload", "value": "0684f7658bb03af5b8f5989d5e6fc816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895068, "uuid": "11ba2c81-35bd-4856-a25c-fd7732db92d7", "comment": "Malware payload", "value": "31db03671d36ae234eed8a3e2b836b587ae5a1a0fd120778e2583db9a38bae2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895068, "uuid": "54f49a4f-8306-4670-8733-f4e9d48e031e", "comment": "Malware payload", "value": "9ccaead860c3bf0d8b781f94dd55c306632eccfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895068, "uuid": "952c9b3c-133a-4132-bc9e-a9b0600430fe", "comment": "Malware payload", "value": "4a70418e188aae9aeb45dd7b92853838cdc53f15d7d708bca81db33e4c0cf2986e2cbcb28e6b5cf194f9d9eec8e2f994", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895068, "uuid": "bc6cf947-c11e-451b-be07-9553ae1e5850", "value": "T16D565B43FCA555E9C1AA91318A629253BB717C482F3163D32FA0F3386F72BD06AB5750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895068, "uuid": "a9fc942b-ac01-4615-a0f2-ba878d024abc", "value": "49152:dg3fb1SY3v5a7uWtxrq5p0KFKNZmw3otAjVNKUTZHeOFoVnmvb/EQomYyFN3XM8o:dchhB8I5C1jjTZH7omb/H9N9TtkEEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895068, "uuid": "6d723f9d-03a5-4f0b-8cd6-c05ead20fbaa", "value": 6136100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895068, "uuid": "0c4b9d6a-bba4-4ad4-8ab1-117f954dbedc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895068, "uuid": "a1bdb4ef-1013-458a-b22c-b1af4e3c9a0a", "value": "h2stream.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7565da86-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874090, "uuid": "b66ff90d-d9a5-4aea-8967-35f0061335d8", "comment": "Malware payload (Mirai)", "value": "57f391891b1ad2edd0d6c7a3e5cd2898", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874090, "uuid": "57be0b07-b67c-4965-b45e-2b3ddccaf8d6", "comment": "Malware payload (Mirai)", "value": "3330c958ec0b4802df9da7eb7ff8c1b5b0ee6571ae71868b553f52bcf930153d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874090, "uuid": "d94baac7-712c-4157-af16-9b492c1b9975", "comment": "Malware payload (Mirai)", "value": "64132124ebfb7acf19b11362882028c1ecd8d143", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874090, "uuid": "8386895b-3093-4a5d-8615-f90261765bd5", "comment": "Malware payload (Mirai)", "value": "611bff6f96f9c0523f3d53a2cfb1f8cf07665fc6c545a717fc6a9b929f089237b61f3482ccc1d1e967a53f53412b1672", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874090, "uuid": "d459b117-fa81-4505-8440-8efb439c3a78", "value": "T16DB57C03E683C4F1DA560BF4125BFB7B893699164121C963DB98F929BD72312E70A33D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874090, "uuid": "08bbce0e-e598-4d31-af31-b8e4ed7141e0", "value": "49152:OPLPR3ADgmDy0mAvIy3c2bAp8kVwBKW+:OPd3AMlAL35kp8vJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874090, "uuid": "654a24db-e3d8-412b-91c8-0a320c20c120", "value": 2411928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874090, "uuid": "c62f49cb-eb53-47a0-8834-451d029c0db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874090, "uuid": "e0d3dcb0-2159-4465-ba58-319aceb76c43", "value": "ciubuc_i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3539b527-3e8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776890303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890303, "uuid": "c8bb028a-a5dc-4cd9-a1aa-49a60a38c6cd", "comment": "Malware payload", "value": "522226abd36e363551e8c3fdac0e730b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890303, "uuid": "cc5d3cf6-9cf0-40c1-a35a-cd4921127e9e", "comment": "Malware payload", "value": "335394158108363d12aff48b766f3e5f3edb68cf9d531083f63e3df3843c0845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890303, "uuid": "5df0362d-7f3e-4f90-a245-cf5aab73f290", "comment": "Malware payload", "value": "bc042d93b11893dae0defde686e03ae056a453b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890303, "uuid": "666c051a-120f-4ccf-9071-6c6f98a78f38", "comment": "Malware payload", "value": "c26f980353be4286e85d7cb2e41ceb9106643bf890db7aa1999176daef79a052943f2e187edfe7b5a43c1003e38775e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890303, "uuid": "8a06b83d-dd81-4201-9e23-62bde26ae3bb", "value": "T13346DFC0B52E60A8EC56733E684B253F8BFEAF441544E9DB95FCDEF388578467812902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890303, "uuid": "ab7e613d-d8ec-482f-b210-5c4405f829a7", "value": "d4d8a548490910c2e9bccf34d2b22d32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890303, "uuid": "af95daca-f4cb-4c9f-978e-15ff1c4ea655", "value": "49152:89sn46wA6P92F/m5TjGtoA8ern+0+rfgd0:BJwAM92k5fGo0+0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776890303, "uuid": "e9d668a5-c212-43a3-a669-1177ef9be246", "value": 5425664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776890303, "uuid": "02564c34-5d3e-404e-87dd-67b297c1ba68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890303, "uuid": "4adf1651-b908-4bd5-959a-37228ba67df2", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba20682-3e5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776871551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871551, "uuid": "ecedc9dc-32ca-4cc0-8477-be3d89559968", "comment": "Malware payload", "value": "097c87e4cbe3df4973f93aeabe962dab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871551, "uuid": "f1029f0a-4c9d-4a87-976f-15ec396a0ca0", "comment": "Malware payload", "value": "3389d856444cf3039aa317b34e55a3e948969750e22f3e1f876d339cff7988a1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871551, "uuid": "0d8eb5b5-125d-4f20-94f7-87d42d253fcc", "comment": "Malware payload", "value": "fe8c61cc1856b078df23a3a25fa4318ab82fbf81", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871551, "uuid": "17a1160f-ea56-4853-b3f1-62b10c64e3db", "comment": "Malware payload", "value": "b54d09b9802fad36f516cbe9d8a7cd6d22713bd4396e746c6f9610d317e527f33d69eb08d4e51d99f723d55f1b6da512", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871551, "uuid": "1286c784-9164-4bde-9eeb-769d1d44e123", "value": "T17DB533207EE714BCF235D39554688669D36F5E2A36B12126F236DAC2E5E780A03F8F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871551, "uuid": "a1ca8449-3bef-4c58-a312-2649bea6f3b5", "value": "49152:eh8Oq0nlztZMLTrT5RM5nY63muztb1zr4HxtNCUN5tOZ34HvR2:ehTq0BtZMLr5qY6Wuztb1PgxtXslKR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776871551, "uuid": "b764932f-7983-43c4-8805-ce98940af63e", "value": 2327848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776871551, "uuid": "5206ec04-1321-4b2b-ba78-436eb40778ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871551, "uuid": "36107f20-13d9-4e29-9356-d03c6c905c3f", "value": "25d1d4122123.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead6da60-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880300, "uuid": "656acf05-aba5-4cf6-be3e-a51668234206", "comment": "Malware payload", "value": "31aaae64cf8e5b7445d238ce2e47fd32", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880300, "uuid": "728b2bc3-6f0c-485a-b297-414aee97ba7b", "comment": "Malware payload", "value": "33a92ef6f93e8f9301bba6ac2b2ed88682fcd52a24a393a599f07861a69bb323", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880300, "uuid": "892ff352-f801-4c8f-887f-91deef388e28", "comment": "Malware payload", "value": "2447a0f87447a7588dd56c0813da68fb24b2ea84", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880300, "uuid": "1c337c3e-4572-408e-9e1a-9f51ad633741", "comment": "Malware payload", "value": "2c898d86def3212308e38a5513ddaaa90ee616b033964f3ef630138a78dcf65e6147f26071deccf3ce2eef0f7f9d4fb9", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880300, "uuid": "a93d9b22-5b8a-49ea-aad9-8eb763164414", "value": "T1C73512AC74B1B95AF1D0837FC6892DB7DB2CA540D7A83DDB8E2041527D8310E6F6A871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880300, "uuid": "4f9c98f8-977e-4de6-b2c0-bcaed0cf3ce9", "value": "24576:P6p6VrhKNCf2Tx4iv/xcwQ0r+RZPp3rlw8aMbdCAOoCaeEnE:P6AVFkvlxKggZPpxdC7o1LE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880300, "uuid": "b6563438-f152-4dc3-9d52-501cd8a28a71", "value": 1162425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880300, "uuid": "5326f66b-5b22-4713-b5d4-dad414056224", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880300, "uuid": "72f560b0-5e8c-447d-8b46-9eae71910762", "value": "ClaimingAlyssia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf62853-3de1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776817567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776817567, "uuid": "67dcf873-af57-4bb1-8eb5-46b3b38b4f32", "comment": "Malware payload", "value": "2f74ffcc35fdc94eea6cdbda0bdda894", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776817567, "uuid": "5391920a-6598-48a4-b6e3-903e7003a547", "comment": "Malware payload", "value": "33b05c38ea48ea30c9e73bb0a2bd6334e5f8bec47a4203dd17c3df08fca38372", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776817567, "uuid": "a72f9047-e139-4322-b759-d1362266b3be", "comment": "Malware payload", "value": "20460f29fea445e4bbe0febcca59b844e08da8f6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776817567, "uuid": "0cd759ed-ea17-4f04-a919-172eac03ffdc", "comment": "Malware payload", "value": "5d1056a3c6a0ea7ca60f60e303eba2b2a24751238b4946bc8260331a5d877f978ca424dfa2a24a9e2bd8f5308e4fc3ae", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776817567, "uuid": "a7f3e513-d0c8-4612-801a-fece68752617", "value": "T198F1F17AC930BCD8876D324097A22C4E21A4295793B34FB4DB091CFA3E65757EF2568C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776817567, "uuid": "027af4c7-f25c-409f-8105-41d67f342d6b", "value": "192:F21Joh5CejCzmDkh5+VzsYtug1M0h3EIv4vGj9x606Ac:F06h5Ce+h9HglYvGJx6sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776817567, "uuid": "842fbd53-f244-4824-9b62-bc258bd8d17d", "value": 7673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776817567, "uuid": "8b244654-74bb-4243-84f6-ffbc48cde33f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776817567, "uuid": "014fda37-e4d0-4078-b559-7f4c8eeaae6a", "value": "file.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5721c8fc-3e14-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776839250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839250, "uuid": "61887ab1-fc8e-476e-b227-98ca8781de8b", "comment": "Malware payload (GuLoader)", "value": "48b76fae28d5fff281f1eb1082b5eb76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839250, "uuid": "a404e64b-91df-4068-ae0b-1b7984b8236c", "comment": "Malware payload (GuLoader)", "value": "350c7cdc9d10c12ae1c490890975e387421616170f710ebbf9fa6d29fbf4b7dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839250, "uuid": "154196d7-6b1d-493e-bf98-4008bd3f7eeb", "comment": "Malware payload (GuLoader)", "value": "02e9bce222385c292aebd5492a63b0e428099188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839250, "uuid": "e7c29b26-bdd2-4762-af1d-b663231eff88", "comment": "Malware payload (GuLoader)", "value": "3cfb183c1813f2e7072221e317ee1d03296cfa6f23eca47ef39d72098aec8a63c2b9bd7681183754e514309c76d90f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839250, "uuid": "a0ed88a7-32d0-40b0-a625-cd85d169abaf", "value": "T1A18412143D92C96FC6A51B706EA6EFB4BEA5FC502561574B23A4BF0FBD3838188053D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839250, "uuid": "11be7b86-79de-4a2d-8c08-bf7bf85bbcc6", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839250, "uuid": "74507c1a-2035-4954-98a0-a4ee259b51e7", "value": "6144:Yp+ggFTytt0LDAjGetyZTM4fIt8R1zebFJCPZRtZj0htSCCWwdIdCnkmNL3Y6IWi:I36HUGY4At8R1qb/MZRtZIp67bYlEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839250, "uuid": "73bb7b15-12ce-4817-ab40-e4ff07027b14", "value": 381803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839250, "uuid": "d097f118-7746-4117-8c5b-bfead222b555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839250, "uuid": "be6db92e-d512-4833-af2e-98e46d09a580", "value": "Ustabil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1819171d-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897556, "uuid": "8d77c781-84ee-4775-a9a7-a6b1e9f75588", "comment": "Malware payload", "value": "149cc539b82a7c1b55210ecd2056a48d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897556, "uuid": "6bc67110-bd8f-4d47-97c8-f0d4ca1ec701", "comment": "Malware payload", "value": "35182b759e806a3005b8dc8a56c3b090ca49b01e0da838d175815468655521eb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897556, "uuid": "30c44dfb-b644-4815-bcbc-dadb4ee6f1b1", "comment": "Malware payload", "value": "8a3f312a3faadf4be801be7de2512ce29a722283", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897556, "uuid": "f9865c3e-f49d-4dd0-b6a4-560598b9cc90", "comment": "Malware payload", "value": "c53bed13361348bf3961522a7a413a1220d1e23c46229a00276fa852c52529d18a2a6aa10491bcc7cb5a197bbf1518cd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897556, "uuid": "53e56965-8b6e-4bd8-9722-0ded0b88f5ec", "value": "T14EE2DFA3F36962F6F003CEB556911F4A248C9CDC914F627F01E416736623985C32AA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897556, "uuid": "ccd88b82-04aa-4e1c-b8ce-3a30b1343d52", "value": "384:3IVkphNRVd2h24Iz4kgwuImyPfplM3UdkBXvJc3FUV6Qx8GNTmOhjIQL+LLhiN9c:YSphVUo4IkkdPaBn6CnTVRIQyLQ0Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897556, "uuid": "bb4f9971-dade-4122-bff7-d979a1ae149d", "value": 31472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897556, "uuid": "0cd3a871-3ed6-457b-9eed-3841911d8266", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897556, "uuid": "3bed64ac-5c0d-4ec0-be80-abc62fb4f705", "value": "FakeAndAcceptPay.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d67f872-3e19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776841489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841489, "uuid": "7f89646f-5902-422a-a6f1-b6a82bb26a73", "comment": "Malware payload", "value": "11888aadeeb7696e5134233f13c3d1f9", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841489, "uuid": "cc5fb427-1356-4da0-bae7-8edcd6f5428e", "comment": "Malware payload", "value": "35204d0ba3485eb4f0f8104a218e71526d152679f97e65ac878ffb2552f41896", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841489, "uuid": "23fb5814-92a3-4cae-8588-c644195c2cc9", "comment": "Malware payload", "value": "add784fb57945e4255426ee59eba0d3614a452e9", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841489, "uuid": "5f9a8b13-0f0d-43a7-8d7c-a8b480b488c5", "comment": "Malware payload", "value": "851938675afb62b9ed0f8fcee565bcf98fff1111e467cf3b7ea2371e349df13a1ed2dadc3189e73629d76f6ad79d2bec", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841489, "uuid": "e9a61c46-10ab-446f-ac5b-7a5da80a0285", "value": "T13EF58DD2A3A600E8E9B7F23C85568517E7F2B81753709BCF15A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841489, "uuid": "2dbbffa5-25cf-41cf-85fd-6b1f79b9a02e", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841489, "uuid": "3fd4e2b4-5fc3-49a8-8e7f-27ef9d135b65", "value": "49152:zdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bJ:RHvfGfZvZj1/N/z/owJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776841489, "uuid": "c29cf532-9f91-4f0d-bdfc-fbdb9f1132e9", "value": 3484288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776841489, "uuid": "7f9071f1-46eb-46cb-b61b-40fc12bdeb86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841489, "uuid": "aef84070-b3fd-4367-9dca-c755a789c9d8", "value": "USOShared.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f595e72-3e38-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854619, "uuid": "ba1726aa-c839-40c4-b636-5815f6d2418c", "comment": "Malware payload", "value": "d94806b5f052f7a9751203c6fb22f082", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854619, "uuid": "4e78372a-3f72-4fcd-99ac-52ac2edee7a3", "comment": "Malware payload", "value": "35302b25381e53272a79b77f6600a1749ab8988faf2f74305da962413bc672b1", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854619, "uuid": "9969bde4-bed0-4105-846f-08c7b319d7b7", "comment": "Malware payload", "value": "b4c166fc9fcd8dd4eaec6b9c32ecf674552f668b", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854619, "uuid": "5b0e5b23-3c98-4a80-877a-05a544130829", "comment": "Malware payload", "value": "a91f514b607f665e5a217813966ef0a736408a44c0206e2c7ee063858a1d39a4f778a426a4988b7ec2441ba749ca15b3", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854619, "uuid": "b62d6779-0745-4c3a-a010-7113cc43c968", "value": "T161558E6D87A322D1DA7AA70426AA391D433E4C4F14F22B497F0D2FDD1F14A7A17B819C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854619, "uuid": "08b76637-37dd-428a-bc49-8d145e1c515c", "value": "24576:Fre7yxKk0/u/MjMRR+Athg+TOedbWumZ7yxKk0/u/MjMRR+Athg+TOedbWumn:FrYC0+QC0+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854619, "uuid": "cd3d9e7b-c576-46df-b253-4eb1dc1abfa9", "value": 1355349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854619, "uuid": "73b11a88-c971-436d-aa8c-599bfb260597", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854619, "uuid": "06da835d-8b35-4276-b6a6-d7c1d974f6d9", "value": "51_28p_darwin.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f73e33c-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826406, "uuid": "917393f9-ae0b-4d54-abdd-85e3e73faadb", "comment": "Malware payload (Mirai)", "value": "cb1ea44099bd91b5d8d928ac2bc9699b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826406, "uuid": "66f9859a-bd8b-451a-8c32-53adb5352d85", "comment": "Malware payload (Mirai)", "value": "3568b7340b25495b586a467143c2a2358f5e802b0d1cfb950030ccffcf301eec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826406, "uuid": "0c1f5d56-c15f-44b2-a475-9a17dffa35df", "comment": "Malware payload (Mirai)", "value": "5fb3fa7425bae0a63420c8261b23c0f439a79ee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826406, "uuid": "5652ffe0-06d7-4880-8344-f0c63bd96e19", "comment": "Malware payload (Mirai)", "value": "f66e46fa5f3231fbc766c134d61d3066877ffe0900d4f782acc363c07cb69cab4ac36ddda00e922ee9c91757339fb7d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826406, "uuid": "f86d4fe6-97ca-4634-9419-41362aad422d", "value": "T11B141A46AA404B13C0D627BAF6DF42453333AB5497EB73069528AFB43F8679E4F23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826406, "uuid": "67e0bb9d-b363-4d2b-a043-7b61864de3da", "value": "3072:e0F3JNNHJBbWICaqUW0hFOOS5vFNGYT3Qm7Wo2M/REQSm:P5HJVFCaqUW0hFOX5GYT3lf2M/RHSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826406, "uuid": "8650b775-e793-457f-9214-9ca0cd3381f1", "value": 190651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826406, "uuid": "bc4ec0fa-92fb-4983-8e78-677808c00673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826406, "uuid": "8548631d-91b9-4571-be0c-482a4db9d5aa", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabab3ab-3e95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894903, "uuid": "17f307cb-004a-4556-95a5-d8fe139c674f", "comment": "Malware payload", "value": "e45dfc893267d9171b94114698d49e31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894903, "uuid": "aac24aaa-d647-466f-89a8-cb1cf86a5d15", "comment": "Malware payload", "value": "35dd753fb9a0b4e2a3c688974f08de8e714aedd7c47aad381caffc058850a3bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894903, "uuid": "5e606480-ae86-41c1-8e8e-92ad6d61ca54", "comment": "Malware payload", "value": "0f8149f7d642e826aadf8e1c575f702901b77a8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894903, "uuid": "300c2a54-dae0-4370-9408-f5f1727e3f53", "comment": "Malware payload", "value": "7c42543d5195cb9f0e017b658c459a6c8ae7b99b420299148bc1195565d9300be1d039fa0e50f149eb74d39fc5c3210e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894903, "uuid": "e8ffd845-2d97-4092-be91-5334ce9e26c0", "value": "T16C45CF06F8809F62C5D12976F65F8268731747B9D3EB720699189B343BE792F0F3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894903, "uuid": "488f4ccc-1fdd-4ecb-8987-636d2aa78f47", "value": "24576:6z/qLvfxB+6qHxWiOeiJnaGYTAlR1wUHwRTH9JdZRVopVCextfMaZ:6kfxB+bxWitGYcw2wN9JHopVCyqaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894903, "uuid": "481e40a2-9fba-4440-83a8-3d37bad5b29a", "value": 1240901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894903, "uuid": "783bba31-d22b-426d-aed5-b5a8c06902a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894903, "uuid": "0ea16e94-cb43-4922-8eb4-2c461c5d6d62", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f03787e-3e5c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776870241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870241, "uuid": "b02444fe-3b65-4947-b6f4-cc2ad54d50b5", "comment": "Malware payload (XWorm)", "value": "4d13e4e5243783dfc6946556717ae446", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870241, "uuid": "969a6ff0-87dd-4455-89d1-5be131a75fb4", "comment": "Malware payload (XWorm)", "value": "36010c2ff297548a91210e2ed7d48247ecd5f74373db8e7dc5b482174ef60fa0", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870241, "uuid": "96b8cc97-37fe-46a0-810e-7a838678809e", "comment": "Malware payload (XWorm)", "value": "b3ce38b18b8a244880ee323403c4eb0319cf143e", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870241, "uuid": "c2c758a8-d4c2-4ccb-b191-3fb1a9abd3c2", "comment": "Malware payload (XWorm)", "value": "8aa43f2842946fbfe3d9933aeb2fb9a8f2cc913562bd3963ac1a7d19b12dbf9c649c600f934964a4d3ef46a84fc51945", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870241, "uuid": "5d8a99e0-0fbf-48b3-a41b-0361b11ce307", "value": "T167F11921A85EF45BCB991CB9270A4150BF348DA9B5FD226704F86A4701A88FD0C56FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870241, "uuid": "53b6e907-33f6-4973-ad61-f56071a0eeaa", "value": "96:VzC54Yft+qJkI1JhNKVg7C1VtaAx1f3CDW0o:1U4YfX+VuC137x1PC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776870241, "uuid": "58966699-af9a-4306-b5ac-fc26727c7184", "value": 8125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776870241, "uuid": "f5f34dd6-f190-4c47-9ef8-fe3658773339", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870241, "uuid": "1326af33-a7f9-4057-87f8-2cb427be2e77", "value": "36010c2ff297548a91210e2ed7d48247ecd5f74373db8e7dc5b482174ef60fa0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad259fd-3de0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776816842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816842, "uuid": "646af0ab-1f4f-4133-802d-89ffe43ffd38", "comment": "Malware payload", "value": "3ed3c7c1338a2cdcd1b92f4e2aeeb9b7", "object_relation": "md5", "Tag": [ { "name": "pw-IAMNIGGA", "colour": "#77E22C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816842, "uuid": "88610f83-197c-4a29-a7bc-eaab411ec47d", "comment": "Malware payload", "value": "362efebf2bce7516ba2293a1415d21f1e072922ad401d4d2c2d5acdf517b29bb", "object_relation": "sha256", "Tag": [ { "name": "pw-IAMNIGGA", "colour": "#77E22C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816842, "uuid": "f5bde6c4-e9ae-4715-b221-51730b0324a1", "comment": "Malware payload", "value": "39d616b4021192aa1e1701fcfa2922dc5b769324", "object_relation": "sha1", "Tag": [ { "name": "pw-IAMNIGGA", "colour": "#77E22C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816842, "uuid": "4eb02369-b7ab-4004-a299-d6172bc7fe35", "comment": "Malware payload", "value": "ca74fec376f747705f978368aad0c1cf485632bf445725f7e35b364bfb6fb36c102c76066fe3a59e0ae0b2ee6ab57123", "object_relation": "sha3-384", "Tag": [ { "name": "pw-IAMNIGGA", "colour": "#77E22C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816842, "uuid": "46184bc6-b6fd-4859-a934-af62b1386d0a", "value": "T17EA17D157900F184E07F137CF3B8A294939EE2F97227B31B674A4C0146AA8541F536E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816842, "uuid": "f35a05ef-cf12-4453-91ec-7ffc0dba737f", "value": "96:UpFoq/OgehpxEt9SvxcApK4yd0PrAxwdrdInCHv/3DN2X:3qVehpISvicKHOTdJ/3DMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776816842, "uuid": "4415989b-796f-42b4-b7a8-5100b5174de6", "value": 4762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776816842, "uuid": "516cb1e9-284d-4bbf-aea0-abdbe2f34942", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816842, "uuid": "6eeb0e74-e16b-4a8a-91bd-b420a169a1a3", "value": "bin.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85be7115-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826444, "uuid": "ad331360-2a34-42a0-9cca-49f55d09846a", "comment": "Malware payload (Mirai)", "value": "79dbc67a411ac3d6c5c4990de2ada68d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826444, "uuid": "8403a18b-ca3b-46ab-b77b-be492b800eb3", "comment": "Malware payload (Mirai)", "value": "3724c804231366ed429dd3c6ecf8cb51955a35fe0bae41d3c1dabc5b58f95186", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826444, "uuid": "e947ccf9-ebff-401a-a52b-975ecd2599b2", "comment": "Malware payload (Mirai)", "value": "d165f3c86368a847cb4f2b7bbc96e4e3515df8d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826444, "uuid": "b46e3cb0-6d5a-4540-9a4b-dd95d3b91578", "comment": "Malware payload (Mirai)", "value": "ca9920942d5c9fbe8512c666978e927c3a0352d0b760c58480a643715669e66cb6d66ad6378113f7e8bf611c207e5fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826444, "uuid": "9b26667e-a150-4afb-baef-622d8e6a3cc3", "value": "T11904A71E6F228F7DF668873147B78E25975C23DA26E1D680E1ACC1105E6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826444, "uuid": "399c3588-e888-4bfb-8bb5-238d86012ca7", "value": "1536:fmlcW4LXVIwIM6xBS//3FRQS/Z+aiuinlvfQ9IeilifVG9b4TXDHZWupLSG9A0+:8D4Loo/VZ/ZauilvfQclifiE5WuNF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826444, "uuid": "8e31282b-3b0a-4c31-ae03-d5f121416516", "value": 182636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826444, "uuid": "647988fc-9635-4820-90fd-f8b2ea1640b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826444, "uuid": "46a3aa8e-c9ee-4433-86de-2868e4b5f693", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f49670b-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876738, "uuid": "0c56a822-c2b5-4c9a-a289-727a5c352730", "comment": "Malware payload (Mirai)", "value": "268ffd51e9c9173d26e7bc19d57147ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876738, "uuid": "fdf12926-5014-4dda-8c89-2d1630841944", "comment": "Malware payload (Mirai)", "value": "378e11f0a64ef250c5a3118bbb914996cffcb6baff65aabe99590b0cdc3bf173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876738, "uuid": "09eb605f-5c5e-4417-91d6-0a4fbade415c", "comment": "Malware payload (Mirai)", "value": "8178240a504e506eced6220b8cd5e476f839545d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876738, "uuid": "dcf2f469-2ab0-4fe7-8994-9cf32c17736a", "comment": "Malware payload (Mirai)", "value": "d4099f0fff39d9327e9a25699d9b5668815e275d6a9fbe56630daa3ed8678d9cbe1982913deba7c28ab5ab5ef534c2be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876738, "uuid": "68457579-fc22-4ff5-bc76-b277327ce191", "value": "T13C832A95F9814B21C5D512BEFA2E118D3313177CE3DE72129D10AF21778B96B0E3BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876738, "uuid": "b7d871e6-6f54-4581-a457-5a81538198f1", "value": "1536:4wnW6LltCc1HFdFfnA/vAa4Ww11Q2M8i6+fghe3U7AL5YGYC61d6dOO:BhtCU5A/vAa4V+fghe3UUL6GasO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876738, "uuid": "a86e45eb-b39e-456f-b1c9-0447e5df3124", "value": 85492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876738, "uuid": "bade821c-00ae-4a27-934d-7eac734f0c80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876738, "uuid": "b3230dca-e844-4f57-8314-bc4a000037fd", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c3b0df-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876933, "uuid": "2fe69d9b-7364-49c8-9522-6357a335258b", "comment": "Malware payload (Mirai)", "value": "fc85facfd5d1ba0ffa73140819ac6292", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876933, "uuid": "5e5073ae-e29c-4d52-a274-1a0eff9a9f3c", "comment": "Malware payload (Mirai)", "value": "37f1890213349e8fa8731ad58b611b3c795acf61f28fdf614e5313ef4e62c772", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876933, "uuid": "08b33e3f-9d54-467f-a0aa-9836da3626a2", "comment": "Malware payload (Mirai)", "value": "e0cf977ad3d8d26385e84c622a0bb7d36d6d694e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876933, "uuid": "ffe2288f-f4d1-4df7-acf0-7c8e9d396cce", "comment": "Malware payload (Mirai)", "value": "923c59c53190b8cd71f2bbadef697882ac2ea97307839eae5b0e1a090f48a6f1a634ae5391c190647c8e5f81a0d04761", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876933, "uuid": "ade2756b-8645-4682-b282-a775a9b84e31", "value": "T186E2F2336D05BCB9DC7040B7BE6E82C7B65386B8E19E229A793807FA71C75492574183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876933, "uuid": "4a99bb5e-0786-4040-85a7-c8f25f9e663e", "value": "768:ceBsVPxhgZ8g8H0mQV2pbL6lNxbUC3CBIWpmKnoTs3UozU:ceGVPxGuhW2BWT1ZRGmKno+zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876933, "uuid": "d01bb739-9215-4b25-9299-1313f742c970", "value": 33872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876933, "uuid": "b3455281-92ef-4e0d-a7ea-4dacc2743a92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876933, "uuid": "371adf56-02eb-4d03-a47d-17d1f172748f", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9330f33-3e9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897451, "uuid": "663ac434-b144-403d-a2c4-186539ce0144", "comment": "Malware payload", "value": "6572e5296805cf3f56da13de3db0a1b6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897451, "uuid": "7f85e33a-1477-49f6-b895-c49ee804b1e5", "comment": "Malware payload", "value": "37ff58060a67ec5913a73d57ed1b47e4be67f925a59c4571994cbab3207b6ddc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897451, "uuid": "461991d7-2feb-4ee8-b8fc-a3682285d916", "comment": "Malware payload", "value": "dcc9e9f22426fdd093ac7e0ba660801d7acf5f3e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897451, "uuid": "192a5ca3-70f2-454d-ba1c-b58353dc7620", "comment": "Malware payload", "value": "fa3385e6fca7f02521681eb1affaaf2814747c21cbbeb3f967333bb1a042f798a9ac1596ec30135a8653579f5d87d5b0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897451, "uuid": "73bc74e1-b992-443e-bd60-8c6cde718f75", "value": "T156C2DF386197DD16E85BCCBB2384DAE13A1C12D40AD7E11F2CA0571BD417A8BC6BC63E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897451, "uuid": "8dd493a5-a24f-473f-b57d-a4ea81f4691f", "value": "384:AhU3w9gntuYBEKasZ3BazjbpE+WEjj6YKpo2pAqgIToY3HOa8TSYY6Sh15TsbgR4:0G9nDnrZ3BaPbpPFOlFoY3HHOQ15ToM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897451, "uuid": "63a7dd3e-1611-4949-a4af-ab4858513bb1", "value": 25743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897451, "uuid": "a8a6a666-cbe2-45da-b406-fb00b7cf5ad7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897451, "uuid": "64a82014-f1d7-4dff-b19d-928480ad244c", "value": "37ff58060a67ec5913a73d57ed1b47e4be67f925a59c4571994cbab3207b6ddc.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a30de8-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874092, "uuid": "3e71d51b-327b-43c5-9373-bfcb5338cf61", "comment": "Malware payload (Mirai)", "value": "aec0c4602343d92aa8d953ab8c647356", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874092, "uuid": "c29b76c5-538e-4efc-97fa-0623fc857f82", "comment": "Malware payload (Mirai)", "value": "38398e5b916b6c1181ae143f78e35c69278b27a9e1746d2fc540528e87a01df1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874092, "uuid": "0e40903f-db05-479d-85b7-890dfade07c6", "comment": "Malware payload (Mirai)", "value": "6f59dddcbf9259b717960963f781c462c24655f1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874092, "uuid": "6f04e74f-7130-463c-8bd9-51db81a2807b", "comment": "Malware payload (Mirai)", "value": "21023d9e8594bcac193d1a0661f8e183bd8a9f343f2a82b0cbaabea62c54dded300ee6e56941567ff126b7cf2af869ff", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874092, "uuid": "973eb6b2-91d1-4cbb-a5dd-2ac5425bc522", "value": "T1EDC59D62D968AFEFC526D171A538CEF20B53680052160FF639A6E3B44947AC2F3067F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874092, "uuid": "76f1b8da-9535-4723-bbd2-7029a7b28fa6", "value": "49152:ABrUxGV4sEICYEdkFlPDgl/yLKPDw9v3lQ+ItB433oRVJmvPseX:AGEA/4D32JmseX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874092, "uuid": "cd79585f-afe3-4fed-850d-73c2ac15e7c2", "value": 2694952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874092, "uuid": "ed314b92-db2f-4720-acc6-98d7c8879b93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874092, "uuid": "4e9aa041-61d9-4dac-8d7d-c83c84e06880", "value": "ciubuc_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3012300f-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776884711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884711, "uuid": "9869ce3e-fdbe-4f92-abee-f43de562f5d5", "comment": "Malware payload (Gafgyt)", "value": "f4e6fd15685c9b23ca1685f816210e52", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884711, "uuid": "f6efc648-4c3d-4e8f-b506-678324cbd318", "comment": "Malware payload (Gafgyt)", "value": "392c27f4b54410426db40e6479bb0e7d90eea6e26a65fc2256b4b331a9598494", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884711, "uuid": "7df36c51-673c-49b6-b9b0-c22e6d7a55b7", "comment": "Malware payload (Gafgyt)", "value": "6aa6b2c1e621f819df795cdfaa4b7d4e027f207d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884711, "uuid": "97d50270-b7ac-453f-92bd-32f104230da4", "comment": "Malware payload (Gafgyt)", "value": "165ca4e8eb4c68cb5ab9665f24443832c6399b74ea530c347621c00028bd5b6b47adbb3f53dbb90959c04dc21697d1ab", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884711, "uuid": "bb21679b-99e7-4cae-9c7c-4f73a341e5b2", "value": "T1B9E3D733B2E18DFAC14652B026EFDEB29C31F1FE0672312B23A41D605F2D9D61D99A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884711, "uuid": "4ae41584-5c9a-4bfa-b7b7-dad506bbfd66", "value": "3072:syUyaJ3LUQEWuZI3zKZPhJAphahZtwktUm+QVOXFNqOPPe:+3OI3mWphaDtwxm+QVOXFNqOPPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884711, "uuid": "f29594af-ad4f-4daf-a35b-1058462b1028", "value": 144121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884711, "uuid": "7dfaba5b-7ad3-4603-b499-c375a50a7e34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884711, "uuid": "7d581fe9-88a0-48f9-a1e3-e51677c628a8", "value": "392c27f4b54410426db40e6479bb0e7d90eea6e26a65fc2256b4b331a9598494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd56be28-3e83-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776887203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776887203, "uuid": "f080b962-787c-4d29-b83f-0bfa7aacc6fa", "comment": "Malware payload", "value": "bf6128c22ec7ad3440f22e63555c64d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776887203, "uuid": "4b371ab6-7c0d-4d4a-8d10-a7bd9aa5d6d1", "comment": "Malware payload", "value": "39514398b78211c53ae71a77d8f0bf1a27ff4b55df09d9570d17f5136137788b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776887203, "uuid": "0eab8822-de4f-4379-828a-e68aba2d7588", "comment": "Malware payload", "value": "eb3cff4fdc61b777140aa18e57cfa4b8e588c48a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776887203, "uuid": "fb9c7293-d429-4b5f-a445-03c525fe162c", "comment": "Malware payload", "value": "1fbfa062ee8add28354606fb95bf1f29dca70d4ab713bd6209b1f9ade208cb565df2cf08b0c407d7b394cf527db3e689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776887203, "uuid": "2b6b9d04-68b3-4ae6-8f85-3bf3beb735fb", "value": "T15216128528E618BEC4A3C771C2C578BDF26BBF454C72989BFF872D005E36905D872A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776887203, "uuid": "a54f29f0-0570-4b7d-8feb-38c32798889a", "value": "66e4622a2560a497065719058a0b3263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776887203, "uuid": "3e07d8b7-a01a-420e-b034-18f1b167c674", "value": "98304:OqDCzDbYRLnFwzSiBlR/1GcGVNzkx0Z51W2hU14njlYR:OqDEILpaDGFNZ51W2hUkjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776887203, "uuid": "816c4756-3395-4259-94f2-b194e17a629e", "value": 4266496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776887203, "uuid": "ee0eaaac-5b3d-4b3a-bba2-d1812ecf1437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776887203, "uuid": "8e179345-411c-4bf7-978f-ea5621b40f20", "value": "apablo12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0727755f-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877341, "uuid": "1a487eef-1fea-423f-a086-db7a4c2680e9", "comment": "Malware payload (Mirai)", "value": "9f82fbdd1f74ace94b22635aa45492bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877341, "uuid": "7e19ca52-c7b0-4398-b13a-62285f161516", "comment": "Malware payload (Mirai)", "value": "3976d7df147e852bd4652c6ed9be458abda286548aec40fe375cc7dd7eb19448", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877341, "uuid": "bd47718f-5ca0-4171-adb1-016559abc11b", "comment": "Malware payload (Mirai)", "value": "1cca93d486246f88571dfc0f086a1ad960517255", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877341, "uuid": "b1678ad0-a172-4cb8-8155-bd896dbd8a12", "comment": "Malware payload (Mirai)", "value": "d0f248030b5b6ecaea34e64152438ef3d420a53bb848d7370191b04ee8affb283844cdfe7c7bcc32176964cde557fa63", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877341, "uuid": "2702eaae-c35b-45fb-a660-a82c39dd8e84", "value": "T141F33AC7F801DEBDF80BE73B48530909B530B7E111921B372257796BEC7A1991867E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877341, "uuid": "19bb28c8-285e-4a6a-85b5-abf399b1f59b", "value": "3072:2GLPPY1v2addiTV/8cA5nQ9aVvjbiJLTUlSyY7QC7:5H+diTVkc+Q9PLTlyYkC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877341, "uuid": "c831813f-46f3-4f0d-b481-e5f3e7d03f0c", "value": 165184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877341, "uuid": "b2d2b0e7-f99b-46b4-b87e-fd912b80cd01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877341, "uuid": "285dad1b-13b9-4938-8426-61577675685d", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a427c250-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877175, "uuid": "f6c064ed-2a63-4e58-a7ee-216eefe47776", "comment": "Malware payload (Mirai)", "value": "11d8d17ffa6d6995a26c1c2f9d5dd4ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877175, "uuid": "77e8641b-a9c3-4af6-bf2e-15b193bb6b18", "comment": "Malware payload (Mirai)", "value": "39dac2cd71624df7c0bb632a800c03f49082d4bc514b56bf3a70014b1d88c8ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877175, "uuid": "4dce68f5-b437-4b7a-b304-6f1f487b2282", "comment": "Malware payload (Mirai)", "value": "874bf93af19953a9f434e015ad9e5ad149ba43af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877175, "uuid": "7e4fee94-ced6-4748-87de-2220fa74624d", "comment": "Malware payload (Mirai)", "value": "ed8f77440383dfbb032307cbac4d5d6584383d41237f37d449e164dc2687b1e4145934498475b4a19e13783094cec32c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877175, "uuid": "aaaba4cb-ff89-402c-b972-cff9510f9b24", "value": "T172535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877175, "uuid": "f3e93dc2-4998-421f-aaa4-c35797e7eaa2", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6vQZP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4bZP+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877175, "uuid": "58d6aeeb-8423-4449-a924-bb2f49954d34", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877175, "uuid": "a68c9f39-11fe-4c68-98f7-7ac4e23de17a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877175, "uuid": "be572b4b-5ea1-4a71-8253-8665364de46f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae58d36b-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776876333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876333, "uuid": "ac8fb1cc-a4ab-4caa-a82f-b2dc78221d36", "comment": "Malware payload", "value": "100130b4adf6421fa9706d9b1eefe29c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876333, "uuid": "a54cb337-2387-45cd-a1e7-6dfa2a77d842", "comment": "Malware payload", "value": "3a7d26aa627ed2c274c29a2ce4a2137595882bfb77083eaf1e5b70e03dfaa344", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876333, "uuid": "c74ee76f-5776-454e-b43f-7f442338c16f", "comment": "Malware payload", "value": "ff308893986efcf46efbf873cd86cd1a2c6a64bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876333, "uuid": "0a3068a9-7287-4fd6-ad8a-1802f517942d", "comment": "Malware payload", "value": "aa26a435535b0e822b513a3fb39109a5b6c8ad1aafb3f77f05417a338cb0ee7452557df06ae62e80373889fbe46918e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876333, "uuid": "79987d4e-4a2d-4c17-a738-6b07d9aa1f97", "value": "T19CF0E28A038723370F64868B7139D90D20842022D58DAB6C759DEB64BB0DA497B53BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876333, "uuid": "cd7f081d-ab45-42ed-900f-daa0b1ed5e0f", "value": "12:4CkEk1ETHkEce7pB+X3Zd+/5+XRwbA90W:4CkX1EDKe7pB+Hj+/5+hbGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876333, "uuid": "ce5d0fe5-4224-4fc3-8203-4854619a7f9b", "value": 492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876333, "uuid": "cc838d33-2a4d-4053-9231-156982c7826a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876333, "uuid": "7c3c1ed1-457b-4275-ae58-dc38a3039daf", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c64473d-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895094, "uuid": "b323fa5b-c1d1-4414-bad8-5aab704ab0fb", "comment": "Malware payload", "value": "a3b87b72209825304ff6bbe2bb1e7c0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895094, "uuid": "061cee80-8812-4202-964f-190f8bb566d4", "comment": "Malware payload", "value": "3ac6211c58344475351d3cd6081f054c9dae436be8da65870c090aad7bc48d6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895094, "uuid": "54666978-f5be-4012-9c55-26f4030e5955", "comment": "Malware payload", "value": "f494a0ebb9dbeeab61a49065caefd1706a6fe814", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895094, "uuid": "29192686-a26c-4ec5-a8cb-04abbb822162", "comment": "Malware payload", "value": "ee2f9816d6c05c72cb1de735a1db0393a26f0eab00a01814c9ee79a16dd1503f9232c26251bf56c532428da86edd01af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895094, "uuid": "c16433ce-1d9f-4bbd-9115-c457042814e4", "value": "T1D7661862BF58DE4FD29632314EA6C23473D53D1081B020379656F71D2EBA3A09D6BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895094, "uuid": "ff90d94c-210d-4d24-a9b5-37739c667245", "value": "24576:CW9vpF/C1SMPzeTjRBztvBebB42qqBRzoIhmz3Nx77OqOWfNo4l7YFZCzt2jgiph:Vdttt5gZoIhCn7DNx1YFZ2C55Hxvt5E4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895094, "uuid": "fe43bf14-8817-4693-a927-2cfc23c7e6cb", "value": 6750392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895094, "uuid": "5a74a2c0-196a-4e81-adbe-6be23b54d76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895094, "uuid": "6c47a200-fcbc-4f7b-9dc6-830eb544501e", "value": "h2rapidreset.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ff65f2-3e1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776842221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842221, "uuid": "c59bcb50-8285-4943-b874-257d27acccd7", "comment": "Malware payload", "value": "6ea327289706429bb47e7cfa59cfb299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842221, "uuid": "ac60b842-0828-4aa9-8267-c350c6f91029", "comment": "Malware payload", "value": "3af0ee122f53fa4ba06293f4c942c5df9bbce1bdee31d1b41e58051c9183479b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842221, "uuid": "3faf6325-5ef1-4a73-a729-a727ed05942b", "comment": "Malware payload", "value": "fd43c7cd7751f7b165f0e2000704f62502754a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842221, "uuid": "24ae24d9-fdf7-4694-86a7-a676ce38c1e4", "comment": "Malware payload", "value": "f1b7cb58a0bc96349fb267ee1a21725310f5ab923455e50ba2007cb999c817797ad685c755e24293fb36cc5d5d7ae784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842221, "uuid": "030fe250-fa8a-449b-b7b0-4a9b141fa4eb", "value": "T176F7A356BB418DC6E46692F45497BF50A3FEFD7146F1C36322E437186EEA24C8EA3084", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842221, "uuid": "195020e8-05d6-4321-8db9-26915294565f", "value": "693b9983e2dfb464a405b7abaf658e8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842221, "uuid": "f44ceff4-cd14-4e66-b8ea-35cf6f627186", "value": "196608:VFFG0NUEfM3rYxgA7l8DBDA0bRG8HOc3AucxDwGjXT7MXGnHC:V20rd0EVcDcxnjXPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776842221, "uuid": "64db4de8-5f3c-4088-ada1-7cdc5c72a7ed", "value": 71740928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776842221, "uuid": "de7f46ea-6b92-44e1-87f6-21a5ec4b7559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842221, "uuid": "5535ecee-39f5-4e8c-9c3f-05aa37655b61", "value": "bcn.866151001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd09192-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897779, "uuid": "c50b1127-d2a1-405b-a273-3edde2ca80ee", "comment": "Malware payload", "value": "5d0e76c0bb9afaa8830329a1e1b83a69", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897779, "uuid": "4bd2f248-7521-4a01-aa1c-151b28f6cc46", "comment": "Malware payload", "value": "3af237e0e056eae782234987eb2b03665437bd4bae843c232f84dd113bfd4a1f", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897779, "uuid": "ab56f987-d31f-4d8c-9c84-0ab120f74773", "comment": "Malware payload", "value": "6d27bc410a5cc2c56a4d8bf2107e9174c803b951", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897779, "uuid": "7f91559e-802a-4a32-99c6-a81db2fccd1a", "comment": "Malware payload", "value": "5ed25ac6fe4ff04110419ffa77654224279744c5e7b169ff5935b74c91423b9d596981dbb308163654237d528ed356c1", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897779, "uuid": "258c28ca-4f3f-41f0-a1f1-e89fba57dcfa", "value": "T1AFA4232CADE106503D67BF403D8C5F024A34A15BB6F9EAA6251F3F888CEFC6C156964D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897779, "uuid": "8a1618c9-b5d7-413d-ba0d-5299853fcae6", "value": "12288:WzYfcEaN9B/Jm0LU0gM7aQdYyvZJHJmWT:dfclN9BhmSH75vZJHgWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897779, "uuid": "5d7652c2-6b6b-4e8c-ad9a-f25ebf1917ac", "value": 462603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897779, "uuid": "371249fa-5273-486d-9877-da88aab39c79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897779, "uuid": "ba9d4d8c-cf93-4cf1-8375-a80bfe94f141", "value": "the_cracks_whip_claude_3.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76a3306-3e95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894897, "uuid": "212b8a43-c850-4fad-a37b-6e5dee91b1d2", "comment": "Malware payload", "value": "21997fb8e9ae221235459f92b4bd06b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894897, "uuid": "6a99f24c-437d-40d1-a7a0-f3c022add1e6", "comment": "Malware payload", "value": "3b252ac77c79724fec975cc64721f1050afd211fa73e849b39232f703d124720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894897, "uuid": "90fbf35c-156b-408d-add9-e1e24e5acbde", "comment": "Malware payload", "value": "966647ffe5912da235f7bcc61ecae9bec2d2e77b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894897, "uuid": "a67e5fb4-bccf-4f6a-b31b-1dd9451a8d07", "comment": "Malware payload", "value": "f2ab3c8ff3a6dc27f5bddbeb530aebf64d1d0d52a8db534e77b7850dec28c469446f4f8117bd67a02c5622584a5e9b90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894897, "uuid": "789a8ae7-8d72-4c07-8d2e-cf638b376e4a", "value": "T1E394E142FB442FCED667833498C6D9185F28F58933FA6F813A939468BC151368FA971C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894897, "uuid": "73485753-9953-404f-b5b1-bb15b56af7d4", "value": "12288:C6+4Av29V3fHUQT/2QHm9XMaFjYHg9yx1Wkt:PUC3fHLDGFCH/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894897, "uuid": "37ef8dd7-09fc-44fc-bbd1-ce02e710f869", "value": 411085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894897, "uuid": "727aea83-5233-4688-ba9e-80383252f43f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894897, "uuid": "9988774a-4309-43e2-855a-cab21da4e376", "value": "nc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3068d4-3e5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776870026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870026, "uuid": "988db9c9-8a0a-4c60-a999-c6099f1d4032", "comment": "Malware payload", "value": "3eae0fddc1637c50601124a2f3ef4997", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870026, "uuid": "c1cd04f3-f8fe-4d03-8528-179e8116253f", "comment": "Malware payload", "value": "3d6dbb3c7d1919252c46897444c5782b526059d7e6fa04e391cd5533cd11f73d", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870026, "uuid": "40b925d7-a44b-41e5-8e20-ef5ff113e8c7", "comment": "Malware payload", "value": "e5ce624ccd4bb2bf41f2f8e56e9a2c3098610516", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870026, "uuid": "fee3a52c-94ff-4cc4-8eec-404e2ee54812", "comment": "Malware payload", "value": "9fc68f41d96a5fe75a355926b0d52384c2a8e9bd6d2be5a582047ba10b14c0d9cda659268ef9d34ada4d481092cd67a0", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870026, "uuid": "ac45fb38-045b-4d00-bd9a-0132f12ec96c", "value": "T16C11B1EFE80B837255324B585E167C65EE898A1B322155A9784CD08F5F745D8D0C43EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870026, "uuid": "9296db4c-bc84-4eaf-9ae9-77cd63531bdd", "value": "24:Z3vxYKQFKdjrQb0SYPEQy2SPOW1PxYZsisj32qZEuTR:NxYKQFKdjcbr52tWjSjsphTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776870026, "uuid": "02e84793-4b5f-478e-b7c0-194ef0775678", "value": 1003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776870026, "uuid": "f799f245-4892-4e62-b276-b75ba060d4e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870026, "uuid": "d0f6a675-bccb-4c04-b9a1-e1c25df5824c", "value": "3d6dbb3c7d1919252c46897444c5782b526059d7e6fa04e391cd5533cd11f73d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26638f1-3e5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776869924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869924, "uuid": "7d38e88a-1374-4706-a186-1cd70bf908b3", "comment": "Malware payload", "value": "51d9788d36bd5197cfc2d79bffd107fd", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869924, "uuid": "7fab539b-ad97-41df-ac72-c8eccf3622a0", "comment": "Malware payload", "value": "3e65e72b82055d6897cde37c80e4bf9fa04a14a88a8a59233fe6688486a1a31d", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869924, "uuid": "4e9d7d60-80fa-4cb8-bb9b-e6aedbf9c817", "comment": "Malware payload", "value": "84ff9201ef3a4af6b922049985a320472e5ce098", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869924, "uuid": "65284eac-3c20-4f8f-8bf1-2897f913f2a8", "comment": "Malware payload", "value": "875727ff47b2052995e5b4dc4b70f42b46815e6ea508603dc11b20dbb0711508c9014bdcee8fd214452e08710eb6c261", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869924, "uuid": "262a125e-5656-44db-94c3-7639db8f7aaf", "value": "T1B99533618DECAE699B588625553EFE5003E0CF5EF50AF45726D222CF02EFBB3851B484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869924, "uuid": "5d990eeb-6be2-4452-8836-3e839a05c205", "value": "24576:seJtC6/5qurcF9O4t2oHWWoQBIozyvQdu7sfuTxh+qwHVC5wR3XwFpNqEbxjvZXk:NJth/Pek/QBRDuFM0wFgj1yel9NBOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776869924, "uuid": "8f13caf0-3a68-4336-9f3d-182428a4a802", "value": 2012702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776869924, "uuid": "3de76bb0-32ea-4793-9e64-792b60c1c6b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869924, "uuid": "bb777af2-ac32-45f1-8c4c-65e187201be0", "value": "3e65e72b82055d6897cde37c80e4bf9fa04a14a88a8a59233fe6688486a1a31d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf72898-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897618, "uuid": "4e825ea0-e854-46c9-8062-912844ef7c46", "comment": "Malware payload", "value": "ffc7b700facea57aaffe1b2aec3b77f0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897618, "uuid": "dd76d1bd-d003-4a6e-b5d3-bb8445bd21b2", "comment": "Malware payload", "value": "3f4fc71fafb6abf0d172d8da3aba74dc10fe65049f07db9e58c24ad775b8d355", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897618, "uuid": "ceced3c5-e9f9-44b8-8179-f11f97cccbf3", "comment": "Malware payload", "value": "3fa26c751db8c1be0cafdf5b61520e1ab534dcd0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897618, "uuid": "0c009cae-f403-4a5c-bb46-46d891ab1df6", "comment": "Malware payload", "value": "4cfd908fdfa5ffdda45d76fddb99cafe939f5d49de8a4074e71ae6a47151577b787d23de39a6fd8f95ce1843f9f23534", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897618, "uuid": "38f0d64d-ccb8-448b-b829-e8d6be5827a7", "value": "T1FAA41263A06F1B36F81BC9F7F1432A717C3D1D84A143242B6EAA550798478A3A39537F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897618, "uuid": "9325876e-5f00-447f-806a-a0391205db65", "value": "12288:9BCw1W8AlvMnx65DXr73oNyS+daKeNJ2q0o0YtyylX:98VNrbDVLmJh0YIylX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897618, "uuid": "9c3e5ab3-c4e3-4c24-a31a-0e5aff466aa0", "value": 492669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897618, "uuid": "165c82ff-3d02-40e9-9f0a-43eca5c6329b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897618, "uuid": "39737ce6-2461-44b7-84a2-b85ca2cbc045", "value": "MeteorBypass.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e47a36-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875682, "uuid": "772daa03-00ab-4dbd-b645-3810edd14b3e", "comment": "Malware payload", "value": "6dd4af447c05dcb36a21676946d1d893", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875682, "uuid": "0e059c20-ab2e-4445-bc62-a1ee509f53e0", "comment": "Malware payload", "value": "3f735bf0ec885559d5ffc651ba16022e446c18255473cc9a9fae7cd4e3b35f78", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875682, "uuid": "7d00ba8d-5d31-44d5-be0a-0ee721a094a4", "comment": "Malware payload", "value": "3f4af691598d2e0489ea4e88d87ff6eba9a8605e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875682, "uuid": "e74a124b-31e7-4372-bdeb-f6701f1feac8", "comment": "Malware payload", "value": "49afcd6d5bb014f5061fec610413148e8a635062a81b54545289c52df0ce419f52c0de4381d09f177eb31677e04ee7f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875682, "uuid": "068f841a-f350-4f9c-b0d9-e18c4051ddc7", "value": "T10BA68C52FDCB14FAEA43193005ABA22F23314C094F65EBD3EB507F29F97BA951836149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875682, "uuid": "9190e090-62f7-4b28-b51d-1dfea1a61c45", "value": "98304:cyHBC3ANOe5OyHOxptOZt6dREwUzg7T2DxOnZROwh8D0c8C:cy8bO8yrg7T2DonZgwh8ocf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875682, "uuid": "1e30fd57-8924-4ece-b54b-56cc3014ddef", "value": 10267089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875682, "uuid": "73ef43fc-acf8-47c2-8307-7f3a9c96474c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875682, "uuid": "0ad9df3a-76e2-47d1-8605-fde1fc91073a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de63da1f-3e9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897459, "uuid": "ec668896-1621-4edb-b175-f1ff42a61a55", "comment": "Malware payload", "value": "b95dfef174642a66cafd10ce8653768b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897459, "uuid": "254798f5-c2d4-4172-a4ad-3804da801103", "comment": "Malware payload", "value": "400e270b7877524603b82c40593970f3bf0e97b108c99ea3477590677f82af7b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897459, "uuid": "a73366b1-8229-4761-bab6-1ea8a636a6c0", "comment": "Malware payload", "value": "ff86fc663b9a7d11d4500efe845311f0605bc117", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897459, "uuid": "4671fca7-9d54-4e4d-b0ce-bbbbd1a79b36", "comment": "Malware payload", "value": "a9123f7770682879147caec40e79cfe53bca6a47c695a98da6a71a7347e32129ba3c56465dbf295c31812a0e9ba8b038", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897459, "uuid": "13d05a8d-b261-4687-b3df-0f99e7f89d5a", "value": "T1CFB533B1C38E489BC127CE778D95FA048929F42F35994F7E560C85CB325AD8C49BB329", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897459, "uuid": "4b9a2fce-5720-4832-85be-c0a80d6f2936", "value": "49152:MyCel2v4DIE1P6fDC0QvPWRN8Ajqj34+cpUy0fHBtpdhQQmtz:Mlfv4DIEl62Vv+AAjD+uqfQQmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897459, "uuid": "03228b4c-b530-4a9f-b9c3-db32ba65cc71", "value": 2426975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897459, "uuid": "683e114d-2e21-4317-ae95-8c6381c3e1ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897459, "uuid": "acb90b59-9058-42c6-b30e-df7e51552ce6", "value": "400e270b7877524603b82c40593970f3bf0e97b108c99ea3477590677f82af7b.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b55aa5-3e10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776837694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776837694, "uuid": "fecacc3f-f42f-4543-a66c-9bc88dfaa3d5", "comment": "Malware payload", "value": "2184d49a05913a4b0fb917b0de4cba0f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776837694, "uuid": "e17a2c75-4de0-4695-a2e1-e6f840f79fcd", "comment": "Malware payload", "value": "409efbec9774dda96d65cac3ef999a883fa19cacaafee30f0930edc6b38dc64e", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776837694, "uuid": "abc547fb-f900-4950-9f77-e8171e6857a3", "comment": "Malware payload", "value": "744c579d126c4236aa294ed52fc24687f4c9df61", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776837694, "uuid": "9179118d-0e97-4f88-8463-514ef83b2f03", "comment": "Malware payload", "value": "99094ab268cbce7df15d76de9043e3cb810b5c2c02130ce1806c8eb5c90992f225ae344efc5b5964cb83edfb52f49df9", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776837694, "uuid": "6f849d8d-f30f-48f0-83c5-05e1d808692b", "value": "T1CC92B61669B300226923C0BC67A79746333180079645CE6A3FAC5294DFCAEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776837694, "uuid": "aec86d4d-8d21-426c-ac09-6cd6ed713417", "value": "384:X4FTAsXe7FUFh/+4MA/ksb7RTsa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILnL:Xe8sXe7FUFl3NsafWkkg1kVKUO6IkV7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776837694, "uuid": "e62b011a-3808-4294-bccb-2ed0559f0dc5", "value": 20092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776837694, "uuid": "89302b95-8035-4926-9fd9-d3108394b4e1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776837694, "uuid": "61638ad6-ba0a-4679-aaac-b0ca06639975", "value": "qdfljwx.com.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ee64f0-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776884725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884725, "uuid": "25bac55c-7cad-4fca-905e-d50252374955", "comment": "Malware payload (Gafgyt)", "value": "5da17a16a336e29d40ce57bf5b674025", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884725, "uuid": "af5fa599-5b4d-4473-98e5-e380ec25431f", "comment": "Malware payload (Gafgyt)", "value": "4155502664f3b94b7a0412ebb6a2c6b43dc03bb473ff787f19565473b5839fd1", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884725, "uuid": "283d31d5-2fcf-4ddb-b7b5-c292116dd782", "comment": "Malware payload (Gafgyt)", "value": "b74ea2bc9bf412325a8c5b14e8c980fe8f2ffac0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884725, "uuid": "3af4b30c-bac6-4df1-8b44-bbf97331ee69", "comment": "Malware payload (Gafgyt)", "value": "30713de259e9d002af0169db1bdccfeb8264592491a7061552d2c95e1b75605510ca459ad0f26454997853e705d274f3", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884725, "uuid": "176ec277-4d07-4583-b816-0774aa02df5e", "value": "T172D34A37E4518F73C0836AB11C6AAD310F1595D31BAF268A267857F08B4F5CA744EFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884725, "uuid": "25f935d7-60ee-46fb-9e8a-2b5b3b0e82d2", "value": "3072:B1E8x83QHjqmgjHmhQXn55hZttT5I7mAK0qW6MyoQ6:/E8q3QeXrHXn55hZvT5SmAK0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884725, "uuid": "5c8e45e9-4332-4e06-a20f-3f121b4b260a", "value": 140225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884725, "uuid": "156f4f9d-290e-4623-b759-693d58b2188f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884725, "uuid": "86f802b5-bd3c-4450-915a-8337b5070cbc", "value": "4155502664f3b94b7a0412ebb6a2c6b43dc03bb473ff787f19565473b5839fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807e9fb4-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826435, "uuid": "e84581ee-cdee-4c79-b68f-09795a74ba92", "comment": "Malware payload (Mirai)", "value": "e55a1c6358038e2775b7399eb3f3d724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826435, "uuid": "77323805-1a2f-49c6-875b-254b1290abb7", "comment": "Malware payload (Mirai)", "value": "41c953d92959ab56f3f2e248b41b8b7272e9aba4dbe868f221808d6c3fc9a25a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826435, "uuid": "0d115936-f684-45a9-adcb-1a5b7ad492f6", "comment": "Malware payload (Mirai)", "value": "35ab20fefd47557ab2607d9c43ee71a8b953bb20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826435, "uuid": "228a16a2-c789-4ece-9b12-4f4bef1044ea", "comment": "Malware payload (Mirai)", "value": "fd6120cc97d5f96e8402da938f5c9d185a4330d47ccd9351dc039778ecb9fa132f493f3dbcaf77ac57d99017b709d7c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826435, "uuid": "afdd1b3b-20d0-4e7a-b447-8bfa6b7dd250", "value": "T1DBE33A07B5C184FDC8D9C1B48BAAF53AE936F45D1138B26B2BC4AA171E9DE305F2D640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826435, "uuid": "a7a976d8-4ab1-4d79-8b6a-a2ad92cb6a81", "value": "3072:ADKPkibws4eOk6uBm2MCkLr/SkS0Se23pPSBOVVFE:ADKPkibws4eOk6uoWVZbFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826435, "uuid": "5dd8bd74-8619-4a75-bab3-832fac9c7bb3", "value": 146056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826435, "uuid": "c11e9508-8f53-4b9c-ae98-44dd885d41f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826435, "uuid": "11036034-22bb-43bb-9737-fb969767b9b8", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcf2580-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1776884926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884926, "uuid": "dcfaff6e-f41a-47c0-99ff-4175ea8e6eec", "comment": "Malware payload (Prometei)", "value": "a5e8b6533ab27babed97fdb8651d943a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884926, "uuid": "153f5f3c-7264-4c38-a215-0e99396c0580", "comment": "Malware payload (Prometei)", "value": "4253c46c07541700b04a2bb28897df63dc21694eb10ad755d91f855feda7ba1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884926, "uuid": "a250cde4-87ee-48e8-90e7-7859c34fc23a", "comment": "Malware payload (Prometei)", "value": "b0e0f370786e3aaf07eee5e4a7de1b02071bf1b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884926, "uuid": "bdfec04d-54e8-4aa9-9581-807cfc07d37e", "comment": "Malware payload (Prometei)", "value": "9fcf8cd0b6241e43214d85b7b3f64fe7f7adf5accf1799b6213ca7b1a4cabc845921cf129b2af609917cb32c5b5b0168", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884926, "uuid": "a34128ab-3f93-4455-9a08-e00ce1b32bdf", "value": "T109166D6AB2B354FDC15BD03097AFC6636835B4B40131BC7B36809A352E72E605B6DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884926, "uuid": "ae92ba63-18df-4b55-b3a9-103460896b83", "value": "98304:uxGcUqZs6WcTDHBY+Zyas1Pe5VmuREfmeBejKfAZR:PYVREfmeBNfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884926, "uuid": "2df1210f-892c-4911-85c6-598d0c95c05f", "value": 4284336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884926, "uuid": "e9f49213-1af7-4219-ae81-666cd1a9180d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884926, "uuid": "da7d22f4-ff95-4510-a845-424df2237438", "value": "9ada584e6ca9d4163d5e82525db9bc85c1bea2b04db0bf5f904484aae4ff7482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f8ba62-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875006, "uuid": "cdcf9f0e-3ef1-45ec-93c0-12cd9c0c1eec", "comment": "Malware payload (Mirai)", "value": "09a254c33d6d90dd3f81dd6bec8a7586", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875006, "uuid": "c94e61a4-a4d2-4b2a-a271-33b873d1e2cb", "comment": "Malware payload (Mirai)", "value": "428ef996926ac99bd697b34482a139117fe8fe113ed6ac16a8254d6cd53a998c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875006, "uuid": "4352cae6-f233-400f-aa72-ea348addf71a", "comment": "Malware payload (Mirai)", "value": "6c83721df474888caf1964d209d252796d92a54d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875006, "uuid": "5b9b1ec1-eb77-42ec-b2f2-59cf31b9491d", "comment": "Malware payload (Mirai)", "value": "11a8db307c8c758d3ef83ccc5a5f7b06bd2ad07a43190b4d4e411f01e594fd961dd65b438b8cabf66355e13e8f91c86a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875006, "uuid": "9b05ad0c-acd4-4a70-a8c2-77986009f14f", "value": "T1B0E3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875006, "uuid": "dc7c784e-d3b6-4667-984e-34c32affc1f4", "value": "1536:p+fTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4Vx7dbK:pYlybKpzEOfGQ+vEubTt4ouftL43dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875006, "uuid": "1238f1a2-da10-454e-9573-7a1fb3cd16dc", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875006, "uuid": "24e25ad6-ba07-4e50-91cb-eb3f081d0f33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875006, "uuid": "f021c807-4923-41f6-a68a-3f57b6031e42", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28fc253-3e3e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776857496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776857496, "uuid": "abca539f-6f80-44a5-8f50-8e451ecbea7f", "comment": "Malware payload (Gafgyt)", "value": "6b5b6079f978e1069d423208720da5e9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776857496, "uuid": "5eb193e6-77e2-439b-8b75-edbcb6e6c93e", "comment": "Malware payload (Gafgyt)", "value": "445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776857496, "uuid": "238a85a1-dfda-430d-b629-8dca6f6b4704", "comment": "Malware payload (Gafgyt)", "value": "35e9ae2df0f26c0a8007cb647027dceb9df28f61", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776857496, "uuid": "56874bfb-3773-41b7-b579-3ab96eb1bc4f", "comment": "Malware payload (Gafgyt)", "value": "79740ae9060de829b23e11fbe7661b18d4cb0bfb2d28ae96c0d66b1cb804aa6303e062a5f8bf749ef887973a6e4c62e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776857496, "uuid": "6bc4abe9-871d-462d-bacb-c08412c5b43b", "value": "T1DE11C8CB50D4EC5297E9D62E7290C615608C93C663EFAF9CEED57C15C9C880DB029F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776857496, "uuid": "9a954b04-33b6-4565-9042-73ab7df18a24", "value": "24:sQwQn0QIQ78QmpQTEQt/SQUQ1SQONQD0Q1yQN:sFG0F9bpMEG/SJNpS0QyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776857496, "uuid": "0c4029bb-820b-44a6-aa51-a19dba552aea", "value": 1010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776857496, "uuid": "339c023e-20de-4571-ab48-27e673f76e7e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776857496, "uuid": "cb28f723-a51c-486a-a7cb-6842524aa066", "value": "Ciabins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0688dfad-3e5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776869180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869180, "uuid": "304ed4ae-6708-4a66-8bd9-1454398efcc7", "comment": "Malware payload", "value": "1d23a84bbde85808b490bd714c9fa546", "object_relation": "md5", "Tag": [ { "name": "lauderdale-dollar-mar-forgot-trycloudflare-com", "colour": "#D69F87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869180, "uuid": "7b9f724a-ec7b-4932-8f66-4ef7dfdfc866", "comment": "Malware payload", "value": "44671d56654521eb05acab950b91c0efc1c0c02b689b2ee8fa4f262f57640330", "object_relation": "sha256", "Tag": [ { "name": "lauderdale-dollar-mar-forgot-trycloudflare-com", "colour": "#D69F87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869180, "uuid": "1994b0e2-fc6a-4ff9-b273-b9a020f51b92", "comment": "Malware payload", "value": "c25109c596b4278ab5a929565b217660300bd865", "object_relation": "sha1", "Tag": [ { "name": "lauderdale-dollar-mar-forgot-trycloudflare-com", "colour": "#D69F87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869180, "uuid": "1a2b7695-cb43-4c10-85be-177010d6a8b4", "comment": "Malware payload", "value": "f5de225e965829f1fa5d05964b9f112da6f492d806c20492fcb96bbf87347fde143666ce142e768eb27e402f0cbb1322", "object_relation": "sha3-384", "Tag": [ { "name": "lauderdale-dollar-mar-forgot-trycloudflare-com", "colour": "#D69F87", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869180, "uuid": "292c5926-9045-418c-9367-b60c59112617", "value": "T16A2308F360DCA6050BA75B60EF19C625FF74806BA903D897444A1E7FC66C2D6A62F2C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869180, "uuid": "3278df8a-28b7-43eb-943e-ffc40799c8ba", "value": "768:SAoCUnWHJbVaUVoGA/064EpolIp6t0ryUSiSh72:SgBMUVkDVoe6t0rybhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776869180, "uuid": "5e8eda1b-696c-489f-9f5d-d869feb5da5c", "value": 49208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776869180, "uuid": "61921b36-37ed-4d1b-9800-fda1e41e947d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869180, "uuid": "1794175e-b322-4e0c-be74-b60e40f8aad2", "value": "archive0331.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db60f28f-3de7-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776820145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820145, "uuid": "fbdb4cd4-4ad3-4c0a-bf54-6fda17b27a2b", "comment": "Malware payload (WeedHack)", "value": "b596d7077de2a9c213321a9766c22a0f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820145, "uuid": "1aeabce4-1ead-4296-9d17-d25b26fca291", "comment": "Malware payload (WeedHack)", "value": "4563e7a90bba5e2f24a30a189956aa8fa553312391347a926239eb05d631d9b6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820145, "uuid": "56047a7e-3d3b-4650-b2a6-3e3a7750428c", "comment": "Malware payload (WeedHack)", "value": "313e601b536274fd6da94abe04a943d370f1e836", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820145, "uuid": "c3b4184a-8a25-43eb-900f-a043235f0d09", "comment": "Malware payload (WeedHack)", "value": "058c18edec5c7301a5bee51cd9b8320011b845d8a1300cf9074e546472b6274119033fd03396dbc8ad5ce37389ed9389", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820145, "uuid": "219c25f7-d558-4b12-885d-b5f440b5db86", "value": "T16FC2E1205286482AF443917B84C94953CF5EF791254E1CBE08EB4857D253E4E7BECB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820145, "uuid": "55406728-c461-4cf3-b3b0-7f96abd1e317", "value": "768:o9nW7I690JeYXApAY1GOkO2NAz8FaRDZ4XFLyYqom:Z78kYX8D2NJFTVPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820145, "uuid": "cc2d321d-99d2-440f-965b-cf679d09d197", "value": 25743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820145, "uuid": "67ff1dbd-edac-4711-b19d-02ab27b31748", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820145, "uuid": "4f398df1-d5ae-411b-8018-6e2d890bf1f7", "value": "dupe-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2819f55f-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876967, "uuid": "d01541e4-8851-4831-9aa1-50a1d1eefe7e", "comment": "Malware payload (Mirai)", "value": "f1f4835ecddd08952fcbab135ab43251", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876967, "uuid": "f4d400a2-a5f8-4fab-9d48-cf82591e9434", "comment": "Malware payload (Mirai)", "value": "460cdc154dc00f028f907a54776ab5529ed24a6d0654b07a7c3d769598efc3e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876967, "uuid": "d31ad128-a652-44d0-b8fb-38dd7d3557bf", "comment": "Malware payload (Mirai)", "value": "624f4f3e6765046ae694e2771876fed705657fa6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876967, "uuid": "2e06c06e-a73b-4c77-8693-70af2518a569", "comment": "Malware payload (Mirai)", "value": "f0889771a73716333c09578c44dba849a184c1ddfd8e409da214732c847de981e75e18b6f4ece743c02ae5d41f14ead8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876967, "uuid": "60531a11-fd9e-46a1-87f3-f721f9a22e1a", "value": "T1AFE2F26A51ECB12CE44E903BC32FA98E31E65D11FE17C69424C476DADF601F914B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876967, "uuid": "2b10baf2-edc0-4d8f-8356-81be29c8c4fc", "value": "768:g32bRAqg2AQzSPMjFY8AFOEPB6ZSq7xnwNQBU1:DbRAp2A4ECF+FvB6ZSonwN2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876967, "uuid": "e940db95-e2df-4670-b148-b8a14ee8ee68", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876967, "uuid": "6b1b785a-16b7-4c48-b6d5-319c68ab1f31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876967, "uuid": "73474be2-bd7f-4cdb-8bbd-9c31ed5f6f55", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb0504b-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848311, "uuid": "18bc62fa-9675-4d19-923b-50ff75d2f291", "comment": "Malware payload (Mirai)", "value": "c4727d81f88fc96a975e879cbfc7d16c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848311, "uuid": "945edee1-ed50-4f3a-8544-5bf3a53f32d1", "comment": "Malware payload (Mirai)", "value": "468fcaec13b79d9fd66df987af117b6c7ff3a9a68ebc2886b9a4768f0ce752ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848311, "uuid": "f8f8419e-f7a9-437e-832d-133717ac7929", "comment": "Malware payload (Mirai)", "value": "6a913c9cecd57b9c4c3a39885851e2a37b06bde1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848311, "uuid": "15f1f533-9fa5-4cff-8d49-64735feacffb", "comment": "Malware payload (Mirai)", "value": "feef698018e0b071ad187cd5554598e1af4a3c4e9f7ff077b6119eb2a07915f8051b113024696f97bc1ce27653e6b4c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848311, "uuid": "72060ca8-a108-4570-9fc8-6e05d6d7becf", "value": "T1DF9318C6F401DC7DF80FDABB4463690EB631E2611A831B266757BE53AD321E05927F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848311, "uuid": "efa64677-e107-4512-8985-7fb80171da67", "value": "1536:6sdLEbXJld3puE6tRknqnDPwK7wjkoLFWSKZRPD8bAjaZkH5S2gk0zjX5R2RGCJZ:6buHt4qnDPwKcwSKZpz2OS9kqSGCJjGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848311, "uuid": "fee9bd20-2159-469a-8332-30964804eefb", "value": 96740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848311, "uuid": "e1f47759-e992-4b2b-8cf9-8a217493d09d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848311, "uuid": "37b14d05-bbcd-47ae-a972-6b007ec7189c", "value": "luxzz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e8c41a-3e16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776840369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776840369, "uuid": "848760c7-d925-4886-82aa-fa8f65372519", "comment": "Malware payload", "value": "6883122429a0183d10ca6a2b9dfd2bfa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776840369, "uuid": "8b94611f-be38-4c25-af07-1d1228d8e9d1", "comment": "Malware payload", "value": "47d6fc7d532d97e293cc30f428b27be5f91fd4974263afc9be98aca2ca6e5448", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776840369, "uuid": "983a750a-7865-4eb6-b66a-acfd7aa5fe31", "comment": "Malware payload", "value": "7e01aa1ae450d6e13879e34756a51ca5cd586d87", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776840369, "uuid": "6525e283-4c76-4eae-8639-14c414261fb8", "comment": "Malware payload", "value": "5256ff5cc0dd1462eb93a5218869c1bbd21fbd55bab325b52ddc7d7c00c12a34c32a8ac43a6633a91426e95073f05e41", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776840369, "uuid": "7b645b50-e1f1-4cad-9cc9-a8e7dec3eb64", "value": "T1D1E54A113188C427D52F6371B6199FAF89352A207B3354C773A8C65DEEB1AD29230FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776840369, "uuid": "ae7e6246-fc2a-476b-86dd-36b25a50ba69", "value": "49152:IdqYaZrf5jSTUialiJrMf+7UVZDEFeJ4vLNgmUESIEjPMN2lv+oBNYtaMV3eVouL:7jSTBhq+E4veHjPMNaxYtaMV396AVMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776840369, "uuid": "6fe07b8b-3616-462d-9443-2c83379d05fe", "value": 3186176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776840369, "uuid": "bd9cc768-930c-43cf-890c-b3a5c8d80acc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776840369, "uuid": "429f7813-5222-4e2f-8b29-d210c0e29cec", "value": "substitutions.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3b66c5-3e13-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776838940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838940, "uuid": "cca8546e-3e98-4542-bbbc-af5e4a887ff0", "comment": "Malware payload (LummaStealer)", "value": "b162f237153b72ba13afdfcf2eb17644", "object_relation": "md5", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838940, "uuid": "392ea25f-f9c4-4229-9444-abca19217b05", "comment": "Malware payload (LummaStealer)", "value": "4804a8800007a70241a5e5b2e9f548d2cf56aa64800324a16818616950880945", "object_relation": "sha256", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838940, "uuid": "2946551c-ab59-411e-8fb2-c3954caf446e", "comment": "Malware payload (LummaStealer)", "value": "56391d4b656cbe466f4ab7570233b48a8e24b0ae", "object_relation": "sha1", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838940, "uuid": "18a56c08-3f84-4351-9841-3dd3f0c5b996", "comment": "Malware payload (LummaStealer)", "value": "9db87b9787bde837b105ea440f2979dfa6891b63002bea861cb0bf7b96f8f45d6eaed42ad917304cfdca8476ded742f6", "object_relation": "sha3-384", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838940, "uuid": "afa5ce5a-18ff-416a-9018-aee85abe23b7", "value": "T118956A00EEC754F6E903173269A762AF2736980A0F36DB87DA407A7DF9B72D50932345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838940, "uuid": "b57ce770-7cda-41b4-8a30-c8e902acd8a9", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838940, "uuid": "04e5b6c2-9ffb-4ff4-a957-55c2a890f519", "value": "24576:Nef2SwNrVMV13HfqZeSYmkJfpzqUWT7wZs39pBrNA1+GdpINetcyCQEmjlWtY2Gt:QgxytfmCRZs39fxAwGMpy7pUtYHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776838940, "uuid": "a2b8e69e-b10e-47dd-854d-966d93fafff5", "value": 1966256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776838940, "uuid": "2b519b38-8c2a-484b-a0c8-7ed63f80b1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838940, "uuid": "65c682a9-3c17-4b54-bc45-4114e45e2642", "value": "4804a8800007a70241a5e5b2e9f548d2cf56aa64800324a16818616950880945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49a40f2-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821851, "uuid": "45c7870a-6142-4f72-b894-369075be8b54", "comment": "Malware payload (Mirai)", "value": "09cf7762037046759dee90ca2fc42df6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821851, "uuid": "b8c5021c-9f16-4574-a454-c6cdd429f47f", "comment": "Malware payload (Mirai)", "value": "48eaf0d452acf3682dab0f151dd4ab95d6eeb6123378da2a9852e0f6e979393a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821851, "uuid": "8b5462d7-6aa9-4e19-9ff6-535c51221f37", "comment": "Malware payload (Mirai)", "value": "b51562a7303f74025ecfccf6651c446962852d4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821851, "uuid": "e8c5c3ed-e880-4208-918a-44523fd67be0", "comment": "Malware payload (Mirai)", "value": "85190e2cc7cea9125c82ed7ce4fa4836ae9c6c547d41c3d25f27756e040b2d0f9ee3b2b5762d9d3a3c90454ec64ee151", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821851, "uuid": "e3ded3fa-9f09-498a-a9e3-85b8ec107c12", "value": "T16553F54578819A13C5E423BBFA6E018D373563F8D1EA3216DD222F6477C982F0DA7752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821851, "uuid": "0bfd519b-8a48-4691-bf47-bd5e232f3cd6", "value": "1536:7PCSEuPYQsl9rsObO+Q0maKlG9WCHY2Jxed42+:7P9XKrssQ4mG9VH3Jxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821851, "uuid": "b46ff065-fddd-4009-a291-1083df4003fd", "value": 64716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821851, "uuid": "7be20a6b-344a-4aca-9e9a-8ab9318dcd2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821851, "uuid": "bde284c3-a21d-4a6b-be20-3356985ef760", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7b9a65-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826457, "uuid": "35734379-2798-4a39-aa5f-526f92c34b91", "comment": "Malware payload (Mirai)", "value": "cb18f3e2bc8af39f5a85072912e1eaf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826457, "uuid": "6ce007df-83d4-42fa-86aa-456cdb78be9a", "comment": "Malware payload (Mirai)", "value": "495630dca6cc2b16f4e01c5dc5e9af3189ca3cf405b5f1ef1a52d061fae43d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826457, "uuid": "4294c842-bcf6-486b-b065-edd8982bf17d", "comment": "Malware payload (Mirai)", "value": "21ac245e1bc0f1c4d5432ec6952863ae58a212d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826457, "uuid": "b04fb44e-9333-4a6f-a088-78d012c3fecf", "comment": "Malware payload (Mirai)", "value": "00dbaa334fead2c1960acfbd5cfbf9906ff67a2061be094a5597c46018811268b250ddd898e2df1f97b5748f7417e81c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826457, "uuid": "c36a4f08-7eb4-40a9-94de-6dec575e2ae3", "value": "T172C36C73C8296F98D655D1B4B071CF781B63961181871FBE5AA7C2B58083D8CFA0A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826457, "uuid": "f401ed61-8d0d-4185-a97f-96f47add4a44", "value": "1536:ybX/MtH3tyYjyBjTy4yC74KaTRLIWwswIRaqyW4HqAvhgiLSG5Aj6:yLktHgBq4y+/alwswiyWMq8rO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826457, "uuid": "9657a6b8-69a3-44d7-9eb9-54ebece3c242", "value": 125760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826457, "uuid": "bcfb5756-73ef-4894-952a-0e61305ba033", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826457, "uuid": "552f9060-265d-4494-a0fe-6407c8226b59", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba2d361-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884462, "uuid": "aa739fba-bfe3-4fb9-9b04-2ad41b5165b1", "comment": "Malware payload", "value": "e38d50f176a90f2201d5b1dd96b6ae8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884462, "uuid": "3a21e2f2-ecc7-498a-898e-abc3d3a1776e", "comment": "Malware payload", "value": "49ef7b251e607d0cd78df94ed64665dc1cfb40755db9c25dca9f95fb00843b4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884462, "uuid": "7a423c7b-0709-4ba7-a3dc-35d022450356", "comment": "Malware payload", "value": "5fc21074a92ebf57b516fde1a319d8b2c97545b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884462, "uuid": "1098720d-e433-4530-8c2c-aa8f93757e17", "comment": "Malware payload", "value": "0664c5162c8b494fd0adaf04a9cfad3c674c98dc09e393109a42d5472c4d26a3caecd7bb464557bd4e2f3ecc510fa95c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884462, "uuid": "a9d1c53f-a366-4b2d-b294-7129e0facd81", "value": "T19865E0627711DFA1D354C63005F3C7555AE525A20BE2908AB278C3287E21B6D6E2FEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884462, "uuid": "855caef4-0c0a-4591-ae88-9f1c2fbad2fc", "value": "24576:t4CTgOHoJHSTQFzx+J8nVZkpDZmFhJeyxoVmsKcPpO3mtBM6aX9IazdEIl6:t4CqoQFzxLVZknkz2ocPvaX9IaW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884462, "uuid": "4984223e-d284-4e35-b9d1-4a3ca0011d3c", "value": 1427975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884462, "uuid": "ab88ed7c-35d0-43c4-83da-660a20485803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884462, "uuid": "47cf52d7-dd77-458d-ac76-496f9305cdc5", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd0c586-3e8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776892006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776892006, "uuid": "d6e6c000-3297-474f-bd18-110e7721aee2", "comment": "Malware payload", "value": "97442d65cc7fb63278711196540512a6", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776892006, "uuid": "4c40c0f6-c4ec-4868-aa0a-66b813122b8a", "comment": "Malware payload", "value": "4aca8d725a10c995eb7a46a060d52d646c58c9754fb203bb4e5fefdf07349485", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776892006, "uuid": "8fad9510-2193-404d-8cab-80f8fc3c30a3", "comment": "Malware payload", "value": "212ea5e7da8c3191a4ebfec8680cfb28245cd9e3", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776892006, "uuid": "b55536a7-f30b-4af6-ad82-4366bfe3c203", "comment": "Malware payload", "value": "0b6859a967c1a021511a67c91dae693563bf77199d3204f3d3689154190f954bcfe7232c2f7567685d1129058699c2ec", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776892006, "uuid": "1e087829-3b05-454f-84ad-e77410975bdf", "value": "T1DE76126E445C10F8FE2AE8F59E6B3713CD1BF89307719343112B43958D8AA529BA327D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776892006, "uuid": "de00ad49-c605-4131-9831-12ea3334f133", "value": "bedd6d848bac4316f8d2ce8b5991d853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776892006, "uuid": "f37d45df-48c2-4e0d-900b-a8a1340ba3b2", "value": "196608:BxXN+u9WztUF64ucyKEJw0JhvYcZpFVl6Cd:Xd5cztU/y9Jw8BTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776892006, "uuid": "23cbe265-b3f3-4b0d-945f-554d6e9aa36b", "value": 7781888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776892006, "uuid": "37eafe46-b86a-4409-aadb-f1bb5bd9187f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776892006, "uuid": "7e3eb205-e771-4db6-a9d2-c4c2e9448f59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598ba913-3e51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776865454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865454, "uuid": "fab36875-6720-480f-8bcc-151c9d540dde", "comment": "Malware payload", "value": "16d59f6098c27156a602aa0963c64b05", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865454, "uuid": "feef2a8b-10a3-461e-beb8-d94f8641db63", "comment": "Malware payload", "value": "4b0cfaca996b9954bb3c60e0dfe9c2a6dd07a442f9bd00e3f8c7f46a2e783987", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865454, "uuid": "6da67b08-b162-4ed6-989b-fc048000cb64", "comment": "Malware payload", "value": "8635d2576bd93f6279e8802d4dae7f279811d42f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865454, "uuid": "721a949d-3d4a-4928-af31-7d165781d8ee", "comment": "Malware payload", "value": "015995c3e765a36e50dba8d16d105e5237cebb4d70fd5017b8b0d5e9f4219a0ea83472edfd3f566372002dbd60baabaf", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865454, "uuid": "f5ddf3c7-ea59-426e-9794-7373c750baa3", "value": "T130A3E0076D891FB5DEB8192410FF152BE74087CBA54A6985EB632C467FFF204201B2ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865454, "uuid": "f6305d08-c970-4214-ad65-04f012aa3526", "value": "3072:lfRgl2GnV5l6IRF1azawoz5h1ztoJ4YZg31bqq:lJgl2GnV5JRXlF/E4YZUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776865454, "uuid": "e734d069-1492-4e80-b213-a3db2ed60f3e", "value": 100386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776865454, "uuid": "143ba16a-5845-4194-9ca6-2c88e5ebce51", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865454, "uuid": "b5e31ff9-3698-4d21-ab4c-f3f82471ad73", "value": "DGJKL0INVOICE.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826e46b4-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820855, "uuid": "c701b548-2233-4ec8-aabd-b3209b61a5c6", "comment": "Malware payload (AgentTesla)", "value": "b84ed71707b8057235d72e024fd2b591", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820855, "uuid": "7e9b8a16-e0a7-4b46-b096-e24f46d697dc", "comment": "Malware payload (AgentTesla)", "value": "4b5931e2e1c61bdcfd19e151d12e3f2270891603a67f203c360c7c15402f5f2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820855, "uuid": "ad80833a-3d92-4cfb-b9b3-2082674e928d", "comment": "Malware payload (AgentTesla)", "value": "88edc54c6272c29574e502a23ff688d4ceac460a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820855, "uuid": "0cd6f8a7-1bcf-42c2-a292-673017785796", "comment": "Malware payload (AgentTesla)", "value": "7b2357b178460e4abeda950fb67460ef8db640c4d19d4269caad91762ac008de715b2b6a922e1c3033cdf30a30f4c592", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820855, "uuid": "82b14fef-c5ab-48fd-a0f9-e8131323887b", "value": "T12165338380A46052F1E5983F6249B883EF2860BFF7CC5C371B85D959D203609DF8EE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820855, "uuid": "87707c47-13a5-495a-ac9d-cb18de58287c", "value": "24576:uCLzmumsvMcDdcxLfA05S+5A9z0s6ysWWgO:FLzmubUWaR5Z5A9zG3gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820855, "uuid": "1953e49b-2f1f-4cf4-9750-b914db50befe", "value": 1539562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820855, "uuid": "debe6e8a-20dd-4027-91a8-08639c354944", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820855, "uuid": "1c0c297c-5f23-4a0f-8cb0-3526c1dc95d6", "value": "demeBildirimi.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d00312e-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776850937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850937, "uuid": "64785053-3690-462e-84ec-798f7677ac62", "comment": "Malware payload (Mirai)", "value": "3fcf3ca989b8436ab018ace6a868b0da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850937, "uuid": "1fe0c5e8-b36c-4d49-b9fc-fc5261514328", "comment": "Malware payload (Mirai)", "value": "4c2df1810cdb3aa407dbae07ed14213628b303d7bf487418e51924c3760b47eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850937, "uuid": "866ff432-0158-4689-a33f-a01c98aa27a7", "comment": "Malware payload (Mirai)", "value": "077d479f10339abbbee970c5d111a5ef2514bb66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850937, "uuid": "257bb312-3cf8-4942-8810-58a1a1876148", "comment": "Malware payload (Mirai)", "value": "3a4832d506b17502c764ede0f08cc009e99d0f7e26c3b724a9f3e303fa9e2e3d8416a384d09fefde88253c576534573f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850937, "uuid": "9fa72173-fa5d-43d0-bcd2-09bfe09b93e1", "value": "T1CA13F25172C7EDA7C9D4E037826E342B72A4E523BB97FE813AF06751C2321A4E36611C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850937, "uuid": "8c39a7af-3026-4025-b7f5-9e134f89418d", "value": "768:n3XFQh9sCCqwPUAudPwZD+Rfz1wRgEW8YDlmlKNzZb4/dXly0G:nnFw9sCQ9kaE71weEWPlmIxy/dVy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776850937, "uuid": "74208b45-dee8-4036-868d-6fd0b23a9630", "value": 42768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776850937, "uuid": "4fc0b95c-d8c9-41a4-b7fd-445858a01d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850937, "uuid": "a62f4ada-dabe-4256-9f42-3c5a491dd2ae", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4114f9a0-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874002, "uuid": "13809a63-d61d-48bb-acd2-33f13c0cd112", "comment": "Malware payload (Mirai)", "value": "d31bbe9efb07914aeb131fce4e8fbf84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874002, "uuid": "a5f91449-8cc1-4e7f-9e8e-aeb84f7cfaef", "comment": "Malware payload (Mirai)", "value": "4c7d25d925c59540f5a62ff8e36f80e5bc9a06a63d20f8d60f2746081de91e56", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874002, "uuid": "767a4f27-8ed2-4c3b-968f-be0cf5e97af7", "comment": "Malware payload (Mirai)", "value": "e0df30449eb1b7c9afaa7eaf4e32df73144207be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874002, "uuid": "633b36ba-0c1d-4e2d-9df0-f51e9a1d0c0f", "comment": "Malware payload (Mirai)", "value": "f61e36d20df93b5668a4fb5972e23c5cc681fdc6b1ff7c37115fffcd137d7ed8bb24b930a275268e8f8a1b45b000972d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874002, "uuid": "00ba1fb7-e0d6-4e90-835e-83e8c6b53ea7", "value": "T17BB56C99EE0E3D42E3C7E27CDF4A8BB1313BB6A8E32280B37552415CC0DA9D597B1615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874002, "uuid": "fb874d2a-f89b-448a-a0d5-6695be7f30e8", "value": "24576:UFW87Yw3csAB7MNT7tYYIN3hCgqGDlf0lvta28eCEwe3q3JTL6x6xUCnDNOKroaB:i0BsAxPxboFUgn5Knqat4yPc07PZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874002, "uuid": "da44735a-98d4-43ff-b502-6efa527cba93", "value": 2489264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874002, "uuid": "2f5c6363-c84a-48d4-9fe7-17b010a0d06a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874002, "uuid": "91b2e7a8-dd80-4d00-aeb8-4d6a4022e1b1", "value": "ciubuc_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7675a0d0-3e44-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776859919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776859919, "uuid": "fbb261af-27c7-4d71-ad84-49e359f6018b", "comment": "Malware payload", "value": "5ecbb27824f5bffba72a028152b9c00e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776859919, "uuid": "0b203dae-ea5d-4f2b-ace3-785016a62875", "comment": "Malware payload", "value": "4c8a22dd7eb4b06c6e2ab19753892f802ebb2f1837baf12b981e82cfd9cd24c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776859919, "uuid": "7390d70b-3e4f-46a0-aa38-5fd5eacb8bf3", "comment": "Malware payload", "value": "380bf424dc8ddfac3f38c07bd53cfa54d1f42ca4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776859919, "uuid": "5d470d4a-d9d7-45c4-a2bb-3decb34e9d41", "comment": "Malware payload", "value": "25d31b2694d7c3b418fab63402ebc71c24a29f101191e59a85313674198ff5af9ed043788b6c7015e1f864fa6eb160c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776859919, "uuid": "e4dc6915-5eef-43ed-818e-9cff9f12ba44", "value": "T19F137D6526953C25AE99883B5C7E2F0CB9A983E1300491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776859919, "uuid": "f41d37b9-22c4-4ad1-8491-06590d68f0ea", "value": "768:bqs9NyXsZztCA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bvHusZscy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776859919, "uuid": "84cb0cc8-b1d8-4a22-9cee-abe223c4b11e", "value": 45511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776859919, "uuid": "6a19b249-70e8-4812-b2bf-826273fc1529", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776859919, "uuid": "3a15f48d-b84d-4343-aa44-deb627ca6bea", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63eeba7f-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874061, "uuid": "81a6add4-587a-4432-b7df-77ea84ed6def", "comment": "Malware payload (Mirai)", "value": "a4fa4f65e8243ccc33343037e5e4599d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874061, "uuid": "66cf6d43-379f-4a50-9b26-08e233237328", "comment": "Malware payload (Mirai)", "value": "4cfc6b0aa7599aabbdd960417800d02b7f8cb6289ce28b1aaf34a988232d75e1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874061, "uuid": "847abc6e-be4c-4688-bbef-1c5ef1b981e4", "comment": "Malware payload (Mirai)", "value": "1e280c0318af4d31d750ebfcefaa3964cfb777bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874061, "uuid": "ecb69d93-ed84-4176-9f1d-f910ab3fd4cd", "comment": "Malware payload (Mirai)", "value": "60ded6e4879f30b28a13ca7abfeca778a23fc55a49909c8e8d3b203219a2cff82874540b2ad9e40f8111f584805fb18e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874061, "uuid": "3479902c-0eb1-4d80-bfea-c0c0a98eec03", "value": "T1B1B57C47B708B9BEF246733784574A0E24047F12C0815F33A2B5F5AD5E7A1A91F3A6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874061, "uuid": "9097edbc-9847-4dd0-8c8e-368047f2248b", "value": "49152:qjN24aVXK3PqtE38WXH0xH9qHvZbhrBk9:qjN2FPi84zHvbBk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874061, "uuid": "ee6692af-6c81-40b5-8a62-5f3027a97a62", "value": 2322396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874061, "uuid": "853881e8-94ae-4d83-b7e7-434e850a4675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874061, "uuid": "51c90a74-4ec7-41ce-a32b-b496dd9f9dcf", "value": "ciubuc_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40c79d8-3e9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897469, "uuid": "9ed14d59-9be5-43bb-bee2-350adeda27a5", "comment": "Malware payload", "value": "10ffff8b7935aa842cb4e86f44088152", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897469, "uuid": "8918c565-4ffe-4977-a6b1-518fc33d83d6", "comment": "Malware payload", "value": "4cfdb29fbd0ebafa99e38f5e264998225386b5a1bd5b33a9e92c56586484b227", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897469, "uuid": "41779b12-730a-466c-8b8e-f2103c98160e", "comment": "Malware payload", "value": "7a840108b6840377d863130dc45e3d2ef9ac5dea", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897469, "uuid": "50563a41-7636-4951-bd02-0b7810594c73", "comment": "Malware payload", "value": "11a525593f55439f75cc7e06ece7c19a1f3a13b011922b7492f6029d55c8d5549787c6e7215e1d87e0b3c7b451f6cebf", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897469, "uuid": "997047fe-7e55-4bca-b664-877da8986c62", "value": "T156C2AF3B9DEF7CB4F73629759E5A615B2F0E4B1432C60094119E23AB1D0DC8C5E86BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897469, "uuid": "9e95ebb2-dc40-40f8-a83a-25f84e9ad672", "value": "768:zsUc22FXFtImIu5W3J0PLRw9b1TS1WPrF:Jc/XFtImI7J0PO9bJqWPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897469, "uuid": "ce64b93f-eb60-446a-a3e1-7009f23ba0c5", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897469, "uuid": "645ba446-b515-4eeb-b41e-889106b0cda0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897469, "uuid": "cb500b44-4bc6-4264-9f31-401229a025df", "value": "4cfdb29fbd0ebafa99e38f5e264998225386b5a1bd5b33a9e92c56586484b227.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c7f212-3e24-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776846205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846205, "uuid": "3a0a4786-2b73-4aef-b8f1-b3ed21e01d7b", "comment": "Malware payload (Gafgyt)", "value": "446a7ebe298e0121f04c05711a110313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846205, "uuid": "ab5ead92-535e-4fab-bb76-68e662e437ac", "comment": "Malware payload (Gafgyt)", "value": "4d632fc779db3041cfa5061eb43f357bc7253a3eecbb3640238e5be8d03bbb94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846205, "uuid": "36bd1856-470b-4c06-b275-b468eaa1c223", "comment": "Malware payload (Gafgyt)", "value": "1767aede31820cd56ff5862daa81165ab891dec5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846205, "uuid": "a47ab98a-5a98-415e-8b13-72dfd1578a5c", "comment": "Malware payload (Gafgyt)", "value": "7b9d9e635b15753ab0a814b0fc1c57537b442cedda6aa884804d9d800272b32da2e39f3a4adfde28ee90e722c311aa9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846205, "uuid": "1b498823-f7de-480d-bb1f-815d3442ac72", "value": "T151F2F1D2D34C7832CA223C31C57BCB4211EA2D1169AA30F6B59866FEF896513ACF4496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846205, "uuid": "6c528507-8fdb-4930-8f25-208e2466dfb3", "value": "768:3r0I4emOitqNSet3+bAYs+UDpOGLEcujVzcYmvPtRfkjFbJMtEQ4Xk1SlSWUZ3US:3gumOPset3+crVlGVzcRlFk1JMKQwk1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776846205, "uuid": "f644f739-a884-48dd-a438-4aa80827591b", "value": 37556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776846205, "uuid": "0e78973c-1b6c-416e-afc4-5f5b04874656", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846205, "uuid": "6f93faab-2616-4912-a001-40046513ea0c", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5364d7f-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876774, "uuid": "acc043da-8bc4-4b79-ae02-af3c86d246c9", "comment": "Malware payload (Mirai)", "value": "dab689b7e654ece6f8ea92abcd6eec1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876774, "uuid": "3e05dbd8-63eb-449b-8add-07e71b4a7c84", "comment": "Malware payload (Mirai)", "value": "4dd771642a7baf30f3ef6974c37c20bdad55a879f6ed2fa0d87328bdd4055258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876774, "uuid": "56bb2204-2aec-4ebe-98cd-014d5d72b7f8", "comment": "Malware payload (Mirai)", "value": "a0f2e303d43dbf7ee20a17ae0524f2ebffd70385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876774, "uuid": "deee4f1e-8426-401e-a2d3-9425ecd26c8c", "comment": "Malware payload (Mirai)", "value": "9076b9fb005bf6d701ef795d11b0aaed2378dc39410a4a93317566b7cbcb98c49d7d4237dc7d623ad9b8cd0beada1ae9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876774, "uuid": "31e418a8-bfa0-4dd4-92e9-cea83d14d805", "value": "T19B535BC4A743D4F8F95605795133B7336B32E53610A9CA8BC3A8BA32BC53911EE1B25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876774, "uuid": "24ec8bbc-4d7f-4fbe-b9ba-3e9d01fd38f0", "value": "1536:iJ1cbpvrvokOkeu9MPQNqOr6dPlKvCBI9PyTCavNuMFVtKSSBdU:iJy1vrv9euuKqO1qC9SCwkMMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876774, "uuid": "6334d75c-f0bd-48d5-ae2d-fbd9d6f07c30", "value": 64592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876774, "uuid": "68ec84af-bc3b-481e-accd-98d2697de486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876774, "uuid": "93ba6087-1d0a-4756-b0a6-42337045d0c1", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94661bb4-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820885, "uuid": "238b050c-7f78-477c-bd00-0fb5e916eac8", "comment": "Malware payload (AgentTesla)", "value": "d8699a77398df73f03ff921207b94fe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820885, "uuid": "960a4bfa-5ed4-48b9-bd56-783a9a925f62", "comment": "Malware payload (AgentTesla)", "value": "4e3a83b32bfb612a260f56d721464ef4aec86c8ea76495a2ff0bef8c1338837d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820885, "uuid": "556637b1-da35-4b3c-8f56-75cd01b42f76", "comment": "Malware payload (AgentTesla)", "value": "4df862a81950bc69bebbaf4eba3944d67b90dccf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820885, "uuid": "19123377-5226-4f61-8754-59f55738ad47", "comment": "Malware payload (AgentTesla)", "value": "69cd85b931bb41c052fadd8dcfc2b434b11b29f329d82cf5a2dc333ed1b3e6c8eb30d84a1dc737caf8d37039bc0a862e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820885, "uuid": "a665dc82-6893-48a6-add8-3d37e9703a6b", "value": "T1D015BF62AE226B51EE3D5BBCC0D20C54D7F88D079301DA4FAFE832EA5977AC2C513911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820885, "uuid": "332d2fa9-0877-48e0-a94c-cb9e45df3537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820885, "uuid": "62034b5b-abe2-4718-976b-68a09abe319a", "value": "12288:j2kwTPyG58L+QiQoAWjL7KcXdn+gbkNEQCvoGFvQGtY7/2kt8:jHwTP/AjonLGcXd+HEQCvoGFZY7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820885, "uuid": "dc2324da-f7f1-4d14-85cc-9dcf2ac35810", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820885, "uuid": "ace9f3b3-afad-4b82-9e1a-c08ba1517d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820885, "uuid": "8f0f5ef8-e41c-403f-ab29-ca99e4718775", "value": "N\u00famero de cotizaci\u00f3n de la orden de compra 140467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb6f4b5-3e5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776870133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870133, "uuid": "7d3aca05-de5a-477c-ad62-6d67e5eec194", "comment": "Malware payload", "value": "3dcad3f2e12bef9641371db7500198f1", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870133, "uuid": "054ec7f5-cab4-43d7-a8e2-450a8e10bcc4", "comment": "Malware payload", "value": "4e5d56ee7752035330278b2a38b429c3c7c6f95b7aee892d8ef4030d325cc92f", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870133, "uuid": "d78edec4-68f0-4aae-a332-3bc8d99e62b3", "comment": "Malware payload", "value": "19774c02b3be0ac08dcf6a68d5ed0e51c74eeb1d", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870133, "uuid": "4cd6ab00-5cb8-472b-9d9c-554aa2b90c9d", "comment": "Malware payload", "value": "a79eea00a4ad4fc986a3c592d19e1d343d661a505b94a63097edd2a057ae58bd339735a927801ef62b53d29c7e017a5e", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870133, "uuid": "fc4a5e1e-b8a2-4f69-84c5-6aaf9f6ba61f", "value": "T1F105280772E98A22E05A1737D5E708008BF6E5827363D70F754523A929437EF9D0BB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870133, "uuid": "bff1063f-61a6-4cf7-95d0-de652deafcb2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870133, "uuid": "9add1a83-2613-400b-8ef3-a9de6b21476f", "value": "12288:cbj8I6reF7oGma0lcaYq86HmA1I3vbxkC6WiTxe:g6reF7oGm9lcxlvdkvJTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776870133, "uuid": "ce484585-1925-4051-a8d2-e7baf6005f4e", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776870133, "uuid": "55ca05eb-3811-4782-8cf9-760d660433ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870133, "uuid": "9d780f27-c48c-42e9-a80c-ed107cdb14f3", "value": "4e5d56ee7752035330278b2a38b429c3c7c6f95b7aee892d8ef4030d325cc92f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87a5aec-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880216, "uuid": "299c98df-6db9-4b86-a138-49d8d79d31eb", "comment": "Malware payload", "value": "2209045f7d500e49fff20d8ba50fc0a1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880216, "uuid": "accd01af-28c3-4cc6-96da-35878413c073", "comment": "Malware payload", "value": "4ec74fefd4926e86949bb4744627ec4f626d0545b449afbad27b2933f02c4c40", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880216, "uuid": "437cd71b-967a-4a59-aca3-8ffdc2c36cc1", "comment": "Malware payload", "value": "546973407aee450eaa1ff1bf3a13e6a1c39a78ac", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880216, "uuid": "2b6c791c-5a60-43b8-8550-fe0f781b9fe9", "comment": "Malware payload", "value": "5a842db135ce2153206aeddee8341bc08a7eaf20e65c5f2f65afc45bc0d99dea814247a4a92370a8f43639fb98e3b213", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880216, "uuid": "9564ca89-6208-4f8b-95b2-8bb2e47ade62", "value": "T109D363CAED9EC0F9875E746585DB4C57868AD11B212CC1A2FF5FA6E03F12C24D0A7AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880216, "uuid": "2d5922ac-96d4-4db2-9c5d-d0c7cfbed020", "value": "1536:K+b5je8TOum/XRG3itEXHqzF6i70i0OtovRTLLOrl3fU/:xmHWXHqzF6i70i0OtovRTL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880216, "uuid": "ec74c94c-ef01-46d3-8351-9f651f156b7c", "value": 138566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880216, "uuid": "5a01a004-0207-45e5-a7b9-c0c33022be10", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880216, "uuid": "33053c49-e1f5-43bb-b7f8-d49b02b2fb70", "value": "Global_Core_Backup_655.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb973219-3e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854532, "uuid": "09260f0c-a476-478e-85d2-11fbf5b245b9", "comment": "Malware payload", "value": "9710829bcd7ceaa6db6271613c404b31", "object_relation": "md5", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854532, "uuid": "3e0be99c-5b67-4ab6-b9dc-57f9cbca7a94", "comment": "Malware payload", "value": "4f1ade751ddd15affe423ca9f138c7520190137157617d4e89e5fe6dee26c635", "object_relation": "sha256", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854532, "uuid": "745fcdcc-e8b1-4134-9993-419f314fc8ff", "comment": "Malware payload", "value": "f85ba26d3c94b775999d049c6f3abad63279fc0d", "object_relation": "sha1", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854532, "uuid": "4087d8a2-07ce-4e44-a07f-1c80f7f507e8", "comment": "Malware payload", "value": "3290f972179259da33d6c3faa93ed6c225e15199eacbf78b9810a212d6b05110adf46274af39df17a39832be069d53a7", "object_relation": "sha3-384", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854532, "uuid": "b9576d71-9f44-4054-82e9-c45710e28440", "value": "T1C9658E07B3B900E9C077C179D9165A17EBB1740503649BDF65A0CAAA6F23FE21B7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854532, "uuid": "1da7ee41-161d-466e-a670-2e9802e1e6d0", "value": "d28b74c90862a3d1412c0dcac614f21e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854532, "uuid": "91fa118f-36f7-41e4-a2d3-dd81ec85e711", "value": "24576:/7FPhDc8u9J5hcV7Xp7okD1Axm02UafoQpTzwP1XoG8JYdNL3Ei:kD9nkhAxm0OoQpTzwdoGP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854532, "uuid": "8bb5b2ed-8ec2-4641-abc2-cf918a9e1d33", "value": 1491456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854532, "uuid": "2d52d00b-fef0-4368-89e6-f7858b7032fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854532, "uuid": "c80cf13a-81bb-4b43-ba6d-b0746c895cc5", "value": "c_x64.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ea3518-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821845, "uuid": "636eb55c-bb1a-464b-8314-5485eab0865a", "comment": "Malware payload (Mirai)", "value": "c4163ca1eb0b6a39b7659dc9154705ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821845, "uuid": "b989e304-6d07-4d78-b4e7-38d1f69e0168", "comment": "Malware payload (Mirai)", "value": "4f60cc8c698224ffed7001fb03744693ff4de6c1d1e90a8d44b9408636aa99b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821845, "uuid": "387212dd-b3cf-4914-a480-7610e5016bac", "comment": "Malware payload (Mirai)", "value": "14efc59ff3bc8e5ebf1d735504c4b903833f0169", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821845, "uuid": "d27f52ad-547a-4cac-aec3-6f818435921b", "comment": "Malware payload (Mirai)", "value": "8675b38c242c2df19a4b451fdc6ff2e84ee00bf8843b571c87c8a94c1cc4c91da7edbea841cf278e6a762093d3f188bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821845, "uuid": "1a01394a-c4c8-4148-8b67-21154b517ceb", "value": "T17943C552BC815A2BC6E422BBEA6E518D3371B3F8D1DA3617CC111B64778941E0EA7B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821845, "uuid": "82512c66-2cc8-4b90-b650-5910e9084f42", "value": "1536:0IZejd/oZ+SaVP8+ctncSlG9WtQf05bd42+n:0IZM+EYtceG9SQsDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821845, "uuid": "f1083229-b53e-406b-a6db-ae09761722f8", "value": 55868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821845, "uuid": "e20311cb-589f-4a1a-98ea-5877f428b967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821845, "uuid": "338ee7fb-8a1d-4433-97fc-4ed0658c3f22", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007e34ed-3e38-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854567, "uuid": "3c54d3b1-3e22-4892-9b0a-53a6c811114a", "comment": "Malware payload", "value": "33d855594361c9f83f24e0f92ee66693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854567, "uuid": "9469a7e5-e74b-4691-a49a-350d07465c41", "comment": "Malware payload", "value": "50a891fe72f61b91bca13326f7b334437054fe8e6d6620665c3d47b0118c7792", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854567, "uuid": "90ff341d-4f22-400e-b4c8-0afb3a9f8f39", "comment": "Malware payload", "value": "95a43b1207fdb8feb2ce222765c61430a42c83ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854567, "uuid": "bf88c17f-4e65-4422-a7dc-412de970899e", "comment": "Malware payload", "value": "220f5f2bc994ef4dc926c9dfdacb59a0a3da39da648448acdb6895f025a95028e509902fbf22f92e66f22dc07e379a5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854567, "uuid": "5abdd0f8-dbaa-4f39-a26e-323c4946608a", "value": "T1A525BF83D292915CF41AC1715B2EA273F537BC458B29AFE76390DA361633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854567, "uuid": "c222069e-f607-4ddb-9503-f77059b57465", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854567, "uuid": "cca9562e-7496-4042-86ce-8bd61531ee85", "value": "24576:D+pqj2TUOEe0JRh+w+FY5bkY5bBY5b5R:DyTnEeiRhgYiYDY3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854567, "uuid": "a4df2ed2-34e5-4ba3-9208-02944e5b4466", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854567, "uuid": "adb80ff8-d2df-4e79-9b72-8b5dc361ad7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854567, "uuid": "3e194c92-7f7e-4241-bffd-c710484651aa", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3d1384-3df9-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776827525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827525, "uuid": "831ebea2-08a5-42a8-9fb3-4935e0eeaf6b", "comment": "Malware payload (Phorpiex)", "value": "2a63dbdbafb1f5e0b629d337baf019ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827525, "uuid": "3574b058-f467-4287-8d31-9fa5bdb44bc5", "comment": "Malware payload (Phorpiex)", "value": "510291a735a43bd73c73a172e183b2888a83a0ff69c6c16b19f37a9109d1c074", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827525, "uuid": "17d0e3b8-d3b0-4fb6-86dc-0e975f9ef394", "comment": "Malware payload (Phorpiex)", "value": "2dedf29f91ab7b686c4a79c0a4cf6358cff580c8", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827525, "uuid": "aa11c5ea-d931-4ba2-9262-9d20beaba3c6", "comment": "Malware payload (Phorpiex)", "value": "f09284bddba0238c34fbb4ff5a94b95b471fca9a76a7b2d0e87af82ab4ee0f9f6dd16023f464d61b606b72691033f306", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827525, "uuid": "1e740d5f-eed8-4e37-9e92-cadbca8d6e8d", "value": "T130824B0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827525, "uuid": "a5c475c6-25e8-42ca-be05-c545dd1d140e", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827525, "uuid": "19f1f6a8-8082-463a-8cf0-b8b693b90212", "value": "384:MI78VGQic1Kwzw077u9NHu/gBhav8U9cS:dAo0769Zha0UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776827525, "uuid": "35f8167d-46e1-4439-8100-7811bb4338c6", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776827525, "uuid": "ec12e216-a1ec-4c4d-b015-98bf7ad12f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827525, "uuid": "3a399bef-779b-404f-90bc-288f4b7b4b48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3e7be7-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876759, "uuid": "365936b5-c542-4d13-8cae-d2cc2bf71cfa", "comment": "Malware payload (Mirai)", "value": "50fbd0807fa82415681f38e527f48962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876759, "uuid": "9f558877-6b8c-4788-ac7c-0e6d8a603694", "comment": "Malware payload (Mirai)", "value": "514425f689ce06ada0adeab50c40fe22e1259010dad5c786d0885abc9ce60dd0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876759, "uuid": "3690fac8-179c-455a-8c47-8d69ed44c217", "comment": "Malware payload (Mirai)", "value": "9dba52d81de98614cee9bb48d9a63b3791c669c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876759, "uuid": "e5cdff78-c982-4c03-857d-704b54dfffb1", "comment": "Malware payload (Mirai)", "value": "1f967cffacab3369ceac0241471d5a628f1d1a0881f1151ba82f470d8c03a7700effd5d3ca5b50d6b184586701617b98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876759, "uuid": "30342ab9-0274-466c-93a4-ec596c4c3d18", "value": "T13BA3D91E6F21DFBDF269823147B78A21979833D627E1D685E19CD2005E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876759, "uuid": "99f605b1-9b12-4c99-a89a-22e20b5ccb8e", "value": "1536:V4poNIjCa2Va39mUpZrLNjkWQGjeuvFXz361d64m:rNIjn2Va3BhLdkWfjz25m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876759, "uuid": "eb4a1892-2747-44a4-9348-d9fd96592c6e", "value": 97912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876759, "uuid": "c12ac102-69ab-45c5-9d45-c09a55d71146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876759, "uuid": "25190e1f-604c-4f3f-9c00-361825e896ae", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af39de76-3ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776816635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816635, "uuid": "bfe2e572-3730-4624-8183-22802958a817", "comment": "Malware payload (Mirai)", "value": "b1f48777748395093c7beb3529f21c6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816635, "uuid": "3b28950e-eafe-4763-ac2e-9efafafedf99", "comment": "Malware payload (Mirai)", "value": "51909b551ba69dec9235fb6617dd94bd8669fad20402c4a662c3f821ffce649f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816635, "uuid": "dc2aa7b8-baf7-425e-b306-cf691068c02c", "comment": "Malware payload (Mirai)", "value": "dfd2c8d772165f1096cdf4d4c8f59585a6d62b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816635, "uuid": "9a90d60e-f57c-47d9-a104-7f2bc7045a92", "comment": "Malware payload (Mirai)", "value": "ce0b334cd77dd84ff06b786bf837ab3340438fcc7746f62ed43a2054a7d96b8a994f20e06726ac599fe5da22c0e504a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816635, "uuid": "a6e6640d-379b-4716-92e2-b9b43263e49b", "value": "T1135302E3DB1416D186746973E9F5947719BECAB23C70D09E0EAC431C18F34AA9BBC091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816635, "uuid": "9a484aec-3263-4efc-9617-4fbcba3e1713", "value": "1536:TjhHuQkq7wSwYRtiU6YKvDpPh6xlc1lZMhq:/hHuQksw3uiUt6GlKlsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776816635, "uuid": "8bfb01c3-4457-41f9-a00c-0331c90646ae", "value": 65344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776816635, "uuid": "5d6b1b50-70ea-4940-aaa6-ea081408a6a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816635, "uuid": "fd4cfecd-1285-4e1d-b4da-c24f5ea2b654", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffa3826-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895100, "uuid": "6669f6e9-bfd3-4572-9222-921a3e3f823b", "comment": "Malware payload", "value": "5d53b6fe3fb5e1bd2c63e94ac6b5d22b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895100, "uuid": "d7d9b8fb-ed2d-42e6-9b56-e1a32fc32e1f", "comment": "Malware payload", "value": "5351dbd98770f25448b0ef02750e10bd1ab03f426a67e4c4315e1422e0ae82d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895100, "uuid": "afe365c1-dec7-4112-b2a2-3c1f9a8fd342", "comment": "Malware payload", "value": "04f2371188fca760a2c08ce35a39883e9c513758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895100, "uuid": "058f5945-eab5-4cbe-8764-6b003902cdf2", "comment": "Malware payload", "value": "58b05229724bcf0485e7dbc4cdfbd8a452e0914e3f805078794fbb794f381818f25ccb2840f4d65f1687038c7f1c8b3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895100, "uuid": "d42fbe35-3734-4817-80eb-ff5294ca04ca", "value": "T12A6618137A28E70EC22821304DB1CA94677A2C5942D79527B391F729F9F20AD4DAFDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895100, "uuid": "bc4a6bcd-1e0d-4ce1-8f0f-466aa0c3f421", "value": "49152:5LgdT4WES8IdSiu8IjuL5MAlPGXNOC77eRT6fHZZz82+VPlWvMYouHxvt5EU:EMAQf38r1YfRvjEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895100, "uuid": "0ec735ff-d780-4f97-9014-9b4136b722ad", "value": 6815959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895100, "uuid": "9c234244-2a91-49c0-b570-17441badc39a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895100, "uuid": "d5770f47-54fd-47d3-a9b0-5d04758a063f", "value": "h2stream.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9286d19-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821886, "uuid": "b1dcac0e-d68c-447f-a9df-277c03f3d190", "comment": "Malware payload (Mirai)", "value": "1686e4f416146d361beca55e818e12ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821886, "uuid": "7826eb76-670f-45b2-aa6e-dc3fc01c8376", "comment": "Malware payload (Mirai)", "value": "53b083aaaecde5e17a02217c6234705985c29c7f2ed2079f0021390fe9fe3a01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821886, "uuid": "5f0e5ea9-e042-4686-ad62-f545c651947d", "comment": "Malware payload (Mirai)", "value": "464b7261a8ab441b0fc97a209fb3189319b823f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821886, "uuid": "02d325c3-6436-4319-9bed-6c41ce95ef87", "comment": "Malware payload (Mirai)", "value": "ad8b8469c601c6f079b22b29808ec25c87093de9cd3a19ff70bdc1a34b3bc6df9a8be2046e634cf3cb1c0cb61bcd70ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821886, "uuid": "e45c5c95-ec3c-4ced-b18b-c388e36e104e", "value": "T1AC434C4332280E17D5921EB0353F07E083BEF95122F5B68A650FDB668639E761086FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821886, "uuid": "0a4ca366-90bb-4814-944c-31c3c9cc9202", "value": "1536:R8CkCVo97aKfzl/L+1zlv3vbxudQCwBGagd42+D:Rzy975/M1jxMQzGPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821886, "uuid": "baf0a889-862e-451c-acbd-00200e2e6050", "value": 60360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821886, "uuid": "ce84dd23-57c7-47a9-9eba-3078b2501a41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821886, "uuid": "3c77f427-74aa-4b3d-bc07-71bcf40ae291", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed2b640-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876951, "uuid": "f137bf01-58cd-4787-aa6a-b3f1c98a490c", "comment": "Malware payload (Mirai)", "value": "a63ca56c0551f1b00081c7d367e8bcef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876951, "uuid": "a0e655dd-3397-4eb9-af5c-1ccdb302488b", "comment": "Malware payload (Mirai)", "value": "544cb36ea672c8aa276ac42297c45c4396e332a04c862f64ab1820312dc483cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876951, "uuid": "32aa7df3-da89-4b11-9ce5-15ac73bc0df4", "comment": "Malware payload (Mirai)", "value": "2b7bf1b5112c9a29eb2181b56fa4a65923c85678", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876951, "uuid": "fff5fbc2-8e41-4d7f-8a00-14f946e5edd6", "comment": "Malware payload (Mirai)", "value": "65c95d41f0ad52e856b62ac8f3e0510a160348669251b1c038d71167679c04b98e23c9a095733cf96e881e90986ff21f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876951, "uuid": "a674d83b-e073-410a-9f0f-cff35d79b2b5", "value": "T16FF2D068C0F6EC36E6BB6EB159C9C7C123244F9DB7374E9270498B102B22E27161DED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876951, "uuid": "5bf2a8e4-8f37-44e0-9b62-cc1291842665", "value": "768:sk9hrdmlHUKd0OmGgZvoBHiJ1toEHYLEy4uVcqgw09s:sk9Nd6HDz/kek1toKSEy4u+qgw09s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876951, "uuid": "bf5b4489-4005-4641-974c-d5efe61378af", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876951, "uuid": "f790208f-f5e1-4f98-888b-b71388acea4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876951, "uuid": "bd4d092f-9856-45a4-b085-135a925d0b7f", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6173d5-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776882313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882313, "uuid": "64d525fd-b82a-4ae8-b534-d50ab653c48e", "comment": "Malware payload", "value": "1443287ac28706eb73cb8dc69edf670b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882313, "uuid": "56ba2430-beea-4397-aa6d-843f5f3c529d", "comment": "Malware payload", "value": "547248f2a5abe77b1d47636281462271a54e0bf694cecc1edfccbfc83de95019", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882313, "uuid": "cfdb4fe1-e271-462b-a111-f513ede9eb7e", "comment": "Malware payload", "value": "a94b27530e14146f5edd56ed3634bc8243ae75f6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882313, "uuid": "18e6b07e-709c-4632-aa60-c16858111b72", "comment": "Malware payload", "value": "eadeb6f1865aa5fba47d0aeec78436e45dc38867cbd487f8d5e0655a8aed77af5a6948bb8a576b7c4891bf198b638a82", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882313, "uuid": "ddc63777-63dc-4c59-ae1c-984f038d639a", "value": "T1DD11E4BA76B0A0F68EFBE820A3BFEA469561F6774471D1B0704E154D74C20A772E3430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882313, "uuid": "fb8cb4b6-d516-4473-9908-4c2188b40ea2", "value": "24:nZAjQNOvJ7n5qJKJyTXvvayyhxVuGxy1q1odT2TTqh:nZAjsC5n5qkKv7yJuGxy1qICqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882313, "uuid": "9ad5a109-309d-4347-a003-3bf90980f48f", "value": 1097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882313, "uuid": "c9e16ff5-2a88-4c7b-ad53-68913c605cda", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882313, "uuid": "0cdc6647-a56d-4837-9684-7116a6dd8bdb", "value": "rename_bots.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f21706-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876638, "uuid": "04ca0c64-6122-4526-a0f1-05c2018d16fe", "comment": "Malware payload (Mirai)", "value": "ab85da52b476aec480bea57c19ed1b57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876638, "uuid": "24ba1d7b-4d76-4ddb-8272-e97f57724466", "comment": "Malware payload (Mirai)", "value": "54adb83e52d1e3c65a5f8086642cadc525e2a4e642ce5bb3fd6b8955f7cf678a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876638, "uuid": "a0df2994-ccf8-4d58-bf17-5bc3f6acf14f", "comment": "Malware payload (Mirai)", "value": "a460ad040af6f3d7d7a7c0fa33157be556256106", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876638, "uuid": "b6804c99-7594-46e9-a199-b4ae7dcde092", "comment": "Malware payload (Mirai)", "value": "1de90d024d439b20f81e5942261ef88e5eceeee0a0e11f1f893fda27213d6da67fb5ad8123acefbddba81e938c8b56de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876638, "uuid": "5f8671c9-08e2-4d43-804d-e41882321c96", "value": "T14A03F14C935055FACAE84AF5256C036059B14E563113F8022E4EDABBEAF1D363C5BDE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876638, "uuid": "4b391ab8-b8b8-4362-b9b1-c66c5ed73c46", "value": "768:gi231FZvxdHbgC7j/75fLYP1elii+OOBBNT+zm3qKYiNN0KVHpK2W/bsJgGlzDp8:KhxFrqe/+OMgm3qQNJSbkVJuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876638, "uuid": "547e595a-2d80-4f84-8140-c357c02a7f7e", "value": 38868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876638, "uuid": "4feb5ac7-28a9-4bf1-8591-40aec1877bcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876638, "uuid": "45d2888f-71da-4fda-8d02-faa25d29f11f", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a523d4d4-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876747, "uuid": "bbd71ef2-9886-4303-a74c-357303a7a39f", "comment": "Malware payload (Mirai)", "value": "c5da44d07b72afaf81f8d06bcbbcc040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876747, "uuid": "3bd0772e-3f8c-4705-83ec-2e1cac65ca3d", "comment": "Malware payload (Mirai)", "value": "557f0e4118fac9e8fb75d403526ac2d530766d79ce7a9600bd99f258c682364e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876747, "uuid": "75929b7d-23d5-47cc-8b4a-881e8e9ae4c6", "comment": "Malware payload (Mirai)", "value": "272317dafd64e31f32aac0d7a7ddeaa4273b0d85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876747, "uuid": "997176b8-897b-4e24-899f-23ddc2528fdc", "comment": "Malware payload (Mirai)", "value": "95fedf4f7d14c6ef43741ceea1e2dae40e5762fb95c1de8f22d23c1c2438e635670f1dd8f9fcf84257f8914c190cbd77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876747, "uuid": "2419f8a0-f4ff-4e2b-be43-bddf4dcbfa1c", "value": "T1F2A30709AB650FF7DC6FCD3706E9070635CC651A22F97B3A3634C918B60B64B5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876747, "uuid": "c6e54a55-e4d2-42bb-90ba-8ea9c84cb78b", "value": "1536:uJri55uEJPlFqMBCALbF88QUW/M1ms56XGZDQ+wbp4lx9LJxXY61d6cM:A+3uEJ9rbxW/w6XGkmRxX1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876747, "uuid": "4f27c17f-549e-4540-ac02-85138b80ff43", "value": 99560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876747, "uuid": "c10b1fc4-74ec-4d5a-9067-14ec37c8769a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876747, "uuid": "a8210b79-2403-49cc-846c-06783e536d63", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031ed55f-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894944, "uuid": "d9b4e775-222e-4020-9751-2f705d493827", "comment": "Malware payload", "value": "944d475af1495759703a27da95b8efef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894944, "uuid": "6271b71f-67b9-4553-b0ab-9048f0eebed6", "comment": "Malware payload", "value": "55fca40246251a757b6cf3353852f65cef12cde48ceb7396946224b0569125d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894944, "uuid": "6a581b28-c2c3-43b1-b59e-fe84234ebfb8", "comment": "Malware payload", "value": "89d700e6491341b21ce319b7aaefc79c5fbda90b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894944, "uuid": "78d0dbcf-80b1-4ba0-8c37-9eb29c241c23", "comment": "Malware payload", "value": "9de1b3f6c4a7d4df0aaca2e10b8ba1a50bc4947974aee5fa2ce1349703a873521a786dcc86955dbb0b70b759914179ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894944, "uuid": "60a33639-dc8f-4cd3-bc51-81281abae427", "value": "T18B66D919ACC42BF6C06C5B7454EACA5522B06D144EF14A2A26A4FFEDFC762347F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894944, "uuid": "496edd79-0031-4cd9-aded-dbc55c505318", "value": "49152:uPRtxm8YiC47QmvMLq2dVByEcqPJKpP973LdcMt5Eqw:WLvMXV3P43yeED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894944, "uuid": "bd7deddb-6cd0-4aba-9c48-c1a4aac086c2", "value": 6815959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894944, "uuid": "7bb69c87-ef06-4ab3-a5e4-08a5e198b354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894944, "uuid": "5b1a11f4-8b46-46b0-a9db-5fe3737fdd83", "value": "h2stream.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5286f29c-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876179, "uuid": "45796dec-8d9c-4122-a4b8-ab1fbeeda3fd", "comment": "Malware payload (Mirai)", "value": "01c427f6f0dcbc3b37495b48103c1239", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876179, "uuid": "ab27b610-6847-4f5b-baa8-adf5669ef9c2", "comment": "Malware payload (Mirai)", "value": "56e95e081dc4b48c119d15409bd3d7258bb302970835191e1856c020c700988c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876179, "uuid": "ac9c1bd5-52a5-4b36-9d1d-16f230b41498", "comment": "Malware payload (Mirai)", "value": "5b4cbc3f0c2b5755d8d1cce3080ab03891794c14", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876179, "uuid": "2f20ba90-830d-4194-a865-5dc041269373", "comment": "Malware payload (Mirai)", "value": "5d9b4a6d2e73c05b98fd4a7e7c34ad02c338fdc77dcaf88d71b930da8fa5f7d70ce76bba89b97161af837a5e88e8dccb", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876179, "uuid": "8feab29e-668d-4605-962d-5d13c42dc565", "value": "T1CA2307DBF800E9BAF809D77B44A70506B270E3A6059317763367352BE87A2A40477FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876179, "uuid": "c28cab2d-f9b1-4823-b067-eca30325908b", "value": "768:xNMGZFg2dqx/waa86T2enZSbxR9i70gImhj+tPGGmTLKhgIoXmI3:xNMGZF5aw8G2eZSlm70gImhqt+GddoXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876179, "uuid": "0785e0d1-6d2d-4d0c-9e2c-3cd4e72f4d99", "value": 46188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876179, "uuid": "651e5051-44bc-454b-bb06-1efb2fee97d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876179, "uuid": "38e39763-95f3-4277-aa38-9bcff7d2d705", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7aedf1-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884737, "uuid": "a5c7bda1-9c7a-4515-9c9c-ddd4684da964", "comment": "Malware payload", "value": "5d5ae6836d0c19718409a548f464d381", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884737, "uuid": "32ef6a4b-3d57-47c5-addd-418552b7665c", "comment": "Malware payload", "value": "575f5de937fb9a84c2c1f67ea4204e180a8e89c8bf01343afc42c6491d2cae7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884737, "uuid": "e1f265b1-cb57-4cfa-8efe-efaac2685605", "comment": "Malware payload", "value": "8aeb29a0b3547ee132893b5d0b42a236059ad023", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884737, "uuid": "3b14a524-38fd-4e06-9c83-7b4ea4994dda", "comment": "Malware payload", "value": "6c79e84d92f2a5c755aade04bf7fee9f7c8f4b8a7e817ccd2ca8a3806a23407c32f15ceaccdd498ba3d33508bd99be2b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884737, "uuid": "b5ff764f-d8ff-4075-84b9-6bfe06fa2721", "value": "T118248A67A42CA79FDEDA2F32ADDE8A3353A65FC4CA91103E0C14730E3C671091E39656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884737, "uuid": "7232801c-a354-48d8-b233-12eff6257266", "value": "5593e2897ee726104d63fd5edce0fe75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884737, "uuid": "b99aed08-e412-46ad-9d61-44d623e804d4", "value": "6144:mynOUNtdQ6dyJ6kMKxEWc8o1rD/yfW9oyxSdPN2g3:FnO56dyO7Wc8oNrRHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884737, "uuid": "e9501922-058e-4fb3-8ef4-e9c326515950", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884737, "uuid": "430600b8-fe52-4b60-b904-d19011b62ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884737, "uuid": "f1a3f00a-7de2-48c4-bbaf-5524f31a6c1a", "value": "575f5de937fb9a84c2c1f67ea4204e180a8e89c8bf01343afc42c6491d2cae7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a45887c-3e81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776886017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776886017, "uuid": "30b8686a-c69d-4032-86bf-b78393b31727", "comment": "Malware payload", "value": "56aa1025b206cabd2a0f5e4020dd3b5e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776886017, "uuid": "05542bb4-88a3-4bee-90ae-11db909ed031", "comment": "Malware payload", "value": "5816b746b3a6d5546fb2b16169b1ad7824fd200eb28d20542f7a2d21ea7ad902", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776886017, "uuid": "b327e15d-c1d1-4e81-90c5-d300bb42bdea", "comment": "Malware payload", "value": "2afc2ac4b0c9051a990db077e2ac200344e7d1fc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776886017, "uuid": "70f7cda5-0ad6-4b7e-932e-673becfcbe6d", "comment": "Malware payload", "value": "2d637a55a37f6677bab29fdf9392196755fe30b18ab5186c1e958fdb616759edf31a6989bca746199a589538f43dcea2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776886017, "uuid": "03ef8fad-0f52-4cb0-8d5f-095fd3515902", "value": "T1A0C25C56B205A332C5820B324A4FD7E88F7A9C089F6731027ADB734D2D765E02AB75E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776886017, "uuid": "2965e47d-59bc-43ee-8aba-df6c0bf179e2", "value": "384:qw1gkjee21ZtNV8Tok8hbIx84GPyJvoMey3M5JC0ioXntNo81G+OwBg0uN/nq:hor3NV8QOGPEvteWMbCkqN/nq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776886017, "uuid": "99c33034-f8a3-41e8-90a8-57136525e1ad", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776886017, "uuid": "b9374650-674e-4823-be06-60dd3a812842", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776886017, "uuid": "e38c1374-9002-4622-a065-2bdbdeeb3a74", "value": "azcopy.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7192bf54-3e45-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776860340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776860340, "uuid": "8497be2d-8760-4e8b-9158-38eb27525d5f", "comment": "Malware payload", "value": "25d18117f5b245a11ed5412fc0945f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776860340, "uuid": "ffc24e64-cb2a-41da-a6c8-3a3dfe04b0af", "comment": "Malware payload", "value": "58b59a4e5929f2f9e8284c463c50b38c0e08500bb32518978df82dbb91b0112d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776860340, "uuid": "e3d8a287-aee9-419e-b6d3-dded38da18e9", "comment": "Malware payload", "value": "e76aa3f89b0fe5f34778c238e97c4074a8d726a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776860340, "uuid": "5bda6a1e-10a8-4a00-9495-87d90ac59a3c", "comment": "Malware payload", "value": "a7f12e1d378c90c16b5de031593dac7cf97c6de3b206e0ed2b9ee6e4d0dd9e8bc5f8caccd86b3c3db7c1142276784b36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776860340, "uuid": "41f428fb-7fcf-4821-8d20-085487fea8f9", "value": "T18E352332CF522D788D59975FB2BFFE0829E18953A88D818BD97826471FF028F154BC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776860340, "uuid": "e57dd885-5e7d-4c4b-9804-ac5c84cb0590", "value": "24576:DIsy3F1kDVDc2ikUZL887wxYFc5DsM8AvPU:Pe2i3qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776860340, "uuid": "89cd3f62-ea7d-4f1e-98ea-93d6e87851fb", "value": 1112947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776860340, "uuid": "01d08821-3d95-418e-9f9e-1e778e886a24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776860340, "uuid": "eb7550a6-99f8-4d4d-9c9f-3f55569c427a", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436c2e69-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884744, "uuid": "a6fb21f6-777d-467a-a05c-fa3a269e412c", "comment": "Malware payload", "value": "0290ecb0497a70a1fb064540a8d24c5b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884744, "uuid": "1c1b012a-5590-48b7-8ae0-11a079ce641e", "comment": "Malware payload", "value": "593acebabb516255c3f4c83c9ecd4952b0f7fb2d9802cdd6fdff5659fdce2049", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884744, "uuid": "5c840d0f-e97f-4578-b056-6bc687c17bba", "comment": "Malware payload", "value": "f7d1fc90915bc359a2557e04702bfb9dbddfe30f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884744, "uuid": "a694a083-4228-4ff1-98b5-e2205d5a7183", "comment": "Malware payload", "value": "f47192fbe1f38c362ef02d40e55f32a0c8a6c12de8b03a64c121fb3befa243397f840b6403b03189b6064b0b1d4fdbb6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884744, "uuid": "9cbea30d-8965-420a-afad-2b26e450b70b", "value": "T194E42E6BA80622CCF6745AB458B81BBC965E172AC07823738F91451A5FC314F6BDBCD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884744, "uuid": "3d65f91b-3e38-425e-b936-76ad66f0bdf9", "value": "6144:4Piyjo0W/PYceUYA7X7rvyNEA/VPpaxFtyKU14Xoqm:4Kyjo0W/PY3DGX7reURyKU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884744, "uuid": "f22566a0-e78f-4298-b48e-bafd8f46e9db", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884744, "uuid": "0a5a319f-7009-4b1b-8c54-e4d37e2d8dd1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884744, "uuid": "41632399-5f0e-4b2f-897d-7d8a33572457", "value": "593acebabb516255c3f4c83c9ecd4952b0f7fb2d9802cdd6fdff5659fdce2049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e38c5d1-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877031, "uuid": "93eab19c-ca55-4f99-81a6-9ec021ade187", "comment": "Malware payload (Mirai)", "value": "ef677ee71ca5b24b1c8a95ae675c62b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877031, "uuid": "1935cb96-91ba-4f8c-82fc-959782521d99", "comment": "Malware payload (Mirai)", "value": "5a05f066de7edb8fd1157f71e6e5bb8683862d45db6c0eb27a8ab659f6819495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877031, "uuid": "c691061d-91e6-400c-8c1f-1a3cb5d19109", "comment": "Malware payload (Mirai)", "value": "400f9b0d3a0766c5d2a3194b8c5d0d3c75366663", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877031, "uuid": "5c10367c-b816-468f-b52a-baf417781885", "comment": "Malware payload (Mirai)", "value": "d549afe022ba19eb4f6859768cea0da35d7ff0f152f180ee0bd0c579f47275799013537cc26554bc32071fd5e30c5b12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877031, "uuid": "b5af8d39-6eae-414c-85cb-bb0693af36d6", "value": "T158831895B8818B12D5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877031, "uuid": "d4846d5b-736a-4c55-ad74-3bb1caa00882", "value": "1536:ijna/CzPC7fG7vnmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0om+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877031, "uuid": "12b30f6f-a75b-4a91-858a-63400e81ab6b", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877031, "uuid": "ea7fccf7-ab7e-4a45-a8ac-67e2d5e28fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877031, "uuid": "49a7c8b2-df75-4a81-a079-71d19b182702", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e58fa1-3de7-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776820154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820154, "uuid": "ef44da03-e810-4dee-90c3-2b0d7163934e", "comment": "Malware payload (WeedHack)", "value": "d4cee8b06d6408b037acf35133b6a771", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820154, "uuid": "de73f4bb-a10b-4e15-a740-3187fbcfc8b5", "comment": "Malware payload (WeedHack)", "value": "5a0e1a308637891990ac4d6b5560db8aa8044b1ff885061eda9e0fbac6b26bbd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820154, "uuid": "c3f00bc9-1dab-4f3b-ab8f-ec3116b2a514", "comment": "Malware payload (WeedHack)", "value": "7933c7fc98945e4da9bf31ce3359ce9b73d6146b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820154, "uuid": "e0d39005-efea-454b-85ff-eba48ecc5c34", "comment": "Malware payload (WeedHack)", "value": "2b26d0dfb531b4b92047318775778cb6cb691bd99bf3295c0c3689f3bf1fcccf1e739995bd701c6bb717f14eb185ebb6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820154, "uuid": "10c8880e-1b42-4505-84d6-dd832d55f7e1", "value": "T12595332B77CB5555DF936EB202D15EACC628AACFC1A2112493E35B1A72C325EF743C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820154, "uuid": "caf31a05-1619-411c-800c-82defd885ad7", "value": "49152:4gLfKfwTRZiO7wbMEV4dNwb4Khks7Eo8Of:4MKfg40k3gNwmsgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820154, "uuid": "ea2aa935-f17a-4ed3-a889-a723ded8f079", "value": 2043593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820154, "uuid": "ca66e7ea-b205-4f7e-922b-e5219627a04f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820154, "uuid": "f88d0129-cf8f-48d3-a21c-62697a1562eb", "value": "Sorrow_Free-1.21.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148e76a3-3e64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776873498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873498, "uuid": "4d165ad9-3cff-465a-ab66-bc7aa0467c1c", "comment": "Malware payload", "value": "5b50817fce2fbcb814b88a0a79198f5d", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.TCP", "colour": "#A091E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873498, "uuid": "f842c5b9-a89a-4eed-8c2f-3a080d8cb66e", "comment": "Malware payload", "value": "5a2460ddbff46018cd979b30f6af1a02ddfbd0d49d353633b141265d68fad517", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.TCP", "colour": "#A091E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873498, "uuid": "cdd251db-2f52-4b8e-b4c5-c240fc740d8d", "comment": "Malware payload", "value": "b5c7304dfaed6609f13f5c2a5c81a9809517736b", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.TCP", "colour": "#A091E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873498, "uuid": "1c6f434b-cdce-4cbd-9bd4-0913f67348d8", "comment": "Malware payload", "value": "d37b8e4f8474a511bd1d79b132c340d56b73b3041740b8511f109534757d1d78606b4efec123f4922d628c92667d7148", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.TCP", "colour": "#A091E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873498, "uuid": "914d7efa-a3ec-4680-b270-5f239f18c2ec", "value": "T1B4273316E28E233EE036993549729955407FBA61A22ACCB3D6F08E4CCF2D4552D2FF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873498, "uuid": "8ce95971-15e0-4a07-bbb8-5639fba44a82", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873498, "uuid": "bcce739f-383b-4bd1-baf8-f0831a39ca82", "value": "393216:6Ddra6FP1y959634bZLsxJRC3q/6rPrf3Ca7pRtqlDT/TAW0g:81y95rFQn/QuiR0Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873498, "uuid": "3aad2dd2-ba27-4ec4-81ce-52dcf92c3c65", "value": 20314135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873498, "uuid": "2adc5e32-f910-490a-956a-771dca16f9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873498, "uuid": "cbf6c722-b94b-4096-8b13-f717612c7354", "value": "zpig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8698ea3a-3e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776851356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851356, "uuid": "352298b7-401e-4d48-a6ff-a7010ad2dabf", "comment": "Malware payload (Mirai)", "value": "cdfea3c686b5a55fc0a4d02da1916619", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851356, "uuid": "e64ac8a8-4c4e-4df4-8c81-c31d6e9d5581", "comment": "Malware payload (Mirai)", "value": "5a725048391e5d055281247ba0fd598f7143ac1d2b7fab5719736d92c9114346", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851356, "uuid": "fe64b926-157b-4ec2-818c-3923715837f1", "comment": "Malware payload (Mirai)", "value": "3d6a94ceefc9f801bb028152b6c7fd9ccb00bccd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851356, "uuid": "3a474241-e505-427f-b9f5-985f22db8573", "comment": "Malware payload (Mirai)", "value": "bba7766f9e2a977d4636a2f0000fe9cff7a18775f40efadfd686e67b9dfe45e143ceb5778e7cc54a012f251987b189e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851356, "uuid": "bd068cc6-5c7b-4ee2-a9f7-10f197c6aeba", "value": "T1AB31C9F9A1311ED3840ABE09FAB656FCB073B1A906961E696ED4787EC67C4207E0160C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851356, "uuid": "46d518b7-e2dc-4561-ab6c-b32515d23560", "value": "24:EsrSsGjsrNhsp+ss7XKfXsW6r5zep+D7XKUWJHOT7aVouQp08ooCvoCSkl:EZrjwk+smXSzf+HXe0o5dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776851356, "uuid": "99d35017-59ac-43eb-a5f1-cffb11f78db5", "value": 1588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776851356, "uuid": "b7a359dc-a3e7-4be1-9fef-9082d749a49b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851356, "uuid": "6df228fc-1c7b-4128-893b-9fc3abd37e8c", "value": "ssh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db54775c-3e88-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776889294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889294, "uuid": "f98befe6-9159-44f2-a3ac-8a85a5adb6ed", "comment": "Malware payload", "value": "aa066abcf0667dc144699192f4f83b97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889294, "uuid": "bf213414-f176-4ab2-b82e-6048747522c1", "comment": "Malware payload", "value": "5aebca345f3cc7fd0251092cce5682d68391fbd5b5c232c393c58082f0347a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889294, "uuid": "f85ea8c9-1e3a-4945-b37c-cdaab235df1b", "comment": "Malware payload", "value": "7ca9fc0bdf23a67cf766c803c61ce9e0bc0a4ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889294, "uuid": "cd52416b-e1e3-43e8-bc48-67fef190458d", "comment": "Malware payload", "value": "461d09809993eb6c97eece629d8fa615315491f90e518d5261ce0b2d340ddd3e190267f34b47f10be19ce28715d861cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889294, "uuid": "1237d318-76fa-42ef-af6e-b9e2e303e87a", "value": "T191144A2833EC4A14E2BFCFB995B090140676F4ABEC16E79D5D9620EC2D327469861F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889294, "uuid": "656240e0-1d19-4f65-a436-1194c8a038f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889294, "uuid": "832ca804-7317-4da8-8248-23ebab4f6460", "value": "3072:kBCBaxeImUupz/qWyPQjs0503flaJBCbzX0:kUpUjWyPTdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776889294, "uuid": "632278e0-99b4-4b1c-94ec-92fc042e872a", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776889294, "uuid": "6e07b993-9d5a-4178-b78d-ea6773230e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889294, "uuid": "3d323a10-ac5d-4e03-97e4-31441d0d1d8a", "value": "svchost.zowner", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f9c2f1-3e1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776842711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842711, "uuid": "72957b47-c5c9-41a9-be3a-4781ae6bd76e", "comment": "Malware payload", "value": "e5e8f9a1d3bfa585945888e0d930fe44", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842711, "uuid": "43986fb3-4490-4b8c-a2cc-2e47adaf5efd", "comment": "Malware payload", "value": "5b05fef4fcebf5d1b69776759cc5bfcd6c551a1e65f05a723d5a9d9de2abd25d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842711, "uuid": "fb3a4aa0-0aea-4f00-8930-0d775481c887", "comment": "Malware payload", "value": "f0055cec5362d17bf23e6d7ffa10db17f5127b7b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842711, "uuid": "967f93a6-7c1d-4f65-8c0c-f2f1eb71eaed", "comment": "Malware payload", "value": "eb408102860bf0986a7ef6a42263f34395b15a354ea1960e2e612def31315f75be0bfcf40b8c8c18d80df414cd7a9e27", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842711, "uuid": "f93874a9-08fc-4d7f-bcf4-7e27281f5e6d", "value": "T1F0D43977423478D2ED0BB3B5BACB367BFA84B9382170F4955A0257294DF46B2DE0421B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842711, "uuid": "3d969d12-49fd-4a70-aaab-d42f940d533e", "value": "6144:plSfdQV7gERhqo32F+g8wzq8VBwZfyvXEUHhSu/D7i0gtpp6mYSzD11RDqQZY:pA07zqo3k+g8wzqaBwFyvRfMp6y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776842711, "uuid": "37b3816c-815f-408d-8392-f2e40a60b0c7", "value": 639600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776842711, "uuid": "496ee44d-5709-4e51-916d-7640863c3839", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842711, "uuid": "e4f8228b-83d7-4223-ac4a-bd013eae9541", "value": "GooglePasskeyGOOD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b893862-3e53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776866262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866262, "uuid": "e7f7a18e-87ac-4123-be5b-7d61062db320", "comment": "Malware payload", "value": "551fe5faa211706a8f0448fad241014e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866262, "uuid": "716c61cb-d4c8-40b6-a2a6-0cbe8276b50c", "comment": "Malware payload", "value": "5b4ee50218dd32f3653a97fd1f6d767b4909fca2e0f8d69104c4d371af3e26ec", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866262, "uuid": "0861b55e-63d8-46ae-8d07-2133fd69fc55", "comment": "Malware payload", "value": "56b91474e5c3446ba3e0b04c2d28be969f25ce8a", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866262, "uuid": "bffa19e9-f281-4fe2-b336-385f8d45c0e7", "comment": "Malware payload", "value": "b16711e76b97296ddb3e4d8d906a6ecc90081566a3a4f87b70a001b28b2e5eb0dec53c12fb1ba2df14a4deba416a4d1d", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866262, "uuid": "aea60f50-a2a3-4f57-bc85-f0c50415ef61", "value": "T1BBC41200B4D1A475E0B72A7658E49DD9DA3CF5204B19AECFB3C8586C8F328D06535EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866262, "uuid": "66f73b7e-7bd5-48eb-86d5-762c0930c63c", "value": "4d1adb8c36a03a7a69c0e198ec96a536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866262, "uuid": "5cf8d8ff-92dc-4aa0-91d7-f5d8011c2322", "value": "12288:IHztGhqRHUvfAfyrZX8RnuFlluZRE/Tws4U76QcCibBp:ouK0qyr18RnuFuKTws2QcCQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776866262, "uuid": "ff10cd9c-50e8-48a9-840b-5aebb1408fda", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776866262, "uuid": "0ab8dbf4-f8e6-4efb-8554-766dd981e4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866262, "uuid": "76d4e563-174a-4dd0-961f-911399ccdd6f", "value": "5b4ee50218dd32f3653a97fd1f6d767b4909fca2e0f8d69104c4d371af3e26ec(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d1f186-3e56-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776867586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867586, "uuid": "338b76e6-2e17-49df-9075-ec3cc2afa09a", "comment": "Malware payload", "value": "cc60ac8abcd3a80e86389fea9faf7c12", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867586, "uuid": "cf41b139-e446-47da-922d-5899aa94817b", "comment": "Malware payload", "value": "5c11f39ef919cbe095b447f2663461dde5bd36b34a14538327e5589efa04803d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867586, "uuid": "cad7fdd3-d256-423a-bdcf-f10f661645c3", "comment": "Malware payload", "value": "7c66c2f73228ba587d42e2f3dca1f1f6a54a45f3", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867586, "uuid": "8d961721-19ca-4874-a3ac-a5dd88e29b7d", "comment": "Malware payload", "value": "65f5f92a61cf34e8d6596982a4f66568e357c25ef424d3ebc948f8bbea012bc499174ae35851a2b6c2bf0d93ae82b6bb", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867586, "uuid": "1f4f25ee-65b8-4a55-bac0-064e118b00cd", "value": "T1E6B0129745CD50383A0F7C7C42C035087A18D14B08999ACC7034005D551412D03F0044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867586, "uuid": "b81e27a0-07e7-4ac9-bca4-62468b6c016d", "value": "3:VSJJFH2EXotXiWja7UNVWud5HWayCMfBn:saEYtSs0MrvrGpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776867586, "uuid": "8386f2b5-63a2-49ef-8cdb-766a8df20560", "value": 97, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776867586, "uuid": "6c03403b-3b90-4909-a99c-69df1a08c9d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867586, "uuid": "f07edc5b-b8c3-4860-85b2-420f85979002", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323839ca-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895023, "uuid": "9fb7f467-6888-40f5-ba08-1166af7e7f0a", "comment": "Malware payload", "value": "21e9fcb05b138b271a4b7fb67c88aba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895023, "uuid": "de0a6ba1-46f3-4996-96be-c3336a289e81", "comment": "Malware payload", "value": "5c2839aae4f54664c44f31b5f95f16f2ab5195d538f092d45614eb7e58713ceb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895023, "uuid": "a251678a-7a1c-4ad9-801e-b87186d2c10a", "comment": "Malware payload", "value": "9112a57d5387f1ac9515dc1edd5b5d9afe2d488a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895023, "uuid": "36c7c633-2b9b-4d43-8614-ac667fa80ea3", "comment": "Malware payload", "value": "bd8ec14d03e53d0f906e32cf390ea8ff1dc0250500b85f9fbb8e6b3160ba579ed40f4bbdd4f57722915874b1d0b365fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895023, "uuid": "1218cde1-32d7-45c8-aa7d-990b2f0dd1d6", "value": "T19B565C0DFE248F71C65403B649F812981370AD02AFC747166239F73CFDB6AD4AE466A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895023, "uuid": "2c2c474b-3739-4d88-a542-210539de33ea", "value": "49152:namUgavBLbG1VG0UFFcUJTj3+dIfudJuV0l9cUtDwS5E9:FUgavo1VG0UFFcEENwoE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895023, "uuid": "54ea8444-145a-4c7f-815c-af9ec8cd3534", "value": 5898424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895023, "uuid": "e4f6f7df-1094-4caf-9777-6613ab76c568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895023, "uuid": "b902176f-d922-4337-bd6f-4920d92c608e", "value": "h2rapidreset.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e75310-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876718, "uuid": "c6fcd900-f57d-45c5-bb9e-9860f3001dbf", "comment": "Malware payload (Mirai)", "value": "9d69fb45d733689bcff184ea723aaca9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876718, "uuid": "431638b3-05d1-4262-a658-7606377c322b", "comment": "Malware payload (Mirai)", "value": "5cc13b3c082dd02f628346ece3eff325edcfd523b359eded79146ebc9299ab99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876718, "uuid": "ca6fb62a-165f-4ce1-bdfd-1e29298f7c99", "comment": "Malware payload (Mirai)", "value": "af23e1356113865af732887fed776e4dde5f0e17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876718, "uuid": "1f382a82-b689-4fa5-ad73-53da91d7b79c", "comment": "Malware payload (Mirai)", "value": "0b2ceb2df7cb5eb58269371b372404ee17f976e89deb4b7122d87a7f7a6d666ccb1f88a37754247a28cd531ca6c21e7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876718, "uuid": "49243d5a-ab40-4e4c-ad4c-3a823dbc05bf", "value": "T12C835C91B9815B13C5D012BBFB6E018E772A13A8D2EF7213CD26AF11378781B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876718, "uuid": "b5b38c91-46d1-4046-8dc4-573689e42c5c", "value": "1536:K1gjTcAjL0MRlyzkLumT8tOs/ycdt/F15wvb61d6ow:K1gjXL9LuOBQ+qRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876718, "uuid": "2e030ca4-4195-42a6-9579-b2b612830cba", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876718, "uuid": "d3133222-2b31-4930-8b5b-888e901876c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876718, "uuid": "9fa702eb-d012-478f-b095-0cae596f32a6", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1a891f-3e70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776878769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776878769, "uuid": "078d4ea8-32f3-4745-8b43-8726f7594078", "comment": "Malware payload", "value": "bdf8c551c07352f843ae7776b8168421", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776878769, "uuid": "d6efd574-c505-41f3-92a7-11c2a63ee764", "comment": "Malware payload", "value": "5cf6b28ef8e3b7260a7bbbde941dd7b0880705b67dd4848f9a7a82c8eea819ce", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776878769, "uuid": "388f94d0-5d16-406a-9ca6-9d7f74635c36", "comment": "Malware payload", "value": "c1adb2bb6390be07029febf2d8f756fd90c1bb45", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776878769, "uuid": "4f104883-3a9f-4051-8e61-e63aad72e85b", "comment": "Malware payload", "value": "dd0ce37aa9b112daa6c38bba614ca0c485b9cd9540fb5fe71afbeaf02f2c9c926c92b835600b29192c8ca98723424cd4", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776878769, "uuid": "40f38817-059d-4469-a02a-737dc9155c3a", "value": "T126D37C5C55AF01C45B7368E88BE6EC15FF552317051CC988BA2DEFE02F116B4E0EA6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776878769, "uuid": "113bdc19-593d-4de2-9c5e-cdbdd6c0d293", "value": "768:Bom3lP1zMCYQa6Ws5pT7rJv0ZyVEtsHLh5QaNcUZrwXbVpQhELqoN8RyDp3Z3XS:v3lP1zMCYQa6Ws5pTZtDrwrN7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776878769, "uuid": "3ab80284-8637-4737-9b24-5694b52aaffa", "value": 142876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776878769, "uuid": "bd9cc276-a0d6-438f-90f2-472352962240", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776878769, "uuid": "39af4d1f-5e5a-42a2-ac4d-b0b90316217f", "value": "Home_Session_Monthly_478.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790db8b3-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888699, "uuid": "f877c72f-219b-4c35-a1bb-befb9ff550df", "comment": "Malware payload (Gafgyt)", "value": "794e81e6f381a1d09c1db9e14128fa76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888699, "uuid": "4ea3470b-56c7-4d41-b48f-0484f6b17463", "comment": "Malware payload (Gafgyt)", "value": "5d68dfdfd725bbb5370c59af3d1ca1830abd935890b0d484c2c3ab72f3a4f0d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888699, "uuid": "e0b01ee7-d922-4bee-a460-3c55208fff73", "comment": "Malware payload (Gafgyt)", "value": "9770586d15720b5a108c837c28ab379b5c28c17b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888699, "uuid": "c1e55194-5c9b-4d9a-b108-3ed1802928e2", "comment": "Malware payload (Gafgyt)", "value": "48925b7837aead3d3d26278091bd72287cb7f8e04ebb84a72e281a60e39b4569cd2a607e2e5c6144c27a9bd4536f90ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888699, "uuid": "debed582-f096-451a-beae-7889096da74d", "value": "T199F33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888699, "uuid": "1f8d2626-dfe3-4673-bcd1-9198e9def458", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/ReqnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISanMqnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888699, "uuid": "da574bbe-6fc5-45bf-bbaa-135af2177587", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888699, "uuid": "01272be8-5c46-48f1-ac23-952cbab74a0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888699, "uuid": "c9abf772-2981-4152-b119-473bd9f8d914", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffb4352-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776888926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888926, "uuid": "080b734b-1cbd-40fe-97d6-f86f081f5433", "comment": "Malware payload", "value": "71ed869b438a7e7bcf7290c984cbe701", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888926, "uuid": "98814cbf-bd0c-4187-b322-fe3aa8113906", "comment": "Malware payload", "value": "5d757867287d2b5e900a21a7f22a3fe9a598fe04ee8a24f42ddfdac202c4ecf4", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888926, "uuid": "9f682f0b-1982-4eb9-b9df-cb244f91cb89", "comment": "Malware payload", "value": "ab2ba967bfcd3edbc8db6f92ec1438bbc84fdbfa", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888926, "uuid": "1bf230b0-950a-4481-b2a3-e18f60c7442d", "comment": "Malware payload", "value": "707bd14de2003fc8c7a21fc51fd6f74d80f3b5f6a65dd7eed5fa3e9fad66759d0e0a37a9066b862eeeb4603c0531c716", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888926, "uuid": "312fc605-a69d-4001-80b2-ef9f1682766d", "value": "T1540623D2198A23B1C1DFC3B1A512743DBD1D3BC43A67CC4B7AA965444F33726A63938A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888926, "uuid": "7c5b913e-5b26-4c74-899a-efcdca8d4913", "value": "89833cafc36ca6190701a0c267b25b0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888926, "uuid": "a6366841-2ce6-4ac3-9da9-a1bd5e84e773", "value": "98304:NFn6ZUhVrpQwfzigybz/lzNtz7OMTyk6o0gClkUoU:NFuiywxyb5zDWk50gek9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888926, "uuid": "be885c49-c8c8-4bdf-8925-8ae65c50dbf0", "value": 3905024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888926, "uuid": "649a7d3c-beee-4984-b001-8a981bb0f709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888926, "uuid": "6033a2f4-cfd7-409e-8143-0e1f2a61510d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7539c7ba-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848320, "uuid": "b10cee11-aaa2-4cf5-8ce5-2425306197c1", "comment": "Malware payload (Mirai)", "value": "6cac0b6be8a7723e1b45221cb144b1a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848320, "uuid": "69991bee-5a0b-447d-ac36-4fd2985ff9dc", "comment": "Malware payload (Mirai)", "value": "5da6ccdc950192e6d9de035b162c3641e5af86e5a01ad5acc89ff8075ce23fb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848320, "uuid": "e1b77730-084e-45d9-a292-f7cfbd8bbb4d", "comment": "Malware payload (Mirai)", "value": "4b18f11e08bef0d83f910fdc631a6b8d3689cf14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848320, "uuid": "6d2cbdf5-da7a-4e1c-b6c3-72f45de5b195", "comment": "Malware payload (Mirai)", "value": "5ef4c562d162ad4c6ecb3e781d179a80507ee5fc171a4536ad399be04d490d460cf4a33de9c2f708f826775fec9dac1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848320, "uuid": "79664d78-7dfb-4aa8-8af9-18d045850c60", "value": "T182934A45FD819A12C6D5137BFB2E228E372663A4E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848320, "uuid": "083bf640-b75a-4e49-915a-2d12f37c34b8", "value": "1536:BOR4DpGdpvkFdayIghb87P+L0T5OWXffdyDKmvZe:BOR4DGpsHk77PK0TVP0Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848320, "uuid": "c3a870a0-137c-41c7-8cc2-d0428c08bbb3", "value": 92252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848320, "uuid": "a405d1fa-dd48-41fe-823b-6029f6cd30ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848320, "uuid": "9b105bf3-2fa5-4bd9-ae40-3234989458a4", "value": "luxzz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47eaae9-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821878, "uuid": "a6f557b2-1d8b-4648-808c-258e53e97a1d", "comment": "Malware payload (Mirai)", "value": "550b2c48e2f191385dc9793a621d5289", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821878, "uuid": "06b67b66-254a-4442-b892-f621c805081c", "comment": "Malware payload (Mirai)", "value": "5de45d209e4920a2d700f8848cdbd4221953b1d802d489ce4396c0da156036be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821878, "uuid": "cc0dbbe3-5942-4ec5-9910-462c4feeb264", "comment": "Malware payload (Mirai)", "value": "3c2f3422652f43f93aecf065bc8c92568bde1430", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821878, "uuid": "50accd26-ea6e-40ef-b94d-6ee2024577e6", "comment": "Malware payload (Mirai)", "value": "073860307ad98c7f3de3c0e4b3bf2ca59e297f919e381b3dc321e4d4e7854ea04614eefaa9cc0edc42164b78e2b4fef5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821878, "uuid": "3a4bfe6c-bb28-4fd6-a3fe-e457b4d7f419", "value": "T1C4730A45B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F647BCA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821878, "uuid": "d8571de8-1756-4d36-80da-18629ae354d6", "value": "1536:eNnpO3C6BTG9CJn7UicACQo6zcZuY6ZvNrSVyo8nIMgiiRlFz1jd42+:f3C6A9a7UZ7ey29MvRlFz1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821878, "uuid": "559b216a-7724-4380-a16c-fb8ae9822882", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821878, "uuid": "8a164cb2-6bef-41d1-b715-1e9647d36ffb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821878, "uuid": "368ebcce-0724-4a5a-8caa-6ab87670854a", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3561029-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880261, "uuid": "da995f00-5880-469e-928b-7efc3b65fe07", "comment": "Malware payload", "value": "50979b1cec9daeee9524a40a6c252243", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880261, "uuid": "337a6f0d-fa23-45d1-b10a-4ce28ef8aa36", "comment": "Malware payload", "value": "5e80a76a758262a1eab6c9d0371e9921f30bc744de55cf01e4c16051be2e8a12", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880261, "uuid": "a9dcf627-1930-42be-baa8-7bfbcb1f27ae", "comment": "Malware payload", "value": "fa1d0fa1c92f0540fc4c4b15e16d361a984dc175", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880261, "uuid": "021abf39-0376-449b-ab9d-ea44d73ce4f6", "comment": "Malware payload", "value": "294c69c005637b8b0b2035a54a4acd368fe8367ab87724b5e152bf3edc4b339e2d5f628e00c7863861aea4d717ff8c5d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880261, "uuid": "6074ee8c-a2c5-41ea-978a-edfc3b3cb95a", "value": "T183058AB876D0E507138E0A5FBB056AEEDD6B685A60CC381B9358F94D14A933BF5B0D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880261, "uuid": "eb162918-878a-4239-ab05-80e09b552ab5", "value": "12288:1xbqaXR0S0axvwY3AX+7FwzmEvD3K5XaYThS2Nkl4ysj0WRfNVm+95GXx89QWM8C:TbqSQYThSW78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880261, "uuid": "10b5953f-a0d7-48c6-88e0-5e9303de27b5", "value": 805542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880261, "uuid": "b634cd1c-db3d-4709-81ea-4273a0db65ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880261, "uuid": "72873419-d620-4ff8-80d4-44e35648e6e8", "value": "blockchain.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8797e919-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776850928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850928, "uuid": "6c3b7f2a-ddba-465e-9398-b5ac5db58c67", "comment": "Malware payload (Mirai)", "value": "cc48c5305655349149183695a17430e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850928, "uuid": "4ef628c2-51e3-4c92-a744-8efb0a982d74", "comment": "Malware payload (Mirai)", "value": "5e9f35aca869a797a7f6c5964818fd0453720b1d0e064425012b19bc5df583f7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850928, "uuid": "482e1a6d-64b0-4f31-86de-a3600a319158", "comment": "Malware payload (Mirai)", "value": "97f816ec008ff6eb0b4724e481053a78f900b4f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850928, "uuid": "c447f782-0483-4c7e-9e37-8dfda03ff9b7", "comment": "Malware payload (Mirai)", "value": "a463010bda7ef885a36ca052e65f4b6b5bcf87822a9cfda9ae8c403e1d0de8e37816e3f2f9258e20d1a325edd757a77a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850928, "uuid": "b18f06a5-146f-4e75-a368-cf1633aabbc9", "value": "T123F090ED616037E604085F00F42E879899479FC820A0165C698C34FFA7B8D10FA21F0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850928, "uuid": "4087c3eb-cc6e-46cc-b4b6-4a8f1cd00d8b", "value": "6:kdihX9B8dihdL6B8dihrNIl5zMB8dih7Fa0LKi6B8dih3kICB8dih3HW0XB8dih8:/XjX9qXrNIl5zAX7c0LKjXzCX5XRiAUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776850928, "uuid": "0b5563c3-a5bf-4bd2-acb9-6789e868b821", "value": 510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776850928, "uuid": "41710f57-82a0-4360-8f13-19edf25684d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850928, "uuid": "b164db06-7012-4559-836d-3d229d2846cb", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73921c34-3e19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776841445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841445, "uuid": "57ada11d-fecd-4d96-839c-369f2665416a", "comment": "Malware payload", "value": "6e1b601891c8885af8f390241006a3f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841445, "uuid": "211b8aa8-fad3-4e8f-84d5-b1db44f8281a", "comment": "Malware payload", "value": "5efb639d495061d8a0081e61edadc5ca8c11bc085b63d89bf2c8608d6c4d3d95", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841445, "uuid": "2d23d477-795f-48b9-bef5-dc388eed339d", "comment": "Malware payload", "value": "7532182611169157d69470e9f19a18becaf7f783", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841445, "uuid": "5b45f0e6-544e-4aaf-89dd-e22472bce113", "comment": "Malware payload", "value": "7ed94280a6f5173a30dba9ff5da5d97d61a4c81db0d769fa1226cc6b7f21291c61b3613db77c22adcd15fc3378636a49", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841445, "uuid": "13f4a5d3-484d-437d-bc4b-b7636ce729a5", "value": "T16574C134AAEA001DF1B3EF54AEF46456D96FBF633B0E985C1091034E0632A45EDE563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841445, "uuid": "223cdb42-deb6-48a9-a0fa-e43b9a985c1e", "value": "6144:opSmmoXR3V3M93GumxIYzgpf6m11wHSITYq5UQkNW+J1sGjBqkW3bh:ktmoh3V3M9WuAIKgBxkxTYq0sGjIkWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776841445, "uuid": "8746a437-e6de-4a1c-a174-aaf2a02105e7", "value": 369060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776841445, "uuid": "1dd7d365-1243-40da-bc49-7306dcab2999", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841445, "uuid": "cb5ad7e3-3023-4af3-8aa6-f34adb0dcff3", "value": "SOA19282_Recipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1ef8c5-3e1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776843797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843797, "uuid": "0da4d61b-f710-4eb6-bd18-9ec7407647b3", "comment": "Malware payload", "value": "e4e98ae661997fd8c6596e8016b395ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843797, "uuid": "b981b6d7-6ba3-4529-8250-cb486e809b96", "comment": "Malware payload", "value": "5fbbf4df96c3da6fb2de553e1c65ac550d30e81adc6f18a58d6e1e2040f6560f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843797, "uuid": "ed36aad4-de9a-4be4-8e81-d3d98b6686b3", "comment": "Malware payload", "value": "3bc7e80c66a66c642e1e239123a40faf4c7c9db2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843797, "uuid": "4f49fef2-5886-4deb-8092-5ef9e301728a", "comment": "Malware payload", "value": "5ca50d450581da36f4ee3d90b47f5b6f118cfb6f9a746fb2a25be16301871e6272864af008515414d792302d24ffd233", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843797, "uuid": "f95c9ebf-f1ba-4607-9061-01742a871db8", "value": "T19EE45B7B91686589DC9B72B46BC73AB7FC11BD393320D5D65E03032C9DF06369A2821B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843797, "uuid": "71c0f5d3-f2af-4d39-b664-d5488b2bf634", "value": "6144:rU7HX6JxtMMy/Oj174Kfiu7n0EZGSpovD6N/JPCBs5YNGj9TXaoK5u+:rULutW/Oj174KfiuL0Ip5/JaBs5WGd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776843797, "uuid": "c91c616b-399c-451a-b1f9-6e389801b368", "value": 690528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776843797, "uuid": "d3f99c3a-62f1-401e-ab46-ca4a2cc0bc6c", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843797, "uuid": "c44acc27-1041-4491-8e51-461432524c51", "value": "Cayuhi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f794b3-3e52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776865770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865770, "uuid": "eac7f9f4-d15d-4073-a657-cc18960f31f3", "comment": "Malware payload", "value": "0fa9fbb93c20d61c522002813bb42de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865770, "uuid": "5da93845-22c7-42ae-b8b2-7c1ac795fc2b", "comment": "Malware payload", "value": "600fefce844a74aabe33a0367ba3fa166322ea9113466f8696f3a45bc80151ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865770, "uuid": "5baabbf6-fb72-4077-b584-1ccc63df15e0", "comment": "Malware payload", "value": "0f3a91cb1328ef5071dba539c2a2bbdb9473a725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865770, "uuid": "25ea7203-5123-4d99-9263-5b3b2974ef21", "comment": "Malware payload", "value": "76052b8addf046c43ee50e192df4141792d4a5cea3e9db8c9f8da85e3a4f74a5620f0bb823f7d33aa7c6de40d1f18e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865770, "uuid": "af3eb2ca-a04a-4292-a20d-c3297d7741fd", "value": "T1E7A733965F821495F48B913BC8A08F36A3D1B4B40FB05A8F37A90DA52DB71CADD39371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865770, "uuid": "e03b9553-b42e-4f6d-b680-210fd712890f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865770, "uuid": "6fe71b94-a648-4ee5-ba31-cde6c3fb3ef6", "value": "786432:5rv2G4TLcNOZli3FArhiJxnxgwKvuToWA/hvXYMc3m00PaUMgMdxogodv3/K1:OTIA7YjJxn+b0oZ/hvXvc3m00Pwg+3ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776865770, "uuid": "3cac2767-aa49-4d69-afe6-76127e9ca4c7", "value": 44941213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776865770, "uuid": "ac403ad0-442e-40f5-8be7-60072a8badac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865770, "uuid": "1a061779-e811-423f-84d5-889552a4c16b", "value": "Vyre bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a50b7e9-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894983, "uuid": "c5b64ca8-b399-4de2-a65f-de05ef8d45a3", "comment": "Malware payload", "value": "7325a20d338248cd549847db3d0ac9fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894983, "uuid": "04013927-e25a-4685-a773-b288e6ae8144", "comment": "Malware payload", "value": "60d86c93161d5baf2c3a6bca66922c7f91fbf670a7cf941b8d3314aa76d57dd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894983, "uuid": "e17d0a44-b3eb-4585-b60f-46b40335b83f", "comment": "Malware payload", "value": "3ca959f190a165de7301ab44a672ebe5779f8a09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894983, "uuid": "43fd6701-f602-4454-8f94-86eeace3b314", "comment": "Malware payload", "value": "62075ea5d5b2ef1eca8b709469901ad8c064d383479807bf0a8e631fde3fbbc7a8c364a043ddcb4dc90b30f037dfa5fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894983, "uuid": "5c376d2b-d631-4de4-ac2e-6ca675b4ef7e", "value": "T16B762A97B8824952C4E43A77BCBE80D433A31EB99B8652166D04FE3C7EBE5D90E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894983, "uuid": "119679a5-397c-4bce-9f21-b5b7affe846e", "value": "49152:FHVq4xnQZCnvFtkXQPwBV1MNHKH4ZlassG8I0EMNcSFIUTVy+q5ESl:FHVTMWvFtkXQPh7WcuxQEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894983, "uuid": "53dcac01-608d-4527-affc-b4797b95e6a3", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894983, "uuid": "94675990-e1b9-45a5-9c0a-1e915ff93a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894983, "uuid": "97d5ce70-41be-4fa4-96f4-05a3866b482e", "value": "h3flood.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450c9823-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895054, "uuid": "93455328-3507-47ca-9977-79c2cd6c3cd0", "comment": "Malware payload", "value": "cb054940d8488e95f87749dc0337cd19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895054, "uuid": "cd764277-a882-43b5-a550-db3ae131b5a9", "comment": "Malware payload", "value": "60f732bfb24b53cffb5427e6312467bd6a63c494760b1fec059b98236bb47a3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895054, "uuid": "12f14b7a-12e2-4271-ab2e-223bdd5d4fea", "comment": "Malware payload", "value": "a13fb3b0d5cd02b55cd111333b5e4bbc971447b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895054, "uuid": "def4153a-a860-4784-9bb0-a350f87ca80c", "comment": "Malware payload", "value": "d8b255c9b0a3405bd4a8d74fb3fc0f5a084bf0ef681bbad9ed96805183fa64a9e16296b3210e0dd5dbecf5af9d1d0316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895054, "uuid": "577e1ead-6866-4654-b0d5-739a00936d0d", "value": "T181762812FECB14F6E943193104ABA27F63316D058F24DBE3EA447F29F977A951932209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895054, "uuid": "e178ba9f-e580-4178-a1c5-e2efd173ab84", "value": "49152:JUj3NSvU0F/FUQoU3EqPymbWCtrFZfpn0C0UgqaJG/CE1xXswkAhtPpmfssG8I0r:GjNU3eCBpbTbnE4OGqE1jP5Z/EmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895054, "uuid": "b5b27f3e-0dd9-468e-bfff-d29d441453cf", "value": 7282872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895054, "uuid": "81e6495a-2d15-4828-a28a-cd7ecaed0e9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895054, "uuid": "94b43c88-495d-4ec8-8820-e83a7851ad0f", "value": "h3flood.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2072769-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776888875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888875, "uuid": "c2797249-9829-4e13-9923-03ced4f6c4c7", "comment": "Malware payload", "value": "a30418484257d640e670af047d8f7bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888875, "uuid": "721d209d-8658-44ef-9ba4-d05887ade2fd", "comment": "Malware payload", "value": "613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888875, "uuid": "a54bf02a-da67-4004-8a01-24b03e77a8f3", "comment": "Malware payload", "value": "86e9cc2ae1e4f9366cee2377a8f5e60e076d1df2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888875, "uuid": "d05c87d2-32e0-4d9c-94b1-4444984c6919", "comment": "Malware payload", "value": "97441b5952d065a57206fde0974e1c6a3fd39880c9ada9ebbcb38f75ea0927133cf361615d35110320517e8b3ff99b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888875, "uuid": "4db0811b-f2f7-450c-a1fa-5c63d02d77e5", "value": "T126B56C41789104BEC459B7324CF62681B735F8080B2A67D32E53AB783EB7BD05D7639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888875, "uuid": "2e1a868d-35d4-4313-99fb-eed38bb835d7", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888875, "uuid": "753260df-9ce7-4389-a9cd-3358a56b6fb3", "value": "49152:AbDPy8HmG8egkAoJwbwS8CvdOOZKJlBbVtlhs4:AF4sJvHs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888875, "uuid": "e57a729d-e3b8-4e17-a041-846325494bd5", "value": 2391560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888875, "uuid": "7e80bd26-5d52-4fc5-8284-34f104095d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888875, "uuid": "fc0b2978-8f5e-4df5-8a19-ee5d861cd260", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff27d16-3df9-11f1-a769-42010a9c0008", "comment": "Malware payload (WeedHack)", "timestamp": 1776827910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827910, "uuid": "3287f0a6-46d9-4545-bc31-425b67356a68", "comment": "Malware payload (WeedHack)", "value": "528bc6c4d1c1dbc732149ae5a459c67d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827910, "uuid": "52e3dcde-da7f-4d28-a83a-6d23eded6a69", "comment": "Malware payload (WeedHack)", "value": "617e4691db28e5936ca1134a296dbaae18a1ed0b2cea7f0cdd61e9a4830a5c91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827910, "uuid": "f8e78e3f-799f-4113-b53c-d71fd0acb4ba", "comment": "Malware payload (WeedHack)", "value": "280e841dd42c9f9d1fa82a727d47aca343319a92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827910, "uuid": "4f8b63a7-af23-485f-a6b1-9493be00f7a5", "comment": "Malware payload (WeedHack)", "value": "4bb1d1317bb33e9bf0e3ce6bc0d405594d510fc85c0da1d393d4cffafd0acfba488579c111507d869706a53ac8c82074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "WeedHack", "colour": "#3E0DF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827910, "uuid": "373ca2b8-b096-4d0b-a247-3b7c4eee1e27", "value": "T1AB65332229CCFB4EE60290F061885F05E33DDA56E64941AA84F7794B5F852F9036F7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827910, "uuid": "018c85ee-fc1b-4b5e-a5f2-3486ef93c6bb", "value": "24576:6ptNNfhxunW4Lnn+oVEP0lMFALihJjluwrc4diLgBxmxyqKQnhbSevH1Uq:MNNffuWin+o2PpthWwrcbLgbmsPu1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776827910, "uuid": "6d057794-40de-42b3-9fb5-2794408e8042", "value": 1441020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776827910, "uuid": "0cbd2afe-ce84-4d3c-96cd-b026199795c4", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827910, "uuid": "e2cdfbab-bc64-405d-918c-5d811bc94ef4", "value": "server.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592513a9-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895088, "uuid": "e8c91b1d-8851-4109-b405-f5bfd7d03745", "comment": "Malware payload", "value": "ca7fb0efdc421ac900a246e2534aa53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895088, "uuid": "dbe35870-8a2f-4b4d-8623-4ee3573873eb", "comment": "Malware payload", "value": "6189b23990be9c4f78f588bd5a660c6fa7f2e1abedc9d5fa47ac19356562a655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895088, "uuid": "e2102d3b-17d1-48bd-918b-6e3a2cc249c8", "comment": "Malware payload", "value": "8838465f0d12275ba0a60f18baab840da54ab06d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895088, "uuid": "759061fc-0ec4-43bb-ba00-3053b9391c0d", "comment": "Malware payload", "value": "61c1584f49032cf22bf97509b4adf1c02c485057cb874bdefa1f3ee3e31f7e6faee6c260fc559edb8c151e6caa773483", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895088, "uuid": "d645ddf7-a2f3-4c10-ab05-fb2327856b2e", "value": "T1318617177B19EB1ECB1821300CB2CA94276A2C9942D69517B781F319F9F30BC996EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895088, "uuid": "cefc1624-2fc6-4e81-a668-9c690332dd53", "value": "49152:+FkhZYJyS+5Uvxhp5a8AA1LjsPj7er3jprJHK9qRTj6Xf/OassG8I0eT8ueQS8Jd:T8LVdRT26T8kKBLNXi2HbRvjEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895088, "uuid": "b4188d58-aad2-412e-a05a-917c29a8dae4", "value": 8323287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895088, "uuid": "f1ed63aa-f336-48b9-92fd-cb15a08e6bc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895088, "uuid": "83549b55-9292-4f8e-a37c-8da33ec24510", "value": "h3flood.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f501643-3e57-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776867906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867906, "uuid": "d7c80aa9-e9f4-4bfb-98a5-0afbdc8af881", "comment": "Malware payload", "value": "f5836b923aa05cfcc30e7c8a078ff2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867906, "uuid": "6aa50b07-f26c-44ab-96b3-4b3fada84a5d", "comment": "Malware payload", "value": "6326aadda1ea3106cd9b0cf0ef428f9dd55f4be45c6a3416521d5504a248af27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867906, "uuid": "1ad98fd6-5637-4c66-9a5c-d23e5349e05e", "comment": "Malware payload", "value": "83591a5aaeb999f01aaba8fa5479d4679a4d6218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867906, "uuid": "a0e2a613-faa2-4388-a8a8-4c67285d5436", "comment": "Malware payload", "value": "e193dba0d70a1749dbd67fc4910469b7481f258bd387f976cb54b4ca0013b673607c5954b45b734474986aa75e019922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867906, "uuid": "ca74345d-703d-4358-83d4-43c0b0303376", "value": "T101F78C4ABB458D8AF462927465935F50B336E9750AB1C32333BC2B285FEF39C8DE1584", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867906, "uuid": "2e195fa9-33ec-43d1-aead-9e1236975b60", "value": "33100aedc979741e5464b8a91cb38f35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867906, "uuid": "b609a35b-6dea-42b3-933c-9affaff154ea", "value": "786432:Y+6yajmS0huYvglTaQvXZ0uaMROe63unQXeNL+VerXl+9YKX2VGCr4:PNSV/yuaMRP63unQOiYujg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776867906, "uuid": "d4e76fd6-a542-40b3-b68b-970b85e8a063", "value": 77041416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776867906, "uuid": "54b54352-5a59-4f92-81de-24d3f092babf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867906, "uuid": "557b7ca5-d5d4-45dd-8a2a-fa9a9e3c5400", "value": "inst.880233900b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb4744c-3e28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776848094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848094, "uuid": "cce56824-1dbd-4266-b376-f0b69286f899", "comment": "Malware payload", "value": "0f0b5d81ce14acdaf594b3ff64f596cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848094, "uuid": "0386244d-d957-446e-8b7a-f3dd29233592", "comment": "Malware payload", "value": "6388fba119c828a2fb8d7c58038b8f703d1e80b39615a8f1e7cfe0013eca9102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848094, "uuid": "c1c4e388-9766-44d5-9a73-655f504c51a6", "comment": "Malware payload", "value": "790077f00c7fc95c946ae59cf1f4ba64cdda8210", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848094, "uuid": "f85950c3-a7c3-4a82-849a-d18bebb12e53", "comment": "Malware payload", "value": "efc5372b2181b36c739a91f0792686827c48f82faba521dbbdf35065ff64e45349ef24e83d41cce5c83d31caaa4efa48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848094, "uuid": "ce4845fa-c413-49c3-8ec2-f21ccbd14ad0", "value": "T1A9F2F13BA04987B8D19F9B700A9983F273C29FD4665D81F093887AE5F391F9366404CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848094, "uuid": "0e6fb7b1-b0b5-4b2c-9bf9-95277991b5cd", "value": "768:6MsnNx3Jsohdn7L2EvK6y+elqTbMcgfXWCHbtsKScJL4uVcqgw02NWXh:6MsNHvxyObhgOCpnF4u+qgw06WXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848094, "uuid": "808b18e4-598a-4b7b-a07d-7173a0dd2a3f", "value": 36828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848094, "uuid": "af162f22-4ac0-42e3-ac67-cf40743af76c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848094, "uuid": "abd74aba-50aa-4c0a-8246-a24f69d655b4", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020f772a-3e74-11f1-a769-42010a9c0008", "comment": "Malware payload (XFilesStealer)", "timestamp": 1776880339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880339, "uuid": "eeb9b7b4-0190-4c0d-aa17-dafb68c2855e", "comment": "Malware payload (XFilesStealer)", "value": "22e4ece70980c4f1eb4f236e30e4a71b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880339, "uuid": "76da40cb-f423-40cf-bfec-924269c80d56", "comment": "Malware payload (XFilesStealer)", "value": "645a688913af27ac2b61ed72cb69ee2541d541035fffe60150c8ecb103dc7440", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880339, "uuid": "0dc4f275-f613-4550-b0ec-6b3e5e3eb724", "comment": "Malware payload (XFilesStealer)", "value": "96e0fbdcbc868c90e9b376d17fd3487daebcac12", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880339, "uuid": "54169069-5915-42aa-b0c8-5e7dc20c73f3", "comment": "Malware payload (XFilesStealer)", "value": "d5b9435c4fa22b20cef7521e5f08a800a3111e894112474e5ad953519a177d079aa8ecfdbf0d75702d5fb42d8df02244", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880339, "uuid": "8278e4e5-7530-424d-865a-0b5e948c1300", "value": "T19717339BCE427F76F263DA3F47E1172D55A12D535443C09BA3223A7C0A36B816BF9089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880339, "uuid": "ee69a213-6f4b-425e-a535-c598f96cddd7", "value": "393216:KyMlmCjkFXIR3RM92hJqaiWF0kbaAHbEcN1tH0f6pvm8pG38:BCj8XUW27YWFlbaAHbhLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880339, "uuid": "e384917c-5e44-4fef-90d0-0154717620d5", "value": 18878464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880339, "uuid": "6effd6ad-9fd9-4fbb-b92d-2c8f8b7ba0a4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880339, "uuid": "b6e24e56-f240-490b-a029-210670ac468c", "value": "cliente.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141c658d-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876933, "uuid": "9705e0a7-77e5-4aee-9cff-a23602db9897", "comment": "Malware payload (Mirai)", "value": "4ee07fa214b617415807ef3d9692035c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876933, "uuid": "ba8a4761-f778-49c9-af85-d8f2a82e5320", "comment": "Malware payload (Mirai)", "value": "65711d0c5f33f7f37cdf548ef5dd05abcdb688241708b4959e4e142e9349f82a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876933, "uuid": "5c2812c7-ec56-4d5c-bba1-82a77726dee8", "comment": "Malware payload (Mirai)", "value": "fc2fc73e52fdbf1c540ba64efb2202da5efbc33b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876933, "uuid": "24e439bc-6af1-4822-877b-befa51f64c7d", "comment": "Malware payload (Mirai)", "value": "ca270cfcc40aa53b1e48670dcca0e21fab1c3d58d1c430a34c39bfe0a6a963acdb42266c6fc4efdaa21d746d662dbe46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876933, "uuid": "6ced82bb-1d06-4b82-a7ba-36b9f25f6fc7", "value": "T172430271E08365B723611260E0685FA276931BBBF4FC65332BA665C873C401A77F854B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876933, "uuid": "1a263944-3e43-4922-b14a-f82cb97c1c7c", "value": "1536:TbvFHd2MJcYZElS+JZepg6Luy6tlV1nLL:/9d2ScYmlS+JZep/Ld6tlHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876933, "uuid": "e1adbda0-6f13-4d44-8e5d-f73f3745e378", "value": 60152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876933, "uuid": "acdc33f6-3c6e-461e-a469-cd2382190ab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876933, "uuid": "1001a36c-f1aa-4e4d-b798-9636f287b226", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6cfc4f-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776850963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850963, "uuid": "1316d28e-a4c8-47c4-b013-761dbf8da5d5", "comment": "Malware payload (Mirai)", "value": "ef151e4a5b484ef71377da72315f7c0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850963, "uuid": "17507b3a-67cb-4d69-8221-9b1c4f1d8978", "comment": "Malware payload (Mirai)", "value": "666b711826306621053a5b6bc58edb46adf79a178315d5fd492b076699274549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850963, "uuid": "1b3e3b5c-b77a-4736-beb9-ac098c2e3777", "comment": "Malware payload (Mirai)", "value": "98e61dfb19018510e86b1f0a1220f160036f039d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850963, "uuid": "67453bbf-26a4-44e1-930d-95acc709ae02", "comment": "Malware payload (Mirai)", "value": "ccbb2a371dadd243202dcbd3b317f9b359cd4a489c8f62fd2763bb0c44abdfc5424661ac469373ea74c104b1d648e8ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850963, "uuid": "cd06c143-1a87-4d2e-b535-eae03dd6c0c9", "value": "T161C3AED7F68B24A1CC6246F007C76B8E2E6362119E6BE9E72C1E753B19391DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850963, "uuid": "67ec90ac-d535-47ce-9335-9bd6f6269ca7", "value": "1536:fu189r2mIHgqH8IV3NB4BuLaLWqxIijGsueEoutC8xZJqKg9T/LWQ:21ur2nj73qBuLetRGsZutCpKg9Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776850963, "uuid": "d4b2c45e-a38b-4e00-8dc1-74d4737abe80", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776850963, "uuid": "0b1f676b-7ed5-479c-a8c7-adcba59a7aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850963, "uuid": "d07a483f-8353-4e9c-8db6-25edbe3195fd", "value": "luxzz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e478705c-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776880290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880290, "uuid": "1deec673-cd73-4388-8124-4d575f772bb4", "comment": "Malware payload (ConnectWise)", "value": "13931e8f741f06b43d1438ee6383582c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880290, "uuid": "2c47a35a-63ea-482a-bcb6-e56f81968f1e", "comment": "Malware payload (ConnectWise)", "value": "66ca66cae93c34e60a9a328b082fc7aa5396cc046bcfc5a14681d072128b9be7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880290, "uuid": "5b9ac5e2-88c2-45e8-861a-bbe525a2f590", "comment": "Malware payload (ConnectWise)", "value": "ad9197195b81e27229685ce637ba23115c1292c6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880290, "uuid": "cd2673a6-5d5a-49d7-9fec-95f9344f80d3", "comment": "Malware payload (ConnectWise)", "value": "6335125cec07eff743ccf3394a9b3370316240a71db848a5647a411a4e6843f0affb407816a32fcaea55083840f1ea9d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880290, "uuid": "ee3b6f17-f7b7-4873-9695-786133ee98a5", "value": "T129D61211B3E595F6D0BF1678E87992655632FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880290, "uuid": "8856fd6b-4cee-40b1-9d75-fbf7b957ac44", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880290, "uuid": "ea7bfc9d-dc4d-4f0a-a245-7ccef861cd2a", "value": "393216:xCXvI5MvHxaJeCXvI5MvHx6CXvI5MvHx3CXvI5MvHxI:xZ6Hx5Z6Hx6Z6Hx3Z6HxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880290, "uuid": "6b6adac3-58ad-48e6-b046-60a3e2e8464b", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880290, "uuid": "604b1ff1-f781-4b0b-b6b7-290e0da90342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880290, "uuid": "0ca5bc82-22f0-4f83-abee-96485daded87", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f60b1e4-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820903, "uuid": "0e646b92-fa98-49bc-a0da-176a6d82694e", "comment": "Malware payload (AgentTesla)", "value": "ef0b9775ae48a59627b2e75a0fae8eb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820903, "uuid": "0f8f5b96-6dd9-4d0d-bca0-9e70db6d4703", "comment": "Malware payload (AgentTesla)", "value": "670386391b42fbc7f0bab031ea26d94cab792dcae9c9d832e4d764639abe802a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820903, "uuid": "ade71bc7-3bae-4bdb-ad96-c885009cc158", "comment": "Malware payload (AgentTesla)", "value": "f2e963e3eb478814d5e8a8d761864ec41cc582ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820903, "uuid": "b3eeaed7-021d-476a-83b5-80c63ad7da19", "comment": "Malware payload (AgentTesla)", "value": "648d05925f86b8331f09b1a9a7497599f643323713f882f8dfbb535ab1a819078f719c600193f223d8ad9ea2507eeac1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820903, "uuid": "06c3df61-a7b9-4c08-8d2f-c925698c41fa", "value": "T179254CC328C23258BF98179DB060E6D2B28E7F8E2B9578A5180DBFD93554946FD9D0C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820903, "uuid": "3bf868da-d6ab-472c-8a28-32dceaacd7a4", "value": "12288:jmouNJl1V2Pydzk4eWsaMmTLcEiXLFshOyaSzMSBzqxK8Rv8VQhU8IW0McczCeon:yDV2PydpoXdTzEunlEwhdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820903, "uuid": "1a8025e3-e4b1-4f7a-9153-f606d6fdd646", "value": 1050538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820903, "uuid": "830e6f25-9684-4161-abaa-42a7e2577163", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820903, "uuid": "df201a55-acb1-43ad-a7fc-07b5d056e49c", "value": "123.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1953e162-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876942, "uuid": "81f2c76a-bc99-469e-8ce0-5d48d0523b3c", "comment": "Malware payload (Mirai)", "value": "a87d0f595da6808522824225e467195b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876942, "uuid": "9b014573-2ae9-47b2-8d52-18fdec4229fd", "comment": "Malware payload (Mirai)", "value": "67c36159e48047130fc02b43def4d64c03475ac5f8570a950b5e10721ae777f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876942, "uuid": "25233cab-fd52-4dcd-bd3f-022df67cce06", "comment": "Malware payload (Mirai)", "value": "c0b544e1e5872a4df365c5b9da3d6fc2dd197c9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876942, "uuid": "4f7f4fc2-ff90-4ee3-a50f-4915df771242", "comment": "Malware payload (Mirai)", "value": "55dec750be6508a23582f568cfb1123fc9441522cd7d9391b8bc34f8592c8904b9c0ae6b1e59fc2232bfbf035d969d42", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876942, "uuid": "c64f24bb-aaa0-48e8-aabd-bf68812ed034", "value": "T15EF202BC0B91488DC528DE389BA95131FD481F642422DCCB782DEEE1AD979ED22532D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876942, "uuid": "9cda9a0e-a797-4cf8-a81b-a12a03935bbe", "value": "768:2NYKyukZoTMKe6dgCTu0EFqEcIQkdYq6DOqvnTJLwJgGlzDpbuR1JE:UYdWle6dH60EFqNsvSvnTJ8VJu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876942, "uuid": "285d65f6-6f19-45fd-b387-5330d4f9cdb3", "value": 37068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876942, "uuid": "cfc95e60-a719-41a0-9e78-f67ae6c0ebdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876942, "uuid": "f13908cf-fb33-4ad4-9388-70ae35e28370", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15fd9b4-3e9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897491, "uuid": "16e3dd81-16de-400c-92c8-63dbbd482f06", "comment": "Malware payload", "value": "dd4df48ff982be57e8084ae2cebbf142", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897491, "uuid": "849edfd2-dcfa-4694-ad80-ca5afb3667bc", "comment": "Malware payload", "value": "67c4a0c66f9e2a873d46c480f0e1d1bc39417d6aa1683543fc834631c9ba63d3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897491, "uuid": "bd025f4d-3e7b-4d5c-8a85-e4dbdafba787", "comment": "Malware payload", "value": "c8f1e3ca8fb6845ca3447ee4215d965e48fa220f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897491, "uuid": "277f4149-db1c-473e-bea1-256ce1f54e62", "comment": "Malware payload", "value": "666e0512155a8d987a5e23022d8d31b59930b70c02bb7629855e9d14b75b3ab95bc022b63eb2c33718494cdc92dcfc77", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897491, "uuid": "e696fac4-23d4-4e22-accf-7c3c3c999f63", "value": "T15955337DF7049005FF02EE571E7B7A06A98DB5B58134A7B4B52243BBB870F26413E851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897491, "uuid": "0ece82eb-56cf-4316-b612-a00de1dc6885", "value": "24576:5eCFGdBn2cWGFq5+MYkjxcOGrGfqPbiOlRD9E1lMHRCAMElLEHAI9414ldgcTvPC:5d4B2cl0YfiqPmOVEI5d8dgqPTS8+Ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897491, "uuid": "8957e21f-13bd-498c-8952-bff72faa3a1a", "value": 1295892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897491, "uuid": "4de5a3d9-9fa8-455a-b1f5-d08f00f4523d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897491, "uuid": "b421b4a9-c374-420e-a918-f5d1ec1b65c5", "value": "Astroclient-V2.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d08cf61-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888706, "uuid": "17f897b1-a5d9-437a-bf29-27e70f3b1c10", "comment": "Malware payload (Gafgyt)", "value": "fe33042baabb5ad14387809589728256", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888706, "uuid": "2bcf95d4-d8aa-4ac6-b1a6-ce4acfe5b78c", "comment": "Malware payload (Gafgyt)", "value": "680fd296ead1f8a850165a04bbd52ca76fefbc83d38833028207a909080f788c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888706, "uuid": "2cbfe89e-5542-424d-8680-4254bbdacf88", "comment": "Malware payload (Gafgyt)", "value": "5e550169ce412624f80b65c97f80a8737d799935", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888706, "uuid": "00967e25-12a7-4e24-bece-0bd90e275a79", "comment": "Malware payload (Gafgyt)", "value": "77dc44139088cbb89669e33344766341bf468902c3fe07daf438f1169779bbd16971666887a75a1caae0296ba9858fc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888706, "uuid": "f6ff49b9-c5a4-454a-88cb-4d913997d1b7", "value": "T18DA30897F900EFB7F40AE67604D34B24B670BBE54F531622721739A6AE722D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888706, "uuid": "b88d5637-9635-4216-8a91-642a9f971d22", "value": "3072:HNKLGdUvuXwyKQlU8fzWRmumuxVqDr78fz1e:HNKLGdUfyKl8aRmumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888706, "uuid": "ee7c451d-d175-4330-9800-ef00cbe12465", "value": 98923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888706, "uuid": "16c95f55-7122-46e8-82cf-d4f01abc4db9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888706, "uuid": "f1c480c1-7f3a-442c-a642-8cb716ab90eb", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bbaee4-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897634, "uuid": "09e1641c-34aa-4dd6-97ae-dacdf01e6c87", "comment": "Malware payload", "value": "e9a39a79238de43c54c38bce26c8355d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897634, "uuid": "edb8bf3b-f9f1-4969-a1b0-5981cbdb451d", "comment": "Malware payload", "value": "686c5194070dc5d4b971b73347f7348b4433f749b32b1c06cf47ebb692027403", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897634, "uuid": "29e4a345-9848-46e5-9f21-e6a080235668", "comment": "Malware payload", "value": "8bd1fd59f5cf6199c69e412a57dab67f92016bb3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897634, "uuid": "7adf04ec-66b0-4ee1-88b7-02629684d1d3", "comment": "Malware payload", "value": "e20bd5d82d57a06c9f265f54b81fd990f5ae1fcc659d00825d46ae51be5c08b2631cc8e794f8c95eedc9a890a14f4d3d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897634, "uuid": "c576e70d-315c-48c0-87ed-8ed62cc18230", "value": "T1D1760127BDD6E839E96740B391C18166642A12DDEA0FD0FF06A10DC95E71C8AC352FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897634, "uuid": "8e079b64-fa55-4cee-810d-9cecd2f6e83e", "value": "196608:yk6AdVP8vhGiz6/vfTxZ4EUshzntMWlwPYRykeahK3IJCuq8B:/6G2JGtfTxZ4EJhzntlegRykh4Izq8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897634, "uuid": "1745fd24-623f-412b-be34-f059733e8035", "value": 7673819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897634, "uuid": "7c415653-cce4-4ebc-a38c-dc6e081615ad", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897634, "uuid": "2d6a7016-7c38-4b25-a5d9-ebeb5f7bd12e", "value": "Module.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3976c2-3e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854560, "uuid": "394ea8ba-d843-40e0-91a5-b5f4e912478d", "comment": "Malware payload", "value": "eb1258dbe532c6ed691fd178df692482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854560, "uuid": "c7dd6b8b-c9db-47e3-98f2-05feedf5ac9c", "comment": "Malware payload", "value": "69b198e4c33868550e34da5af74162a938166b47c1f25d5a3033aac57a8a42bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854560, "uuid": "9918d82e-90a9-4c39-a7b7-d0ffe62660b8", "comment": "Malware payload", "value": "b03a2e75e2272f291504db0f5dc4b1a24222a2e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854560, "uuid": "b0d53075-9982-4b5e-9c26-4acd1bb3a85e", "comment": "Malware payload", "value": "dc7a4bc8997b42276af47281931c02b0417e2a592c76ba28deefda1e297aa185251154961c42a85f7e4fdb2c2d67ff60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854560, "uuid": "116a3249-9162-4c5d-93e7-7403c9230869", "value": "T18E756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854560, "uuid": "ec06da6b-79ce-402f-b455-297a56f42a7f", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854560, "uuid": "ef441c97-4eb7-4871-a6ba-1edb04d58a63", "value": "24576:uds9Esxlce6k91UOld2LMxmeDozCMZyFFkwEymOCUwPPR0P:udaEglcAHNaYczYkyL2PPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854560, "uuid": "f226bfa0-ace8-4219-9d68-2215f5c642ef", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854560, "uuid": "27eb2d43-19c8-4fbe-ba3b-4de6d6e6c29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854560, "uuid": "568e859c-83d7-4c9c-99eb-85d0bde9e4a8", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd71ce4-3e58-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776868575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868575, "uuid": "94ae3afe-338f-4c18-b0f0-0c1fbc2c13bf", "comment": "Malware payload (ValleyRAT)", "value": "73d0fe59ff15619d8486b01f992b85ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868575, "uuid": "bcc0aa7e-c62f-45a6-a685-01ce2616b39a", "comment": "Malware payload (ValleyRAT)", "value": "69f215a8744582fdd7f1643be8fd8587cd6edb18834de592afffc6344a76f9b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868575, "uuid": "0a1779ed-5733-47bf-872f-5170f87d4e89", "comment": "Malware payload (ValleyRAT)", "value": "3607b4bd59c1fbe05d712ec0f9b3547bc289ccf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868575, "uuid": "4115ac45-c076-4051-857d-39dd00cbe8c4", "comment": "Malware payload (ValleyRAT)", "value": "408e98103fd5c4b3d0a8c9cde04baebbcdd496f39e3439697912552aad3d04affcb39ef567aa4b7fbfd20c702256962d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868575, "uuid": "42afa01a-d9af-4dd7-aa54-9a336d0910c6", "value": "T130E36C11B9D1D033D56A5C305964DB719E3EFCB04FA1ADDB63881EF64A302C0AB39A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868575, "uuid": "7fbcf168-0c60-4fa2-be23-d60b4c83ef8e", "value": "800d64be663e3809c86e0faef4e45241", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868575, "uuid": "68aa5d68-ce6f-4284-9799-6b07548eb205", "value": "3072:dbp/tR1zrKGULmA/OaW2q/5+GpqoD3yc9eLnJOXOgQ/N1:ddtHze0A/OaZq/zFLDNg//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776868575, "uuid": "d21003a6-8b52-4287-801b-a9f299fcbfd2", "value": 155024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776868575, "uuid": "07811100-7a59-422a-a7be-bb643a29e407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868575, "uuid": "ef3d170b-8ab8-40d5-b25a-c6eb41550150", "value": "69f215a8744582fdd7f1643be8fd8587cd6edb18834de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1777817-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776877305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877305, "uuid": "da562f74-c821-4ad4-994d-dc3b11deba9b", "comment": "Malware payload", "value": "b434f99e8f663503af6467f697e0f9b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877305, "uuid": "6f9140f9-0ef8-42d2-abaf-e373e060148f", "comment": "Malware payload", "value": "6a500283df92975678a1928a9ac2db5935fee14e82a137343dc430ebe79d11e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877305, "uuid": "586db9a8-3584-4530-9673-8cc336187db9", "comment": "Malware payload", "value": "760cdb49f11b264c44768442f2df7606292dc8f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877305, "uuid": "40490087-3a56-4d00-918b-4fb1d145f891", "comment": "Malware payload", "value": "2013879be597698d3126cef54a0ad94073f14ff6eab30060e52f211463d2e836c21d4e537ffc586ebbd35517eb73927d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877305, "uuid": "b0fdef34-5b70-4d3b-88f1-75a988fcbd52", "value": "T155A66A41FE8750F6EA03293241ABB26F63315D068F36DBD7EB503B29E8B76D14836245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877305, "uuid": "2f3cc43b-52a2-4725-a6f9-fa30cbf99dc0", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877305, "uuid": "a822be19-3072-4555-bac2-c220105ea697", "value": "98304:RP6XGXGGFDWt7nIJ3/14trMxq1fEHOzgD0cLzrSpmbiBVlGJJwVdWpWtmuVa0CQ:37FYEJ3/1k47HXXuqP46W7a0CQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877305, "uuid": "9f1f678d-e395-4270-9091-8f0975b37693", "value": 10381312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877305, "uuid": "ea5ddb3e-8491-4750-bc1e-ec13b20fbe1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877305, "uuid": "06832e5f-3240-4310-a4bd-41b84bce0705", "value": "bot_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593f9630-3e5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776870178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870178, "uuid": "83c2a289-ce54-48d7-a31d-8f5411272fa3", "comment": "Malware payload", "value": "1e4869987b827a2315509cda4de18c18", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870178, "uuid": "242a8750-8107-4ad5-ad92-24497ada1aef", "comment": "Malware payload", "value": "6a776cbab04c2edaa2845e8707c8320bf53fb3d5ada49bc851c36997771fffff", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870178, "uuid": "f7ecd8cd-0562-46e4-925d-0e5418014d6b", "comment": "Malware payload", "value": "33b32995243c9c80406e4f0f501a30e2ceb7b1fb", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870178, "uuid": "19f1c864-6a93-4a2b-96d7-b479c3a3d946", "comment": "Malware payload", "value": "a06285aaf43e993638a24034b8e82bc104e5c5e121a0a620d3306d99f8ae0e3c42c0040c7bd4f225d298c8cd3ca61223", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870178, "uuid": "d4302390-0c22-493e-bd52-1442fb286b38", "value": "T180853341B1ABDA579327960D0AF2A6330AB4BD19B6BCD3EF1092D854A3050F9D3CFD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870178, "uuid": "bf306949-82f0-48ff-ac9b-4837f0ac4cec", "value": "49152:E5x/231wB1XbT5yMS7xhd7BmH1coipwkPA:u5i1aLT4MYb78Vya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776870178, "uuid": "c5a5f059-ffec-41c2-a2fa-d1039e5b1ccb", "value": 1786641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776870178, "uuid": "fb4a6f9b-be51-4556-8aec-8f1ff2006fc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870178, "uuid": "bea901fe-0261-4735-99ed-ffdfc2e61aec", "value": "522a8153d86cc0b1e2c9b5dd4a9c6edbfd8c597c4ebe709bca854f9cbe385b41.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233ffc1f-3e54-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776866651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866651, "uuid": "0a71857f-74cd-4785-8782-cacf88388409", "comment": "Malware payload", "value": "3e02a9db64f30f77e1ee42f61ff5d7d6", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866651, "uuid": "aa12c41e-8d78-4ed2-9a67-a64d524e24e7", "comment": "Malware payload", "value": "6b829c2e656f812918bfb36f873a9c0c207832bf4c9aa72d866ddd4b9c9b93f7", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866651, "uuid": "44bbb04a-1541-43d0-b691-46cacc5dd978", "comment": "Malware payload", "value": "d4bec7d45c81d29c59792758db4d9e1f717adb8e", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866651, "uuid": "7c0f1afe-4ced-43f9-a57f-1e7b2524c136", "comment": "Malware payload", "value": "36f17ba41ac8230cdc6776df1a658457b1417c1080c85cfdf9ab58f330c8a9358a153e1e21eca8a795ac618083f6ae20", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866651, "uuid": "2582d2f5-9199-4836-8b7d-5b4ae140258a", "value": "T17A5533C986D4DBA77EC219A5D4FB4595AEF30B070C32B472F4AC8B090260359E56E8FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866651, "uuid": "73cc43ca-b14b-4d5c-98ba-975b2dedc64b", "value": "24576:q9CthvMsiKdnjl5mrJEd3KzCwUGSyObaaB1r2GQcuv8MqgWHLqfluNOQwzxzbY:qSvME6rJEyNSyO5tKqhrkkOz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776866651, "uuid": "d518ff23-b15e-4681-8d7d-6d4ca39a6ad4", "value": 1299727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776866651, "uuid": "61539da9-2a4d-497e-b09d-c9a4340b42a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866651, "uuid": "ff3c41d0-3623-47b3-a20f-3ffe98c3a384", "value": "buffer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fdefc8-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895029, "uuid": "6bdea58b-6656-4f1b-9ad6-92876d077abb", "comment": "Malware payload", "value": "9277e7570111bc3ce1bac5fd3caf8a86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895029, "uuid": "9e2e22ef-2db9-40d2-a9ee-d92982b239c4", "comment": "Malware payload", "value": "6c9c5d0cffa91005e5f2c5024ecff9477c1530dca221808e842bfc5e8582df27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895029, "uuid": "15250f91-b9d2-4c8b-b235-a278fdf1c94b", "comment": "Malware payload", "value": "2e6c0d4f3ae5964cfc79c4407a96b61009b3a19c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895029, "uuid": "62fa3e97-2dc5-42dc-b311-263b502e17a5", "comment": "Malware payload", "value": "58752249f5de5981d84343a2281ab708bfadefad9c2e52430ad97739b4b36c9c77db29d9f605a7c0eb0f81882ab4e64f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895029, "uuid": "57862b93-9d81-47dc-a3b7-6c0d38a3b62a", "value": "T1F2562800FECB14F6E9031D3109ABA22F63316D058F24DBE7EA547F29FA776A11932159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895029, "uuid": "dd7e6183-f146-46db-8a56-ffcb126ca06a", "value": "49152:I+hD46bmUm0t6or4ZtAQF039TywfuNyMlGa4LXg6gW4bEGjR/tF6zM5Eq:xl4YmQLruF44dga4LxCXzEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895029, "uuid": "efbc2afc-e902-4fdc-89c3-ff82c6129f9e", "value": 5927096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895029, "uuid": "08bc8850-c41b-4b4e-b806-be105abea017", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895029, "uuid": "4dd7ec0e-a7f6-462d-b803-920075301988", "value": "h2rapidreset.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3dcbf6-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874046, "uuid": "27cb0af6-8606-415d-a3c4-d911c0c3383e", "comment": "Malware payload (Mirai)", "value": "7e6b06f8ba802a24876a64bd203a33f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874046, "uuid": "3edac77c-ef4f-451b-b0c0-4128677dd74a", "comment": "Malware payload (Mirai)", "value": "6ca85008b331be70d3da51ea4e2af8ea497b644bc577fab2ade1fbbb3b869dbb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874046, "uuid": "f7748b97-a2c7-4770-a00f-eb1e31c0a41d", "comment": "Malware payload (Mirai)", "value": "2fed6fe0471eac3980ea5d420c8de097dc49b938", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874046, "uuid": "41670e09-c9a2-4eb2-874d-78a449fdaeab", "comment": "Malware payload (Mirai)", "value": "3042b2989d975e617b52c629162b4807770e7df460c8c3f965563c3e12e0b33a773cbf67e2d7e117204650b9cd88ba58", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874046, "uuid": "a3634ff0-1f1b-41a4-82d0-83f9761156f4", "value": "T150C56B55FC509A56C6E096BAFB5D828C33232BB8C3DF70179D0487743BDA9AA0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874046, "uuid": "c083d177-4c5f-4e2d-9484-205607c5b058", "value": "49152:19MgfUu8HXRK3bOB0X9DGI8wIZXLTlyZWvPla:19ZUuqRUyB0cXwIWZWla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874046, "uuid": "7bdf08d8-34b3-41c9-913f-b8207ec27bf5", "value": 2498452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874046, "uuid": "29621bd2-144c-4457-820e-b5d396cf3a5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874046, "uuid": "ee37126a-ffdd-4cef-8d1b-167fe4cc8b3e", "value": "ciubuc_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d913636-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848361, "uuid": "a7bd6d02-f387-419e-a496-09f6df9a4f83", "comment": "Malware payload (Mirai)", "value": "8a9fa9f2149898c57cd10448ee13c236", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848361, "uuid": "d0e4b97c-adf1-4dbf-a2dd-210b567f5fb4", "comment": "Malware payload (Mirai)", "value": "6d77ca7d7cf62c759890a816a831d1a5abe6c1e0efd2f57f0fb498278ff808ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848361, "uuid": "4025ffae-2e6b-472c-a4ae-f7e67f0e85bd", "comment": "Malware payload (Mirai)", "value": "90906cdf020200baf5b29972061ffeabc5ec44e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848361, "uuid": "d87a4206-5c63-4040-b512-75bc3c75ba3f", "comment": "Malware payload (Mirai)", "value": "587aadd4eb5ccb4e501010684bd239b925dc880a390ac61fbefe986467fd5ef83eb97e40387218ad656a1500fede02ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848361, "uuid": "9b25c592-613e-4c9c-b54c-816bc9f5f67f", "value": "T19303F11225CC425BDC4DB23D035D1ADFA9B02E621E97FF5AB9880DB98A352A096F4F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848361, "uuid": "c1a1c3fb-4c37-4507-a43e-a745426a3b40", "value": "768:x2kfZ/bHf9x73X4LRk5OxAes9N0tG+QSMhj3az+363yooJKyZk+j1If3IXhj:xnZbHXY2oxAt2qhhLKkZrcIfss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848361, "uuid": "d091b11c-81be-4d67-9584-ab6c22db55df", "value": 40444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848361, "uuid": "71627162-dad8-4978-befa-a666efc5e3cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848361, "uuid": "56d1ec0d-4eaa-4628-ae1d-bc23ef78cbaf", "value": "luxzz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a7ab60-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875000, "uuid": "60899339-7542-46d5-b9b8-126e9705845f", "comment": "Malware payload (Mirai)", "value": "90d758a392a304984983d17396f1a06a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875000, "uuid": "70e715b2-4dd0-41de-9128-75a8afea03bc", "comment": "Malware payload (Mirai)", "value": "6ed3d010b652e550ac99d4b147503795133ca0f610046ae95f8b3750bec3b2f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875000, "uuid": "9c8ce8d7-3ac9-4d39-bc57-aa0d53d50836", "comment": "Malware payload (Mirai)", "value": "b8c9088dab72a866978e3cdd60f5d75da79eda15", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875000, "uuid": "3529fc03-3ca1-4e6e-b10a-2856dc2e3e38", "comment": "Malware payload (Mirai)", "value": "ec943904a8cb827c92d9714fddbc1e80ae3dc87c42a93aedbd3907cc867a4dd22ba90435be7e1c1d8869dbdc98f1a0a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875000, "uuid": "2381f1d7-738e-44a6-92cf-0194809310ae", "value": "T13DC32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875000, "uuid": "74b69c81-ed8c-4186-beed-dd726207cd15", "value": "1536:68B72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dLJ:6eB4exMF7oZKJnCNYaVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875000, "uuid": "b9fff785-d7a6-4b43-8ea4-ba88563d9452", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875000, "uuid": "751bb75d-54b8-4d07-9fff-950b62c1baec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875000, "uuid": "8bf7bf38-5fc0-469f-98a8-9adb23a9eed8", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbddef94-3e63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776873403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873403, "uuid": "3bc9a095-e1a3-41ef-8908-ea575042d7cc", "comment": "Malware payload (Mirai)", "value": "0dd7fb53707fb9376297bc9f8b89f657", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873403, "uuid": "fcb0ee97-7d8a-416f-b79f-1fe468ad132d", "comment": "Malware payload (Mirai)", "value": "6edd5efb2fdb82a7eeb10b78c0a9fdbe1f8720609123e1a398235bccfe3b10bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873403, "uuid": "e42cb677-5366-4cf8-ac08-d14ef4cc42f5", "comment": "Malware payload (Mirai)", "value": "fce2431d8b20c931935b337ca67ab6c77bec50a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873403, "uuid": "de68539d-1979-4ef4-822b-d0326c90060a", "comment": "Malware payload (Mirai)", "value": "c4e2114f2ec1cf2ebf6366607ef9737629c43ee9277e88a4039d6fedf3685184f14acfbd2ae51f7e47cf44c68412dcac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873403, "uuid": "464a78fd-43e0-4828-8548-ccbcf9ec4412", "value": "T12173F74AF9829F10D4D913BBFE0E018D33536798E3EE71129E216F1167CAA5B0B7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873403, "uuid": "f62fe9d6-ebca-464a-b598-8d74b403b6f1", "value": "1536:Kdny3zwiiIhnp/1U1B0n2oDYIVn0nMoSSYB48qllS/icIwLUCwbZn:xjwFIhpe1B0oIKnMoSSYBVFIwoCwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873403, "uuid": "9075a039-c7b7-4947-b75e-3551df2aab2a", "value": 75608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873403, "uuid": "d519f975-2076-41c1-9b09-50ede230878d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873403, "uuid": "d1073c3f-4ffe-4311-a154-a8b2ac1b843c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd78fe3-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880201, "uuid": "991d1127-f63d-413f-91c8-e51c3b778550", "comment": "Malware payload", "value": "602aff9725a6bf762f1905424daeb590", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880201, "uuid": "77685ca7-a8bb-4c03-81d7-cb9267269df5", "comment": "Malware payload", "value": "6ee44cb2add3375121eb50bfef8c3bcf1cf15f651b383617ece16ec02a6a8559", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880201, "uuid": "fde4dfae-25b2-4588-8da1-593cce996067", "comment": "Malware payload", "value": "8f0fc315341c721bd75587e748ea44bf420d3c0d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880201, "uuid": "5a35ffd2-f0da-497d-902e-19fd960b014c", "comment": "Malware payload", "value": "cd634ea333012e3e09e5b849f878494b98eface2c9d53dfa3171793a1bed44d657698fe56f1fe420c6b7317337852dbf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880201, "uuid": "1007414e-2746-49c0-bbe8-7a1fa90e3119", "value": "T1CB136D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880201, "uuid": "58cb3f41-a690-4039-9ee3-7d9cf1910a5b", "value": "768:bRXRWNGxVC9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:brlxpcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880201, "uuid": "1db83916-df57-4ad3-97af-15e51331f3b4", "value": 45507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880201, "uuid": "e295f749-241d-44d1-8031-8592c25c9671", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880201, "uuid": "522fb2d5-ff37-4020-a9f8-d067a3bdc805", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f067d09-3e2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776849249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849249, "uuid": "c3db3a05-a2be-400e-8c56-fb73d4dd89ab", "comment": "Malware payload", "value": "4271d15eaf145350189f221f6d0210a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849249, "uuid": "0435313f-63e2-4c1d-a85b-c323f50e2b50", "comment": "Malware payload", "value": "6f3fc8def94daf3a69c6fe855b1425252410aecf6de035b6098f3536af8e1173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849249, "uuid": "dae58ca2-9b70-4ce6-b50e-117858d1830e", "comment": "Malware payload", "value": "56af4fbfc00ddb61a61cb2c13976f49e12029961", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849249, "uuid": "c08aac04-bace-458b-b8d7-df3fbfedf80e", "comment": "Malware payload", "value": "fa2d726fb5b91faa51204f770e99af26a5f270f297596d98a151303ae67d3433f6ff0bf2c76cf4ac2eda82b8fe490884", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849249, "uuid": "4f02bdf9-9437-42b1-a82d-90d0a229c1bc", "value": "T11E03E1AB42B7ED7CD83AADBADA815248AE70F537C9210F6328E4305ADC427541C65DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849249, "uuid": "1c1b2fd6-a3fb-42e0-86bf-2740debfa4f9", "value": "768:wqjI+QU11QMcTRdCsC7ERo8FdIonEzws8wIk8Uw/Nsv9sPr:u1dC8o8FOoqwvwI1f/iFur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776849249, "uuid": "6e75e5ab-39c9-4ebc-b278-4e94a09f4ecf", "value": 39844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776849249, "uuid": "9de2e53a-818c-425d-9755-fd848f91d7ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849249, "uuid": "3aa13534-93f7-42f0-aa9c-1ae374c47a89", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cefbe1-3e90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776892398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776892398, "uuid": "1b5623e3-353c-45e3-98a3-31e559c5a01d", "comment": "Malware payload", "value": "e4cba4cf75712af93d044c60f19cbe1f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776892398, "uuid": "255698a0-d4d0-495b-a353-18a614006e18", "comment": "Malware payload", "value": "71d7f3906762c432442d24255371d3f4cb8be36f676ab7f924def34044913fd0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776892398, "uuid": "ba94aa38-c44d-49c3-8d24-4563ee43a440", "comment": "Malware payload", "value": "08f3b438ffee06717bc6809686cb3da3bc33bdee", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776892398, "uuid": "af2a9005-edb0-4ad7-85ba-ec8e044da20c", "comment": "Malware payload", "value": "4dcd04da1e8e1be399ad16fd2a40d59656ab853d46a28b57aa9f9e10143979f5eabc4c7e1896fc3ca82b9480f27439fc", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776892398, "uuid": "39dedbf4-fc8d-455d-ae43-6ac693cd029d", "value": "T19C630907EA4261E9C85AC17DC2526632FB717C020361DBEF57847B362EA57D02F3998E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776892398, "uuid": "76560ef5-4ea3-4aa7-a0f0-7c9e18d6e6c3", "value": "91a4d86b004d49986f2fce3383dbbdb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776892398, "uuid": "cf8bf4b5-9873-4f72-a030-424e5dd0b29a", "value": "768:/Avv4H15M+AmehWQ2bO/M2hjy7vo43umLX+eA8upMWjWx8tJLu39r1ggggggggg0:1M+lIWQfjyUdqX+eAjMBoJ4/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776892398, "uuid": "7832d8bb-8186-4430-a15d-5ba16ffadf85", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776892398, "uuid": "64674731-f5f0-498d-975e-b1da34660dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776892398, "uuid": "1a2add77-378b-4f79-a76d-2b8277008a1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ff8ffd-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820837, "uuid": "24343dc1-bbe4-4472-86fd-ad62e0766bc9", "comment": "Malware payload (AgentTesla)", "value": "7e27aaa7948f1e6bd86c114d9cedce47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820837, "uuid": "5df846e1-3220-49bf-83ef-bbaa357525f4", "comment": "Malware payload (AgentTesla)", "value": "71dc50661bf3116897205bac0c7243f866b3b96d6cf226cb54f253e2aadb516c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820837, "uuid": "f8a4a4c5-7b69-4c8f-a034-b0798c095a55", "comment": "Malware payload (AgentTesla)", "value": "b7ca9f82694856ed5683697e798a1348b8f56cd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820837, "uuid": "c903955a-86c1-48c9-9017-069ec5504baa", "comment": "Malware payload (AgentTesla)", "value": "fdadf5f462b9d7b6cfd24eb37ba77be49ff164bb7954ecc8d3f25dee20628064a78a7b7e27017e808a9ae990fe7a5fe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820837, "uuid": "3bd5ae1c-008f-40b0-b99e-05b081abe289", "value": "T154C423BF9A99D903A508901B1E8CA373FBD6B376147900D933378735706661FC82A5BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820837, "uuid": "5c8bc3c6-e69b-459d-905e-2ce2348aeefd", "value": "12288:GnaaSD4xp893JCzq5qDcftDmi8OoemAL/gKo13PiS8vko+Z53EwbIchjn36/rLl:GnN44xp893JCJD4hh8OpHo13Pr8V+fNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820837, "uuid": "ccf64cf0-678a-42d6-a748-d9bcd49085e3", "value": 556695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820837, "uuid": "069cb790-1747-4eb7-84f3-9e514f0e1fc4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820837, "uuid": "0cdca2af-f9e1-4080-8d2c-c5cf67c500ad", "value": "22042026_0101_21042026_Nmerodecotizacindelaordendecompra140467.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41f6efc-3e21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776844963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844963, "uuid": "1f9a242f-d226-42b0-a065-45a861e19bfb", "comment": "Malware payload (Mirai)", "value": "0f29dd0111cd5388219be999b1859318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844963, "uuid": "6d212f58-9b2f-4164-83b3-bda3dea5cdf0", "comment": "Malware payload (Mirai)", "value": "71e6413ff026ba5493191144b5e8a947084751e4cfa537891bfba927ba54ba9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844963, "uuid": "39e347e4-5c49-4ef8-ab82-38902e0c05c3", "comment": "Malware payload (Mirai)", "value": "343b3bdce32c2c480dcb9ffbd566bc98537daec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844963, "uuid": "3984e370-a057-4e24-a2e6-882db3d829fb", "comment": "Malware payload (Mirai)", "value": "f57e688566a4b0410c1f914d4e7172143360c75dab615221c15394e319d97471905a18804de06cab97eac3171b3de3c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844963, "uuid": "3cb37f63-cedd-4f67-9ffb-958559adb007", "value": "T16B044C46EB814A13C0D62779FA9F524633239B94D3DB33069918AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844963, "uuid": "cb238c13-dcce-4148-a7e8-5361ab79564a", "value": "3072:/lAoMkBWDMBaShF/h9b1tgBKsXCmiHUd3oy3d0fM/9zezERM:/lnByIaShF/h9xtwdCPH03oy3dEM/9rM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776844963, "uuid": "342cd81b-8cfe-4235-94f4-7676ac6c1318", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776844963, "uuid": "3fb79d46-f772-4a6a-a8d3-def8248f2b93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844963, "uuid": "9455c580-fa34-4bc0-92e3-bffc409038a9", "value": "luxzz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f77ad8-3e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854546, "uuid": "3163da92-32b6-496f-b3b0-f51094aac54a", "comment": "Malware payload", "value": "96afeae6bd90ee96408442158dca1fdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854546, "uuid": "ceecc99d-cc06-416e-8383-d9f1ca9dd3fa", "comment": "Malware payload", "value": "71ffa9aa7378269d973e975b25c75081fc2172cf2a8f8d7312abe7f801c38f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854546, "uuid": "42ff9067-674b-4930-9e4f-7f25d16a99f1", "comment": "Malware payload", "value": "bcb70f735aef798c6b015fbd074c8d8769b000fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854546, "uuid": "7e4227f1-28de-4cbb-940a-a74a77ec0561", "comment": "Malware payload", "value": "758fa1c96b79f64a1da4411df0a6595bfc71cbe288ae95762e6662d38fb9eb72efc4f0824884e6da1ec419f08a46cb5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854546, "uuid": "1387580b-fd31-4c0b-a943-61045f6e987e", "value": "T1D9756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854546, "uuid": "3fb3c256-4e7d-4409-9c48-724c065c8dbf", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854546, "uuid": "74bb3b27-0858-4c57-80d8-ea9fb75a5573", "value": "24576:Lds9Esxlce6k91UOld2LMxmeDozCMZyFFFREymOCUwPPDNP:LdaEglcAHNaYczYKyL2PPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854546, "uuid": "93c60a52-6731-4469-b624-3cfcf7c7b579", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854546, "uuid": "e480d5d1-4c57-40b8-a6f4-2005f410276e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854546, "uuid": "a4b6e458-4909-4f1e-85b1-ebdaffef6f20", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dc8083-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1776884776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884776, "uuid": "276cd718-7a94-4ca2-8522-c8a1edecb4ef", "comment": "Malware payload (Prometei)", "value": "14e1836ba810d3aea74c826144081f19", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884776, "uuid": "b8e6ec7a-45be-4e33-8988-91fe95fc7ec0", "comment": "Malware payload (Prometei)", "value": "729adc5f8b1359244aed0e027067f3340a0be2ee09452a77c41d3ee91b18e691", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884776, "uuid": "38e4a21f-37c7-48ed-86e4-6f2231c68c06", "comment": "Malware payload (Prometei)", "value": "2a77572943b418b9b15b75b0fa7c0d32923cef66", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884776, "uuid": "5edaaecf-56cd-4402-89aa-deb49c1fab32", "comment": "Malware payload (Prometei)", "value": "d514d72764c9bbe98ac22088f4067d2b6caf149427ec74590d2bd7616f55809810500619774bb4330f45f135e7368603", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884776, "uuid": "82eac7f4-a6f9-4f3e-b1dd-566f731c3f30", "value": "T168A423B4F9219E8F6DD769B91B24831DE182D172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884776, "uuid": "abf3ff16-d285-4731-856e-9cfbdfaa3a85", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdh:Fs6pyCC/Ya2hpi6T6N4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884776, "uuid": "0dda2ad7-ca8e-4e72-a4b0-f875d29953f0", "value": 449082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884776, "uuid": "a47b8512-2409-4631-8047-e3f1b315bd53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884776, "uuid": "fc035e54-dcb0-49ea-b401-7dd8e2fa4eb9", "value": "729adc5f8b1359244aed0e027067f3340a0be2ee09452a77c41d3ee91b18e691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cac3fe-3e8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776890138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890138, "uuid": "6dcd6d22-ce9f-44f3-8f4d-33c85e532c59", "comment": "Malware payload", "value": "44f2035176cf3e5e11312a83448908d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890138, "uuid": "770b4c89-2a6a-4313-a1d3-d5082077fb9d", "comment": "Malware payload", "value": "732342a486ec8390cf8931594ca700b089ed7eabfd665937ab033e2de2358bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890138, "uuid": "a478bbe4-893c-446c-9250-ad53c22f4ff9", "comment": "Malware payload", "value": "c3e1e633d5ef58d0976060e65993f702656ee6a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776890138, "uuid": "f909302c-e8a9-42de-b94b-98c36db8fd64", "comment": "Malware payload", "value": "02acbc188e6107473c73a7e4fdddea8a8ba83e79b212790b49ae7cf9699bf3d3d913e65a290758bcc651c93eab9561fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890138, "uuid": "50131e84-5940-4f2a-8c34-27322a942e8b", "value": "T181E5233D335911A0F9BBF138CA46A7ABD2F1F4468391A79F1B645A251F13924F22E3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890138, "uuid": "150a834d-9137-4d18-b707-a64c52ddc558", "value": "f9401bbcaa2d2eaf5c403413d9baa00a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890138, "uuid": "d88a718b-1416-4259-94f9-66664140fbda", "value": "49152:BLL7CvcdzuhP/7Piky+4Vgjyks2Ljw+SZXSKbVtK2OwiPiq/4qBrwoLkAVA2mq:BWv6I7arHD0jwbZCAt06Gpdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776890138, "uuid": "305f4d4b-090c-48f8-a1f3-70e688741980", "value": 3047424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776890138, "uuid": "0337ac3b-dcb6-4c7f-a708-8b61c356ba8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776890138, "uuid": "23dbfc76-1463-4cd0-a2ee-92c4be5a7e0d", "value": "52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbf93ca-3e63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776873353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873353, "uuid": "9b14874f-1a9d-4d85-be80-adbde4f5ee36", "comment": "Malware payload (Mirai)", "value": "9fd092d17b406eb19125bfc5dd1e5950", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873353, "uuid": "40bdb03e-5d7a-4bb5-afa2-f6dac3bd5b21", "comment": "Malware payload (Mirai)", "value": "73407056f2dbe3b7e67ac9fee0ce2fa6ccfa6642e9847f0f9a1f405fa3769fdd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873353, "uuid": "3f398ece-442b-4e02-9ae4-821554131d3c", "comment": "Malware payload (Mirai)", "value": "8674d5b03da794fb1de5804896f3de7dc550a887", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873353, "uuid": "2e45edb4-ab60-42b2-a31a-7768c3e35db0", "comment": "Malware payload (Mirai)", "value": "a96a5821ad8775fc1b8a8b5483e5d9e577c64fa77dec2019640097635c3108862975a690098eca2baba66a6d2e1f67b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873353, "uuid": "bbac4898-1e98-4d0e-bfa0-92bf32b3c0ff", "value": "T1D833E845BD829906C6D843B7FA1E42CD331173D8E2ED3227DD157F12BBCA52B09AB162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873353, "uuid": "a908aeb3-0a66-498e-82fe-545bda68fa74", "value": "768:5+/lwk5gcxOTLDYr6Etl35agtJFTfW+Qlw+3i+5ObXdVs8nnaCTCuxDMiBwbZnU:c/l3gcxOTLDYNbwglqO+3+8ya9awbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873353, "uuid": "89effb93-ee0f-42d8-a66a-7ddab2063dc5", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873353, "uuid": "78050186-f220-410c-abff-b0f575ad1793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873353, "uuid": "c545c9ed-56d8-4e17-a269-8ab22a0f387e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed13719-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876173, "uuid": "594bb07f-aa8b-4d31-9e41-60436fe01275", "comment": "Malware payload (Mirai)", "value": "d7632a4acb4d1e3f2c67c2b26bacd293", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876173, "uuid": "ee11178f-050f-4699-948a-a3c8fdf58b32", "comment": "Malware payload (Mirai)", "value": "73ee19c193b47f844c000011e7b0f90c6d4cf4519dbdd4ba7ed738903d6825ce", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876173, "uuid": "648f27f2-36bb-4b66-bf7d-d48d57036ecd", "comment": "Malware payload (Mirai)", "value": "3e10d8294c843d9ef20431c988f64343f152e96b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876173, "uuid": "8b29b7f7-4be2-4b98-af88-28a51cdd38c4", "comment": "Malware payload (Mirai)", "value": "c7ac9e7f8215d65f03c12cff82ac08f228dc5b4d31dba58df6b4fb2b8ca141575228095c41fdb81b25b4ebaef2a929c3", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876173, "uuid": "9ce6ad39-276d-4553-99ee-b65257879057", "value": "T19CB2D05C159C56BAD106873841D7BC4129B342A521AECA5FEF787EE02FAE120C2BC49F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876173, "uuid": "338fa0d2-4550-4317-9f0b-089a93e4d670", "value": "768:XYgv2x1frmthnyJXFQuF2Btzck2lqsNA1yqB:XYa6froytFQa2Bt2lqsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876173, "uuid": "d1ef2126-fccc-4052-9c0a-7a4111b7afa0", "value": 25196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876173, "uuid": "b6e2192e-1723-4482-95cd-26c7147a6008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876173, "uuid": "cfe31055-e465-467f-93c1-334deb43b1f4", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94759d38-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875001, "uuid": "91ae3473-09b1-4c6e-a2ed-42f4d0137996", "comment": "Malware payload (Mirai)", "value": "a968fbf0411c17d02f15c44cf6bc6fbc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875001, "uuid": "34ef1c71-5b4e-402e-a932-67b9a408f755", "comment": "Malware payload (Mirai)", "value": "741712f0d9bcee88173d0111a010e3d36da165c91ab82d01f24138868dcd5fbf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875001, "uuid": "41c17d37-ce2b-4d66-be60-387e7be21d47", "comment": "Malware payload (Mirai)", "value": "4d7ea8321d5b32919f71a620373fdd72812c4124", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875001, "uuid": "595cd27b-045e-4c2a-a9a2-d93a53fe5e34", "comment": "Malware payload (Mirai)", "value": "649587631d0566042d2822cfbe686a4e78e84b849cb4f0e5601ed9ce65e6334a7faed8ded3fa78bb52b60b2bb5c6094a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875001, "uuid": "55d8c7e3-57ce-4062-96ad-343122d995c4", "value": "T1EE32C517A7BBAE1BC4D037770193072162E95F916024472FBD0D1C8E6E9A3412D3FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875001, "uuid": "74904bd7-f35e-48f2-8dc6-1abd674b16f8", "value": "192:xvrOR1CQOsz1NxfAz+OH9iG0GhWaDpU/O7Q89AGSybVqeif:xvrbCzfap2GwIU/kwGS6Uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875001, "uuid": "905fb072-a210-45f3-b2a0-e25fc7abd396", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875001, "uuid": "c03b07ac-7f92-48fc-ba9a-82017a41f21b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875001, "uuid": "a11a5085-c6d9-45a4-ba0e-30e60b1f930d", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999b746d-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877157, "uuid": "a990e489-92f1-47a5-87b9-dcf5b02594bc", "comment": "Malware payload (Mirai)", "value": "bccd458843aa813dd3788c2eed0afcc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877157, "uuid": "4d28c1c7-508d-44f4-9ecb-be630bc6d0e1", "comment": "Malware payload (Mirai)", "value": "749d5725be43fc8bf50854a2c4db041017e0111c0f0784d9656a60d6f85092e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877157, "uuid": "3b8d070f-6760-4468-b50b-32e37804b403", "comment": "Malware payload (Mirai)", "value": "79fa7cc6d86b95b3df6d1d51b8d6fe2d9d5c8cb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877157, "uuid": "eb3a6283-a199-4c07-aa5a-d1ad04c9651b", "comment": "Malware payload (Mirai)", "value": "3686bea2eeb74975107c525c06988b45949086c7bb2e96a5ed6da0a3b01b8c2fdec35da782c429279c75db3154a13a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877157, "uuid": "d36118a0-3739-402a-9df4-49b30585a347", "value": "T1FE633B02B31C0E47D16359F02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877157, "uuid": "de9e6884-98ac-44c1-b572-1045c2053c53", "value": "1536:9yJWBrmSTKrFDT6GwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04OxDT6K1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877157, "uuid": "060adb27-20cc-481f-b3b8-49a3ab4d87da", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877157, "uuid": "dd0f83c2-d661-4eee-a361-9ba68b8871aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877157, "uuid": "0f427719-d67d-477f-9c16-07ac2d092ba7", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3ed451-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876276, "uuid": "10daba80-0450-4c8b-9129-9609cb3edf92", "comment": "Malware payload (Mirai)", "value": "436fe96cdb6ffed7feada0fa3ffeb774", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876276, "uuid": "1d5b1447-3ada-44ae-b550-67e56c9e9506", "comment": "Malware payload (Mirai)", "value": "74ed6808411da5d66e7a191ddd6e57a50cbe268f855913b85f7356c7b9ef7f00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876276, "uuid": "b0e69c8b-8a9b-4c4f-be72-772dd73e8e7b", "comment": "Malware payload (Mirai)", "value": "7af5480221a3ed4d43bd78ca9e5e645df35f0f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876276, "uuid": "dc35d3b7-a261-4bfa-a397-4ed44c0f27da", "comment": "Malware payload (Mirai)", "value": "aae0a2afdba0073ce6c23e9b01f6370972c57ecfc99c82abc28030247bb7675cac2793ca7ec8e5d1d1fe81e67e238bab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876276, "uuid": "4180e521-3306-4326-9995-fe9def5af24c", "value": "T16A23D71AEF514EFBC86FCE3305A90B5231CC544722A53B3A3674D92CF65A54B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876276, "uuid": "2adef1e7-2f8c-4708-ba68-7944d70815e5", "value": "768:+TAUA1w7G3zLuBeeqaPrHHwk8CLZK2PXi1TVeheyrrHP/3zLW/ySxeD3sWKI:+EUA1wlBB/bQ2ZK2WTVkxrrHPvHcqJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876276, "uuid": "69454be5-ce1f-479e-aa95-c7d54d1216a8", "value": 48700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876276, "uuid": "6795c27b-a00a-4fea-a056-da610f289a27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876276, "uuid": "86e000bc-cd2c-46f9-886a-907a603ee893", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fed8f5-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884426, "uuid": "9b1e0ea2-0329-4e21-b959-10d4f6180abf", "comment": "Malware payload", "value": "9256424eb44d7e6af55271ad568e2804", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884426, "uuid": "e8687961-fb70-4246-9878-c659d9ca662c", "comment": "Malware payload", "value": "74f2324c600b62b3868dcf73ed714a414d15936738aecf90bd510531652f047f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884426, "uuid": "23e41a09-9ecb-4768-be97-6f3a94bef63e", "comment": "Malware payload", "value": "ec7f6fa838f693fe7ce029ba51ec413ac1d5f1fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884426, "uuid": "f898330c-f0a3-4a90-afab-df62d35c6097", "comment": "Malware payload", "value": "4caac1799971d93de48a867ccd3b00f202c3b8e2b81c58159489286df6087e04bd1edba2005b4f0536e5a829c83346d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884426, "uuid": "d21eed5c-2148-4dba-8c04-2fc3e07c0aef", "value": "T10965CF9777248996C0706A3BE1A7EFB183677E3115D86A0F9D48F77608B33048F15EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884426, "uuid": "6514465e-53f2-4481-8ab6-3adc308c6c7a", "value": "24576:fBAXobSBtriTNEqnHqQsV3TpXeuHEaPXjmNU6m7ROVv:KBWMIuHEaPTmNUz2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884426, "uuid": "952b9cd7-aece-43a1-8681-fdf4f122aaec", "value": 1413726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884426, "uuid": "60a2ab49-03b1-4643-a415-6fee593be4e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884426, "uuid": "9e933c10-f934-436d-b5a5-92d32af4b38e", "value": "bot.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122e3285-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877360, "uuid": "5883febb-98dd-469c-b7b3-94a133549d28", "comment": "Malware payload (Mirai)", "value": "5eb905a35a915695bbfa1d695b53369e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877360, "uuid": "1b9aee34-4f54-4a4e-a641-ff30f8d0176c", "comment": "Malware payload (Mirai)", "value": "750afeeb1d7bcab44cc30741c4d1807dd7858be07c9f245ab2ae7ba726e09e40", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877360, "uuid": "e20acad8-5ad4-49ce-a5af-415ec7956fa9", "comment": "Malware payload (Mirai)", "value": "9edfb75a3c8636ac7540e1ef02deae20accd3f14", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877360, "uuid": "6c740631-f918-4230-966b-f52af7845a12", "comment": "Malware payload (Mirai)", "value": "bcdd741833ac933308709a82dca3b0f7486c3ddc7db9cbe2e752afba5d449dc1e230f66919f338c31582ae71854a6d1c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877360, "uuid": "7e0812da-ec46-4675-93ab-ffa7957d55f2", "value": "T191E32A42731C0A47D2632EF43A3F27E093EFDAD121E4F644255F9A8A9171E32558AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877360, "uuid": "739f124b-30be-41f6-9dc7-f042bee44332", "value": "1536:3J9qyIKZnU/oNbjQ3v9U3uKxfuWoxKsRQ5IhF18BQxSvASMmOKLJ2o8qcZygkPeC:3J9GEK3lU3uKx0xzRFqBMLSq9k2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877360, "uuid": "b7b7f088-5640-4f12-9253-8cf0223992ed", "value": 150420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877360, "uuid": "ee8a6ec6-9029-43b0-bc6f-97d80ea2cd97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877360, "uuid": "0e4aaca1-360c-4cdc-bd5f-a40ee719daf9", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0b75dd-3e22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776845223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845223, "uuid": "29e380c8-82f3-468b-9e60-4ea82dd91e73", "comment": "Malware payload", "value": "3c626102b2efd323bc5d859e84c72742", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845223, "uuid": "964439ee-2f4b-4300-a1de-772b7f75a412", "comment": "Malware payload", "value": "75d8e059111fd0289912b062631ed3a08e0701e6b0c6fca922730f2ddf3baa7a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845223, "uuid": "8c03dd87-8f26-49ef-9597-46817e89160d", "comment": "Malware payload", "value": "5d454a07ed170b3ce72a8fcd0012422de6be512a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845223, "uuid": "37f79b58-0850-48de-a5b8-eb0c00a81f2f", "comment": "Malware payload", "value": "88370c43cacf428549cd76ecf5749272ac509d7aeb5492a4992a70d63d1ee8bcebc19c39d3fc314db83b8085cc26c5b2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845223, "uuid": "48bd9590-5846-44c4-a956-3b0af39b9790", "value": "T180B2EFF1F8ECA436369D853ABB9CA805A9CF7C2F4DAB7D2014575938411C71EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845223, "uuid": "98b08751-4ad1-4bee-a219-bf7408133e78", "value": "384:bVc3s1oisjsKG6qkSgjkjV/A4UAcGE3JNRhQuW5Q:QshUMkSgjkjVdUAcd3JN3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776845223, "uuid": "893366a0-c6f2-4ecb-8526-3c4b3fc6fa2a", "value": 23655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776845223, "uuid": "6069c4ce-5155-4590-89b2-1fff3390f4e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845223, "uuid": "76646e99-d7b1-4ec8-84d8-e8d885fa074c", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10fe0bc-3e63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776873412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873412, "uuid": "fc9e8e72-3549-4195-a08b-379d2138d129", "comment": "Malware payload (Mirai)", "value": "dd56d772c005df56f704df09eddab770", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873412, "uuid": "679e9fe8-5f15-4455-af9d-8315824dfddc", "comment": "Malware payload (Mirai)", "value": "75f3e6d6bd2daab6603b52c06a0d238916c9dc3869800b19cc8dcdaa383f337c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873412, "uuid": "25034953-6436-4531-9f50-78cf798480b1", "comment": "Malware payload (Mirai)", "value": "c72aff52a28bc3b1765be34ebec64b85fcbab67e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873412, "uuid": "b34c3d1e-5464-4970-b341-c8569b5fa0f9", "comment": "Malware payload (Mirai)", "value": "d8890a854a6a134789b5c015b0f9df230d7074bf22a4b44f08c5fed355d64c2d2f0293aa4a0cd3a314925a0cfcb0d4b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873412, "uuid": "31444041-8bf7-455b-8f3d-5c11ce1fba07", "value": "T14E63410ABF611EF7F86FCE3706E52B45308C601A21A83F757974E918FA4A10B54E38B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873412, "uuid": "2e41e816-5f34-4490-8c88-38c19e93973f", "value": "1536:nxo6M86eAtqV4dfYvVNufYuI0Kck6n2MFhwbZn:K6MjeAt84VYvhulKV6nvwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873412, "uuid": "e0f8a34b-5351-416e-b9fb-64df484e7a19", "value": 71480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873412, "uuid": "be5c72f3-01e0-440c-b5c3-2d75a93f74cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873412, "uuid": "13462b6a-57d1-4899-8ed6-0bcc84e1f2ea", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a500d57-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874984, "uuid": "2690ce6d-dfc3-43c4-9a51-3acb43a12b26", "comment": "Malware payload (Mirai)", "value": "f956fe75abe817177a81123ef2db4ac9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874984, "uuid": "918c0e03-9448-48cd-8a5d-bd14d8f5749e", "comment": "Malware payload (Mirai)", "value": "7622a284a69aeedfcd4173e5571d91ae6efe49c6b22ce703ae218ba7dd26a877", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874984, "uuid": "43e171b2-dc77-4430-90be-3b4823ae5996", "comment": "Malware payload (Mirai)", "value": "6dd972698deb72548a469b0c932988daf7ba85c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874984, "uuid": "bcc99624-0b94-4531-b28c-f5da80b20508", "comment": "Malware payload (Mirai)", "value": "56b39da3c9c5060f9a9bb112605b26195855f6c258de0516af50de0ae88b8725c4133285b7eac3d04d4a8dd12ee299b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874984, "uuid": "2e42c884-4a1b-4094-8e4b-7d4c5d762f17", "value": "T1D0B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874984, "uuid": "c6128283-81e5-43c8-b051-91b819055f98", "value": "1536:TUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvC:AixnUHz4Z+5ypkn3E8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874984, "uuid": "18d42fb1-8f35-4022-b7b0-59e1f3cccf59", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874984, "uuid": "b7867e6e-efa5-49fc-8101-5ed8dcdc49bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874984, "uuid": "16d6e8ad-0c73-4178-92b1-476f1ae336d2", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2ad005-3e49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776862212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862212, "uuid": "72443626-543b-41af-9399-9962784633d8", "comment": "Malware payload", "value": "3af0b33105d0642b61c775b5ee41ea0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862212, "uuid": "8b42d43e-a018-4638-b4a4-f5baccae6c12", "comment": "Malware payload", "value": "765fec2faefc6651f7a9345718bd871df9903e6a0115a0bd0d4965596349a7b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862212, "uuid": "16b5ffdc-9e6a-4458-bffe-932098996491", "comment": "Malware payload", "value": "c12b733d99950d62567370eced6800f6e9c8327c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862212, "uuid": "f7479568-54e8-4dee-8c90-cb88478ed917", "comment": "Malware payload", "value": "bc6289042fa92491e9cd22036665a85f632c651b28afbec4178c650c81a70c38c69085036f13461efffd5fd490c08eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862212, "uuid": "3198ea7c-a8e2-4a19-bd4e-60dd1d23d6ff", "value": "T14776239173455653CEA84B314AE2C334A6F8355143B3868EE70663381FB25AE7E2EDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862212, "uuid": "c93e80ed-f823-43f9-ac88-8f44fc66f2cd", "value": "196608:xY6jP/gAsUgdYL+h707RJrXiT0PhVONYV/CMeob:xY6jP/jU++qnbiT8DMYIMe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776862212, "uuid": "579c831a-bcd4-4ac7-b1b7-a46078cdcad4", "value": 7495434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776862212, "uuid": "0f571bc6-c0cb-4a5b-9bc3-0a02e88bd264", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862212, "uuid": "d311650c-e96b-40af-a36e-caf32fa7563d", "value": "h2stream.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c08477-3e63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776873366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873366, "uuid": "70bd5905-8c7b-4f47-9dc3-50f0a7e2f605", "comment": "Malware payload (Mirai)", "value": "d77b588812996fc4c450388517e543cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873366, "uuid": "ec80d86e-3d26-44c2-a054-0b62b799285f", "comment": "Malware payload (Mirai)", "value": "77ed441fe35a4fca90fd19fc4b2fbefca470ea928f233a5586fa6b0bf6a8285b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873366, "uuid": "2139d4b9-0e1e-4c89-8653-0d91f0d1f7be", "comment": "Malware payload (Mirai)", "value": "7d516b55c1368ccca7ea2e78cda0a0e3e0feb925", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873366, "uuid": "f28d1519-4828-47ae-9d02-a3a82e2f8ca6", "comment": "Malware payload (Mirai)", "value": "4d6f806a01687c46e8de1a0a1693df50d9d8bf141badc1df94d67aece924a59050cbabe092c1f538b1543e11e4cb3f6d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873366, "uuid": "d6c8788b-46d3-4ed2-b6d1-5361aa08ab7b", "value": "T14253F946B9829E11C5C807BBFE1E118D33137798D2DEB223DE116F11BBCA56B0A7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873366, "uuid": "a9cb220b-abbf-43e2-9f4d-a1945f866f3e", "value": "1536:Qxnj8zEyaRD6/8MDKL8cC6ePoLxrLN+PfIpirX/CFEbwbZn:ySEJD6/z68c9L4X/CFEbwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873366, "uuid": "a0a2c017-4e7d-445e-ac0f-cb34538ee9b8", "value": 62632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873366, "uuid": "ae4dbd41-acbf-439b-a83a-ab89a7d87155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873366, "uuid": "f428e4ab-80b6-4efa-be02-0a1261e3904f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dc209d-3dfe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776829833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776829833, "uuid": "61aa5555-af78-4df9-a538-93fed6635543", "comment": "Malware payload (Mirai)", "value": "770333857d7a7deed8dec55b55d3c47a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776829833, "uuid": "284dc995-4d9e-4afd-a5a7-e58a56c7144c", "comment": "Malware payload (Mirai)", "value": "78c300d4b4d86d0e0163e8c48b0b58cbbe55ebddab0b1221d0a171c27feb6165", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776829833, "uuid": "db596213-ae90-45b7-854d-3dbbcb58b6cc", "comment": "Malware payload (Mirai)", "value": "8dbe0012f124f2181f00905213ff4c7664726e1e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776829833, "uuid": "807c0529-51f9-4580-a8e0-8f8638a6d561", "comment": "Malware payload (Mirai)", "value": "e401b92202ba120df41ed853d750f131220a98e5098ec8588fc04c5dbeb28c938a66a7ce7a35d98d006211208f967f98", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776829833, "uuid": "1c66b002-b0b1-4cf8-9c38-3bcbf024c6ca", "value": "T1C4E09BD7F1312AC34044FF08F4A6CDE5E156D7CD11875B982EEC7A6F863C8107914A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776829833, "uuid": "5ff3b9bf-e1c3-4e30-bd9e-03349d96f440", "value": "6:L6F0oXFdih3kq6L6FiFdih3HQl4vL6FGoFdihdzXXyL6FG1NFFdihrNIh5E6FG35:EsrOsciqspXXMXsrNIh5WGjs7cKLKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776829833, "uuid": "c5fe096d-0b81-4e3b-953f-90defb9480b1", "value": 416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776829833, "uuid": "7dbcb585-fda3-43d5-bd4b-4a5f7b530cfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776829833, "uuid": "4b28c448-6183-4c4f-8fde-2a6fb23e3591", "value": "massload", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20612623-3e16-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776840017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776840017, "uuid": "3165c8d2-8327-4ad1-8596-9b30f2f2f480", "comment": "Malware payload", "value": "e29cdaa68c80ecf7565cde9b2a710df2", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776840017, "uuid": "716b6d4f-ea30-4643-b032-d645f657b9e2", "comment": "Malware payload", "value": "7973cedfac6240820471861b984d08b546d4da2d0c473448bdf6602e4dacbd5e", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776840017, "uuid": "1aa4da64-c2cd-4d7a-86f9-e275f44f5332", "comment": "Malware payload", "value": "7bf99613e87b543c329b8df981323d71f69e2db6", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776840017, "uuid": "c58c0dd2-294e-4328-a15c-8bf0b5db89b9", "comment": "Malware payload", "value": "e856176a0c3a044b105e7eb9ee0a9ee99bb44942637e30f2fce21bd32fd57964735a5646d2b4d030d48adf87b76ae9fa", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776840017, "uuid": "797a4ab6-9d79-401e-8680-8d3458a404c3", "value": "T10E3512BC74B57A9AF0E4437FC6492CB6DB2CA540DB893DDB8D2040567E8320E5F7A861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776840017, "uuid": "35284571-d876-4184-b39f-16c4828813f4", "value": "24576:F11cEC+sbZ/JvcccLnDGxkK2qTJQQJvagkaBdzCwoobc9:P10+ga3LyxkK2qTJQUvagkgzCRoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776840017, "uuid": "d703878f-35c7-42dc-9cb0-d93ceeeaf214", "value": 1162950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776840017, "uuid": "8f222c06-ae0e-4e0a-a2f3-2e350e41419e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776840017, "uuid": "6b725f26-82be-4482-a06c-ea79cf0d8eb7", "value": "KISSofSIN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c69fe3-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848350, "uuid": "e8dc1054-6e1f-4800-93d6-721914cc8689", "comment": "Malware payload (Mirai)", "value": "a01774fd869d5779cb69d30b532b29b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848350, "uuid": "e3864c6c-bad4-4787-b3ed-08dba70fb732", "comment": "Malware payload (Mirai)", "value": "79bd145c01a073e5a7a1bb1ccad1c73ec5f0c75756110269d67a2a54ece1ef26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848350, "uuid": "93680d7f-2c69-4d57-a0c8-5429d1edb222", "comment": "Malware payload (Mirai)", "value": "8448a1b790a8a5b7c125e0a527dae5f7e19f4076", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848350, "uuid": "4a037da8-dc79-446c-865d-7ed410bd3d33", "comment": "Malware payload (Mirai)", "value": "7bf8570f0457fbbb72fc37cfe9bdf86f2f90735d1a779c8d36d12893b619b88c7bcb6ec000bf48a0bb99e9a8c0fef4c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848350, "uuid": "42c2c33e-ae41-44ec-bf3c-41ab30c2ba4d", "value": "T13E935B22B539193BC4E4947622F35326F1F6438A14A88B2E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848350, "uuid": "469536a8-8982-4c76-9e8e-3e10a8b74950", "value": "1536:DCTLZ0J9dF+/EqR9oShcUvytX5Ym5ngP5gYtGGJ:2yi+0FaB5YOgAGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848350, "uuid": "23ead465-aea7-4411-95b2-df42c8d37083", "value": 91984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848350, "uuid": "dfd30ace-0061-4397-a4c5-6055ef94e0ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848350, "uuid": "1b9b3233-65ba-422c-9377-824b2776a1d0", "value": "luxzz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222010b9-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894996, "uuid": "564ae223-3f8b-4049-8c75-fba4c6c0c207", "comment": "Malware payload", "value": "58a97f2dfd7193d38dd6e58e8a8251c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894996, "uuid": "bd872158-939b-4ea0-a034-0e83687b3aa9", "comment": "Malware payload", "value": "7a1b4267328c8576d05436c0af1aeb1723dfe95eda50994f16c4ce443f0c8e89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894996, "uuid": "42d85081-3191-4ddd-8fbb-dc0cbacd96e2", "comment": "Malware payload", "value": "c98b8e2bf9a696bda2c7ce8e484644362a96f9b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894996, "uuid": "552cfe5f-7291-4166-9b0a-6beea425a39c", "comment": "Malware payload", "value": "d304e73167256aabe58e3c0128a74ad3fc7ed547d644adbf78c8f27ca31c5804208af6f746b0e4886c9f28e2be21658f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894996, "uuid": "616ce62a-0a7d-4136-b3fe-f452cc527ca0", "value": "T10C464A46BC1D64A2D6C976746F6652D47339BC089F82C3232624FB7DB9F23588F132A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894996, "uuid": "50086452-dafc-4465-920a-1377691482a4", "value": "49152:AHatGbX0/kBX2kL2u/i4o6ZmfaRpQrMCRlZ+AmPI4kQGfKRW0CGD0RL+q5E+:AHaC2uFo6QCRpQrjt+AlCgE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894996, "uuid": "b8d0e966-15a1-4979-bdb0-69f28dd0d278", "value": 5767352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894996, "uuid": "f34e23c0-c848-4d6c-86c4-2a209a49bf7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894996, "uuid": "a3d329bf-60d7-4386-a61c-daa1da1e5734", "value": "h2rapidreset.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322a07c5-3e9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776896741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776896741, "uuid": "c91482e7-9bca-4cab-93a6-5da0737042ee", "comment": "Malware payload", "value": "c36a468d4aa9f7d5f1f16b50432f5682", "object_relation": "md5", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776896741, "uuid": "26efd862-64c5-4c17-8392-42ff3265977f", "comment": "Malware payload", "value": "7a8bd26d04f99d7cc0611f67fbd3cb5cfb86c2aaa288d1c11c458bb789e2864b", "object_relation": "sha256", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776896741, "uuid": "141b30f1-5c26-473e-bf77-d7567e3c59f6", "comment": "Malware payload", "value": "ede01bcab5672c1dc78af38c1d63cbb5ac606bdd", "object_relation": "sha1", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776896741, "uuid": "0ea6e436-4b4e-426d-b209-b7a47a224201", "comment": "Malware payload", "value": "190a09b50929cfc240346f56a3a36b9b09a7e39bb158a658eda0591a825c50c9faa3ff0d1d9e2bff0e2c996eb8e3887b", "object_relation": "sha3-384", "Tag": [ { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776896741, "uuid": "ddf53528-0c47-40f9-9863-d31a1ca7d5a9", "value": "T157A4239C26D11A352C97B2D4B9153F870770E71F37ECCAEBA60B39C46AADC30054664E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776896741, "uuid": "75e2ca49-8896-42f2-a68d-e2dfe3b418cf", "value": "12288:cJAjNngJOP9zYfcEaN9B/Jm0LU0gM7aQH:c+VgQ6fclN9BhmSHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776896741, "uuid": "815d34ea-3280-4588-98ce-8cf72e842b1f", "value": 467513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776896741, "uuid": "01a9b882-5938-49ca-9d71-df65fcd61d1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776896741, "uuid": "146ab664-bac9-453e-ac43-5ec9b24569f6", "value": "Wasm_Crack_3.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f76aee-3ddf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776816653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816653, "uuid": "5534b1ad-f61a-43ec-9604-609501422fc8", "comment": "Malware payload", "value": "4d8d59b02081cc66a6776b0f8cc8c373", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816653, "uuid": "c4783030-9787-4580-9aeb-e4aebbf0b0e0", "comment": "Malware payload", "value": "7bce6308c7be6a4c01f9a4538a519fa1cf44d6edb5a5ecf8bab6aa3df70d041d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816653, "uuid": "ee9501d9-67bf-4dda-babe-a388d7f695b7", "comment": "Malware payload", "value": "bafd12928812bd26149a696169454aec94717bcc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816653, "uuid": "f1e431a3-687b-4d9f-a4a5-19d1b1567feb", "comment": "Malware payload", "value": "cf3669cce68dc53881b5b1b6138bf71fc501728bfd3d90647eff654fb3306d29e89d0ecf014c4ce48a2f3b82c7ea1e20", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816653, "uuid": "fcd89f2a-cde7-43d4-b17a-10a5f89945b4", "value": "T192E3DA4D14FB44850B732424A59B5543DFA1872F0A08CBAE772CFF62AF142D8D4EE7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816653, "uuid": "30c1f5cc-817c-4837-9fc7-bc296178466a", "value": "768:woOgR0kVtSR4ZNpGhS+tzczonXBYEdbQV+3hDbf1qmIhO1+osG6ACknEngW8pAzL:DAR4Zkxd1hDMAinXrYyi6IgLCOjhzYUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776816653, "uuid": "f35e6b7e-1814-4881-9ba6-b236a05749ed", "value": 143610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776816653, "uuid": "314ec9ea-8598-4117-82a6-1f60c0ba01dd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816653, "uuid": "84e395ce-5db6-4f2e-964a-f6aa8f1d6063", "value": "Home_Report_Daily_342.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e115fd3-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882238, "uuid": "d97a77e4-4976-49ff-9068-2b404480e899", "comment": "Malware payload (Mirai)", "value": "7d1044e42c032f1050c171616294bde8", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882238, "uuid": "26960df0-bc15-4685-8fe5-a656455e5ac1", "comment": "Malware payload (Mirai)", "value": "7c2722a023ad6f017e581e9fb8c08e44b7b185a203c3d9d97ff391630326c723", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882238, "uuid": "cdd5458c-7567-4dc6-a043-fdd91cf26b18", "comment": "Malware payload (Mirai)", "value": "5b8a8e7fadf5cf8e13717319364fe76ffc6c7b07", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882238, "uuid": "7fa750ba-c975-4e24-ab32-013bd48f572c", "comment": "Malware payload (Mirai)", "value": "b6a4bd2c83e21ba46ead222a2460522fb74a0b044d23e077f854c1b32deb778520b5e96a985609daeb5c45e32a957e64", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882238, "uuid": "342c6284-9b99-4251-b64e-1448a2772432", "value": "T1B9557D59FD5E3C42E3DBF378AB4D87E1A21B71A0D32741A33982035C85969E9CBF0925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882238, "uuid": "caec4d92-b80b-40fb-b025-3b396a753d79", "value": "24576:Me91y17YTPnTnwAu7kU185qBSmu11GjZs:UGn/C1QxL2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882238, "uuid": "bd76e970-a696-4115-aaad-08338ff7dc79", "value": 1322064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882238, "uuid": "55a3bb10-7b97-41e3-ba74-1719dd357074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882238, "uuid": "2dd870e4-e97b-4d22-a474-a34a0661c633", "value": "bot_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03d9756-3e5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776871612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871612, "uuid": "5e97bcfa-5d4d-45d7-8bb4-3c1253e7a126", "comment": "Malware payload", "value": "1adfb25e8bee0460c23380166bbe0be9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871612, "uuid": "cbf52fdc-b973-443e-9be6-8c5b292ac169", "comment": "Malware payload", "value": "7c6327d95c4058b93f82313c2677e8484f8f5850224f7f173c60c78ea3002987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871612, "uuid": "5b8abfdb-d417-4904-962d-50d54ba258a5", "comment": "Malware payload", "value": "527d23ed2b90d7ec90cf4eb9d1e81b919f43e489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871612, "uuid": "d93e16e2-951e-45cb-b616-ebc0758b61f7", "comment": "Malware payload", "value": "e183a430faec8bd641e4480b12479c2af1575f605a3a2ec60c58a0848019b4d1ec0101b39a59864cdf2fb947443d8b63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871612, "uuid": "ce8e6f57-af84-46e2-a4cc-3a00a7b11419", "value": "T1DE343A03F29444B8D46FC17D875BA927E7B17C854720F69F5F980B222E27B90A72EB05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871612, "uuid": "1e9b4b0a-6752-4179-9297-0ee59c7cdc1a", "value": "52c9484defeb7cd1d9a0d27601f834f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871612, "uuid": "334548df-fb12-4ff5-b48d-ff4c114c2bc4", "value": "6144:mvbgYWkIvTO/u5azi9IK+lwxg3ztkQPW2:2bgYW4/uwwfxg3zSUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776871612, "uuid": "92c68029-de80-4f0e-aa3b-3b488df88524", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776871612, "uuid": "9cb767f1-66d8-4c03-9d12-27f6eda9268e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871612, "uuid": "5d786967-7c8a-4a9a-af84-4426d2808e4a", "value": "Microsoft.WindowsAppRuntime.Bootstrap.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857c2246-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888720, "uuid": "895123c4-a25a-45fc-84ab-43179c3e8fac", "comment": "Malware payload (Gafgyt)", "value": "e8bfd3496772e5be6059e8b0cce0b666", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888720, "uuid": "3763fda7-9283-451a-91c4-2076862b35d9", "comment": "Malware payload (Gafgyt)", "value": "7c99506876f33d8aa2ae64a6535cedfda17803c6669adfd99817452d8fcd940e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888720, "uuid": "9da34ff0-9d6b-471d-bf12-c467e49b88d9", "comment": "Malware payload (Gafgyt)", "value": "a975b8b1076155f52bad2022ad8b442db60dde9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888720, "uuid": "c5415721-8274-4c8f-b3dc-3b616ab86b0e", "comment": "Malware payload (Gafgyt)", "value": "05ff5c1d8a5d8cb6dea961e2d32a3ee67357de50a562f2bb233cc560b5c1d9f00390b7a5692730cf37833ab8f4552eb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888720, "uuid": "49b875c2-1be7-4217-a858-0e5a96e8c086", "value": "T190933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888720, "uuid": "5659cb56-b7f9-447c-a722-98e78a12ad4f", "value": "1536:9QK1n/zXzxuPz5tq57MBtcaKECp/dC1k+8LMLumXxVqDrstKfz9e:99bzI9dtcaT0xMLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888720, "uuid": "bcd88f92-24ef-4cf6-b7b6-9829d42ec8a0", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888720, "uuid": "0d743d83-4099-466b-8ebd-60c6b45185c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888720, "uuid": "43a3932b-3c60-482b-90f6-55c4e03908f0", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fc5a7f-3e12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776838582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838582, "uuid": "ea3cbf24-7ab7-47da-98e1-6b601a013e9b", "comment": "Malware payload", "value": "5d5bb4b3d0dd3da194a9366b55844f2e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838582, "uuid": "2dda4b28-ce0d-4b3d-8cad-88b0fd1f2022", "comment": "Malware payload", "value": "7cb2ac0721b4664fa6b6f09092c000d038846efd32d945799b337e9508e29e1f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838582, "uuid": "04108a71-4e8e-4eeb-8da4-4a93a08b5e4e", "comment": "Malware payload", "value": "648c14c383bee9da382a72ee211f6088f95b26c9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838582, "uuid": "8b1526b4-e50a-48d0-b434-06cb70ccbd4b", "comment": "Malware payload", "value": "ad39450dc2d84772220e0e9d636d06d51c938c6698f27e00346c373ce521a772bc350b03e94556cb9635cc6e9e56020c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838582, "uuid": "2e4c9008-d851-4c1e-ad3e-435fc19121cd", "value": "T107D30FCB8ACE88FD8B1F9405042F6D23DA2B5617186DDAE17EEEBD425F12D247496CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838582, "uuid": "ec56e1a9-3f89-4186-b5b6-e1dfc4923f09", "value": "1536:jLYEdzwDr/mJNAplasVcjpd33ZAv6ETuBBUvpx:Azr/VplasVcjpd33ZAj6BBUvpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776838582, "uuid": "d54963f9-e39e-43c1-91ed-a8b7c4c80861", "value": 142790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776838582, "uuid": "e13d21b1-2dca-4371-8306-5edeca23ef75", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838582, "uuid": "6d64d7a2-2cbf-4d30-90c2-3cb24d2f6a29", "value": "Meeting_X_Config_928.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b54f75-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848296, "uuid": "d8794369-cdd0-4e50-841f-3a730b5cb742", "comment": "Malware payload (Mirai)", "value": "22f94584a3e46ecfe93910bede6574f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848296, "uuid": "5469f200-006b-42d9-baf7-bd18770e314a", "comment": "Malware payload (Mirai)", "value": "7defbf222c8557ebf4d767efbb0a1682ae17127e282299ed2464f9b767cc4a55", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848296, "uuid": "5142d6d1-5cd9-4347-a121-90a83e192524", "comment": "Malware payload (Mirai)", "value": "4081930c2f527210777135263d5afce76eb4ec99", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848296, "uuid": "33feacdf-3dc7-45eb-a63b-bcc7660db462", "comment": "Malware payload (Mirai)", "value": "593167e9049cf00e9803c49b14d7abe20e866a759e606bb3feb4d474d20e708bfbdcbc859e46a27b07706c6b4efc2fbc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848296, "uuid": "538b352a-aa69-4374-88fd-8004c22a2efb", "value": "T1503301368A9617D4C02E06313F4B87DD7B68CFF06191E216962489448D6F1BB5DAEEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848296, "uuid": "1367557e-c874-4d85-aa78-8ad7a412928f", "value": "1536:INRtXYi7iE3Vrzgmfv0IrqFWEWnyrH6DRoIRzE9nDO:+r7L1cmX0DF5b6DR/RzEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848296, "uuid": "981eadc6-da71-4668-ab73-bd58aebb6fa0", "value": 50304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848296, "uuid": "06a22fdf-b6f4-4699-a7e4-25ba66eab5b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848296, "uuid": "714b5867-fbee-4d12-9498-7fe9d65a55dd", "value": "luxzz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485aeebc-3e22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776845238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845238, "uuid": "173bcf4a-7a48-4768-a9f2-c97075f3b925", "comment": "Malware payload", "value": "fbca612a6a6d93f2aba48dea7910969e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845238, "uuid": "047901f2-d83f-459f-9032-b4628d948046", "comment": "Malware payload", "value": "7e526353d2dc55f5941c2eb6fd325c5ca79e34622cfdcd2c67e1cfa0263359c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845238, "uuid": "f9f0acae-23fc-4981-9809-2783c0db2b86", "comment": "Malware payload", "value": "9a75dd53ead461d85c900e26bfa62e8cb1002737", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845238, "uuid": "35623d2a-71c5-4363-990d-07027fee9a40", "comment": "Malware payload", "value": "28b05bf6e0b9633e15953d344fb695c1ea119839d71032371f9c5d3a3978f170de5049b8c779ce16461f2d06c27e6a9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845238, "uuid": "dbfefc9e-f716-4f7a-a580-4a0689f095ba", "value": "T1ECA3C62B7B130E23C0C650B152E30632F9BADF5938BC4697B8A07D9D5F3998431567EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845238, "uuid": "61c13f12-ed17-457c-ac40-1834446a615e", "value": "768:hey3p7/2C8Co/ECjHJYs3xucOMxf/1OGP5hz2lnY0FpZteFaheO+Nfb5VRzU2ew9:Hp7i/F3hu1Y01t+aqND5wetXlPB3tsLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776845238, "uuid": "d17b65e2-d732-4440-9edd-f885648397ca", "value": 103268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776845238, "uuid": "086f394b-c4ca-4fbb-8f89-9c5a8a635ffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845238, "uuid": "32c71ac5-c7d5-4044-b846-ff6d20802f14", "value": "SPARC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c84cbcc-3e98-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895845, "uuid": "eae868cb-cf0d-4783-8411-fe3854af5dbc", "comment": "Malware payload", "value": "04d31db5ef14955ea7621d96e3e2e084", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895845, "uuid": "17588b72-68b8-4a40-9c77-09c664e1556b", "comment": "Malware payload", "value": "7e673da88b4d82ab020928ae02000a608cf820a5c3052bfca1a6e65099bd6630", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895845, "uuid": "dc7c28aa-fd6f-4559-8e92-aaf8322f2d17", "comment": "Malware payload", "value": "fd569a2fb447b01cb53c4f6f5084a2d4290a37fb", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895845, "uuid": "2639a16b-7882-4412-b842-b6f15fb4d522", "comment": "Malware payload", "value": "6816479daa2790d16116285afee9d05110b620a4901e35084b421be0843d125bd990338022bb60038f45abb6f8e8e575", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895845, "uuid": "6685a2a4-d24c-47d6-afe4-3490b9295b95", "value": "T18E94238777012EDAC317872FDEFC9B77CC421548CBB4B11A868AB652DE439A1BC625C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895845, "uuid": "be149ed7-e229-41ef-a125-f112cad256de", "value": "12288:NEAVmWhgYr1xcgHmKN0TBrp+JRx4zTk8K/k5StNU4LP2i11GAi:NmWhFroTH+Jkqk5ANUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895845, "uuid": "a83a2f22-723b-4a7c-a66c-12004b88ea54", "value": 434156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895845, "uuid": "ad2c89c9-10fe-4124-a2f7-e6173b12a47d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895845, "uuid": "e1f14643-2e8c-4ef5-bdbf-96b66c6d2983", "value": "49xb5hoiqsr.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2d0574-3e28-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectBack)", "timestamp": 1776847818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847818, "uuid": "a9d75da1-b2c6-45ad-b1a5-debe5413f7bd", "comment": "Malware payload (ConnectBack)", "value": "29e9ef27bcd8e56f0007533d1f8b6cbd", "object_relation": "md5", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847818, "uuid": "23abcc21-7953-4334-9601-4a193791faa8", "comment": "Malware payload (ConnectBack)", "value": "7e8535101461b828c2d12888ab01fe2ead504d19c2e14c141ef029346bfe86d5", "object_relation": "sha256", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847818, "uuid": "04e0f221-517c-483e-ae77-443a3ff41f43", "comment": "Malware payload (ConnectBack)", "value": "f03ae6c07fccf11bccea3b91aa7eb8814eb601b5", "object_relation": "sha1", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847818, "uuid": "6f83554d-bd95-454f-84ec-17c729bb5079", "comment": "Malware payload (ConnectBack)", "value": "f66016ba2a56a69d5b472d79aa3c6b3b0c30dacab4a20832c772645984725f351d8efc40860f81c70c567a7583a8285d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847818, "uuid": "5d02afda-7da7-45ae-96f2-02902bd93a23", "value": "T12AD080330F0F80DADAD4133F6574595CD77F89B65749623108A0DC010C496045F62C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847818, "uuid": "09adb5c5-7cd7-44eb-b8fd-0475187436a2", "value": "6:BnX//In8/r1uBxHocmTr8D9Q3RQdygg5XJYD:BvwncrAH3mHSq532D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776847818, "uuid": "94f8e003-c766-436b-89e8-e5473cce8fdd", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776847818, "uuid": "6e3f3daa-6079-4979-b6d9-1efe9f37fb50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847818, "uuid": "931e2ac6-46d3-4bb7-91e4-6f44426a7343", "value": "payload.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b286f4-3e8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776891616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891616, "uuid": "005e6ca6-c2a4-461a-a6e6-3b019f7a335b", "comment": "Malware payload", "value": "5ca2e77211c82fe4a70a0e260cedeabf", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891616, "uuid": "4e060102-5969-4464-b0e8-44279f555f27", "comment": "Malware payload", "value": "7e9a43686183b6cf6b9ac26c6c3de0176637799bf1b7ba348b31a7407cc3948a", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891616, "uuid": "7aa84684-8707-4c4f-8611-ae839c276d5b", "comment": "Malware payload", "value": "d28370845da990ce05ecf3ae368da097cd691d77", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891616, "uuid": "1de81ff4-60bc-4ea7-8023-8949a14b0f72", "comment": "Malware payload", "value": "54d4fd9b27575327885f86356e07231f87b00e4f2a903ba897bc4c036f4cc969b27a1e86168ad40f39b056951680f60a", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891616, "uuid": "75a838e9-34ce-4771-ac73-5a8ec74a5fc9", "value": "T116F46C31B5808837D92239F89C5A92E5942A7E202E25764B3AF53F4C5E395C3FD162CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891616, "uuid": "6b4a600e-908f-45c3-8ea5-9921e2e0367b", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891616, "uuid": "cd696783-8ba9-4c7a-a438-6e0d840be0b2", "value": "12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h+qMd0QZh/:KZ1xuVVjfFoynPaVBUR8f+kN10EBMD0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776891616, "uuid": "b8316040-8961-41d3-92ad-d276cfce28b2", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776891616, "uuid": "daf5088a-ac79-4ced-869c-3184d4f97ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891616, "uuid": "18960d5e-19fe-423f-b356-f913d5e5e431", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077729fc-3e74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880348, "uuid": "52f90043-b111-42e8-9a45-9db4285500ed", "comment": "Malware payload", "value": "3fc811a0bfebff319395a18a4051a705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880348, "uuid": "dfc5e244-6793-41bc-8a0a-b5ad400571cc", "comment": "Malware payload", "value": "7eda1844e95b1b87c08fca3a0bcdc1a9a1dc614724d65af6f9560f5fa2c60090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880348, "uuid": "9acb487b-b9df-4ffa-b9d5-eebff8d09dd7", "comment": "Malware payload", "value": "c448a015e558b09510dc27918695fbdd73107600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880348, "uuid": "a6a22972-9566-43be-ab25-7823c0e8bede", "comment": "Malware payload", "value": "f26bc715183a6a116888c2855630c8d8df2d35d79c0f18ef37e6bb769b93bcf82f6e081d46ec06d059a9102fc62394b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880348, "uuid": "c2a83954-807f-44d0-8f02-319eb5fbbea1", "value": "T1B475331A0520CF6ADC2F59B175378BA1A313AD5CBC8817DB2256BDAA7E327413EDD013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880348, "uuid": "8564f85c-7cd6-46e9-a009-d259ea1178f8", "value": "377cbbb5b52e6b71f4c4ec2ff9f040fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880348, "uuid": "c091b313-ba76-49fc-bcb7-2d89be8fcaf9", "value": "24576:VcRj/LXfr6sbSvkNEOY4h1ie//IRlIUlEK9BNOtboTQkEWr0/ra282vmod3E:VcRj7hbSMNgEZcQKGSj4M2vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880348, "uuid": "0a159e03-e12d-4861-bd06-9f87f1f699d1", "value": 1628104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880348, "uuid": "e1ab9322-0ad8-4126-b330-e272b9986870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880348, "uuid": "f9995f7c-6e61-4beb-af7f-d17ff86484fd", "value": "KUMP7TWS8H2FDTZ7D6C1PFO8G", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6008c973-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776876202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876202, "uuid": "d11286e7-5f26-495d-bf0b-2a45c050e39e", "comment": "Malware payload", "value": "ca2cbe73a776f393ff99c17da09b3eb0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876202, "uuid": "a33c5575-dfc4-4495-a195-4bb012d531b1", "comment": "Malware payload", "value": "7ee5047cbf8437269764e03f70646314c6c7ebd0feb97d796a79d5d956f7157a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876202, "uuid": "7ec77b51-07bb-40d3-ae18-fb020c03d247", "comment": "Malware payload", "value": "96dd814d185fe4ab83c6506dc9194af8c9abdebd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876202, "uuid": "f1dcfa3e-1242-4ba0-8373-43547c440e1f", "comment": "Malware payload", "value": "c77413fd1eb92af7278d2f35fbdba44b9f3d815ad6d77c3bc538f42d363a48074dcb033745e7dcb391d21c76b1f5ae19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876202, "uuid": "00a55bc5-7eb6-440f-855e-c353eb25a1d6", "value": "T1AA8180BA7591E032F6EDC43D3E64944D4C46809399AAFC05F48C3C88BFA9A48F568798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876202, "uuid": "66f03e17-fc1c-4631-92f9-fea2086215ac", "value": "96:HsKBiqTamLrDCkxwqyWuIRJxQRVKGiGJKuedMDHFBmXoXO1ejlqX:HsOHRaoMDH3yy/le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876202, "uuid": "25f28526-8181-4901-8d8a-cad7d2574ea2", "value": 4013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876202, "uuid": "5c0f0aeb-8660-4dac-9e76-0eb9778aa4a4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876202, "uuid": "ec2a90ea-1721-4d53-a00f-e875e4aa3741", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74668b7d-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848319, "uuid": "6fdb3fab-7870-4a58-b992-0d0f6998c19c", "comment": "Malware payload (Mirai)", "value": "03d322c0a2399136cb7c77a38499772a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848319, "uuid": "5a83b4d0-650b-4f8b-a84d-c1f6a33407e1", "comment": "Malware payload (Mirai)", "value": "7ef770d5ca72990e97b8c1d1d69b635b61675fd1430a2e298212d8d98b965e44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848319, "uuid": "89cedf5c-4b78-4c79-a131-ae499c2b372d", "comment": "Malware payload (Mirai)", "value": "05e41abc55ed48672de63ac4a38432b9aa28b6ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848319, "uuid": "1b44bcc8-3a67-4013-b8ea-8e4b105e4cd7", "comment": "Malware payload (Mirai)", "value": "0a88ed03b313ae4a6069406e7438be769cc4cc7a1cfc8d7fb34d247d8868bed8fbd73d314502c71193afd7bbdf79720f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848319, "uuid": "14933812-d620-4f49-ac88-5335602e8065", "value": "T1172302B9FA8084D2F730F43111750A1AE70F7FAAA121ECDBC06D2A77A4344BA6155E1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848319, "uuid": "9a34649b-998d-41cb-965e-197917d0c306", "value": "768:8NkGBVrBtliBtG7pcv3HJe2/FYXmeNejXHMbQCx1GhsXLiNN+E3gQv2lVVy/Mn1I:8NrrBniBteCPDFYWVjsvjX0HgJVyiT96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848319, "uuid": "765b2fc8-224d-4658-8602-1fc8027cef00", "value": 48360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848319, "uuid": "8f4d12c7-626d-419c-925d-c48a9605471d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848319, "uuid": "dbd5196c-b08f-4fd4-aeee-8458b06a3afa", "value": "luxzz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8087bf-3e9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897510, "uuid": "59c65651-8c55-4536-ac00-e65a484ac305", "comment": "Malware payload", "value": "6e01d49459681b715e9aaf82abab8b9b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897510, "uuid": "a530d39f-3651-4713-96f5-b2e03451cf6a", "comment": "Malware payload", "value": "80436626412f98ccbdb28b16467c40e647ee468ca76546de0f26690f25e3865b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897510, "uuid": "ba93a5a8-b055-4407-b4f6-fed7d1804caa", "comment": "Malware payload", "value": "e72e08f3450478b1d06af7e440f4e5586e075ce8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897510, "uuid": "27d40d93-d607-4458-b762-34b6253395bc", "comment": "Malware payload", "value": "c4267acfbd76402d6652e5d5e5bfe1f82ea7bac78d00766534ca1932724485dc6f5cd772d6786deb2b41b12eef882c7c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897510, "uuid": "d1996afd-df39-4e93-8e86-7c1ab3e0c734", "value": "T15BB2E123E0589910F486EF30654F9E77B54E0780ABA7773B38B04AAF2187F5DE649304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897510, "uuid": "09b8633f-71f7-4836-a64d-87b97289ba3d", "value": "384:I3w9gntFzfOcpmV4WOUeirUjsifybxqIl9x559jLj26Fc+yiHKk4Ck3BU/RhqAyo:i9n/DODJ9ejfyVr9359jn57KkxUUjyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897510, "uuid": "f426aa70-bfc4-4c7f-a7b4-43a99171e31a", "value": 25707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897510, "uuid": "a08c13bd-b112-4079-a1a3-d8ef10ed043a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897510, "uuid": "9320f933-2746-4dbd-a08f-fd2e69699d10", "value": "cigany-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516111cd-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895075, "uuid": "ec81d78f-708e-4608-bd33-d5b8f2720b10", "comment": "Malware payload", "value": "7ceccb978b0e6f44f739d021becf81c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895075, "uuid": "183263ea-fa75-4aa1-841d-17c4f0f41a8b", "comment": "Malware payload", "value": "8132030dc14004f2b63f29842a97fc7c8d73f7b7f495a87722fc2e3b2d0a7478", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895075, "uuid": "741a9009-6cf1-4d4d-b5d0-5e1052ec3678", "comment": "Malware payload", "value": "9878c7663f1d592fc98ba28dfbaadc2642a29af4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895075, "uuid": "27007997-df7d-4c2c-a0ff-43c2f62077f3", "comment": "Malware payload", "value": "ebf5b80f9e7cd210c6e186ef223075a41300f0fe64f2c79b5089b8e356f39021f8aec774d5558d18e57e237ecaaa0ce3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895075, "uuid": "afc0ee26-09d2-4b72-b0fb-c190ea2a2b31", "value": "T174666B45BC2D7462D6C975752F6202A43339BC049F82C7132A28BB7DE9F27588F637A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895075, "uuid": "049eaca6-49de-4801-93ab-6812497bcfe5", "value": "49152:5CQbo1RAr+MFdYuvn52KNPoQjyZ+NYrwA2NuzxxKssG8I0MlivTab6ix5EM:5CQU0r+MFtvn52KNPn2+N/wEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895075, "uuid": "f92b4db2-9cbb-4540-9352-44aa19a68ce3", "value": 7012536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895075, "uuid": "e0a34982-05bf-4ed8-952d-2cc9198eb400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895075, "uuid": "f264fddf-43f0-4517-b3e7-0be9b5470e56", "value": "h3flood.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18bfa38a-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877371, "uuid": "def7a1f9-dbc0-407b-a518-9c6645d354ff", "comment": "Malware payload (Mirai)", "value": "906665a43b49a7dc75f27c43e031b33b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877371, "uuid": "3a45eefb-1fb0-4471-b1a0-436118474670", "comment": "Malware payload (Mirai)", "value": "8269870e21e3c4ac68f20436da0bdea8909cdcd585ae7e160b24b701d6f1a5de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877371, "uuid": "6c770f63-50c8-4d6a-b949-5a5626a668f0", "comment": "Malware payload (Mirai)", "value": "98684e371353051901ecae3f4c3658bb3dd3e141", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877371, "uuid": "ad71f9d2-5f62-4526-8457-01f58e6d1dc0", "comment": "Malware payload (Mirai)", "value": "87afa826e77a04306a448f23ba7369392c2898fda04e95731fa07cb8b636ff004c82c8f844c91082f4f16b84275c8339", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877371, "uuid": "6c29ca2e-d7cb-43d1-9519-005bd8593f48", "value": "T1D3E33917B5C084FDC4DAD1784BAFB63AD932B1AE1238B15B27D4AA232D4DE305F1D990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877371, "uuid": "7edcb2b2-af62-465e-a369-e1efe5270ec7", "value": "3072:cLkqscJodu47GUiy/mj8ROVVXqVQWbH/ew+ZlZ2vin:cAqscJodu47G42sbfAD2an", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877371, "uuid": "b2886cb1-4c4f-489e-ba64-bb8869284925", "value": 155256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877371, "uuid": "c85daec0-e078-4d06-809c-d3944d931901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877371, "uuid": "2e9dfb9f-ca4b-4ca6-8201-97f4de32f339", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0993901c-3e38-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854582, "uuid": "9beaceec-ca32-49c5-9ab2-8f29a1d82c1f", "comment": "Malware payload", "value": "1514c3f22beb9db61ca965afe56f9f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854582, "uuid": "a2484e6c-9ed0-43fd-aaa9-35bebb034e0c", "comment": "Malware payload", "value": "82e1b88eed1fb8988bcb56488b941e3478cf7bf3d5a9c3a61e115735999f8876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854582, "uuid": "3c52c13b-59e1-4f97-adec-c1ba4323a31a", "comment": "Malware payload", "value": "7d583e41dae107adfa225097186f2a1096470564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854582, "uuid": "c710736b-4fc0-4615-82c1-53f9419201f2", "comment": "Malware payload", "value": "a8e7d6aa8f8539cbfd216b68d64032b1ff9d23de44bf4e494c528bd9ea440869bf249ecc0572db67a05884229ea09cae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854582, "uuid": "699859a3-d12f-4b1e-9e1d-6093e31faa41", "value": "T14F25BF83D293915CF41AC1715B2EA273F537BC458B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854582, "uuid": "d7d05f48-d040-425c-b228-02489d762f90", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854582, "uuid": "17f05f1c-28d1-4ed0-98d7-70c2bbfb8799", "value": "24576:1+pqv2T/OEe0JRh+w+HY5bkY5bBY5b1/:12TGEeiRhqYiYDYf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854582, "uuid": "28889de9-c590-4676-abd1-e4d0030d02b0", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854582, "uuid": "fbd23279-6847-4670-bbf3-4ac4f6545e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854582, "uuid": "aa0a3d9b-2bf3-4891-b413-2ad4649078ae", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a39587-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876178, "uuid": "1e1e4738-a708-4b90-9aec-cdae7dab2444", "comment": "Malware payload (Mirai)", "value": "09a630ba08d29085e9a927ab4bfe4e7f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876178, "uuid": "cb5c7825-47c9-4ccb-a930-78bc19d1a364", "comment": "Malware payload (Mirai)", "value": "8341b1ead69a1d5d342a13164d1623d4c30f9d3c39fbb6dea733e6b05699ca7c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876178, "uuid": "f1ab1b79-f2dd-4cac-91a9-8194439ddecf", "comment": "Malware payload (Mirai)", "value": "2223c0a38f536ca2b2d43b123d7c2c44d6f7eaf5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876178, "uuid": "f33afe69-704b-4421-a2e5-9bab6df145dc", "comment": "Malware payload (Mirai)", "value": "8f9ab7420d0d22b0b18e6ea66f6804c27f1afe2d05bb817343c1219a4b6087ef6f12a67fe72ed9525aee453d4b9899a2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876178, "uuid": "6ab13839-bd05-4d12-b5d1-da3a9f778b92", "value": "T193B2C0BEDD848541C2FEEC7ADCAF2B719D49A2C9E2D44F4693109D8C178249B698C0D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876178, "uuid": "945e450d-928b-4f90-829a-6c5a4efc9fb3", "value": "384:ThPaByX8us+j+sDmToURNczG4AoJstB8sqRg8eIZxQktgZbBm3dGVW7bDRWGVCzp:9Paqs+asDm5nTPnBnhktKSdKW1WTNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876178, "uuid": "debd3e7b-78a1-4fe2-b384-d2d1bfe1a8fa", "value": 24220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876178, "uuid": "247c45a4-d738-424e-8afc-a9843908489b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876178, "uuid": "4981d25d-80b4-442b-a88b-51dab51ccde3", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc9a4ca-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888677, "uuid": "e91ffd1a-38b3-47c1-aea3-d9ed2b0ea8c2", "comment": "Malware payload (Gafgyt)", "value": "a36b56823f264847c260d27b1a7b24ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888677, "uuid": "a26d0a0f-d212-4e3e-93f2-c30203f703d8", "comment": "Malware payload (Gafgyt)", "value": "846e22b461fc3a1c36bdca43eb22de12e5b5ac4d0df6860582ffe4195b161fc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888677, "uuid": "a8c8f45e-f5f3-4eb3-8958-5b5f3fc70b10", "comment": "Malware payload (Gafgyt)", "value": "0e865dcacb208a22c5888fd732ccf4fc25662286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888677, "uuid": "7522e44c-106f-41a0-9c87-f2c444b26e8a", "comment": "Malware payload (Gafgyt)", "value": "3cada2524887641e8da475afe4bb26c860234ecdd156fe6db442cc62fbce7be4e5f958da9c2cf586f2dce02bfdd144a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888677, "uuid": "e437c953-0c33-4244-a63c-763014866913", "value": "T1C8832B43E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A313CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888677, "uuid": "764a92df-5cf2-43aa-93e2-9c2902d3dfd9", "value": "1536:ClNtAyOXSU3rUk954CKmg0KfjyJCjujEaX9LmkxVqOEeofzee:gbOXSU3rUkmmbJA94LmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888677, "uuid": "367a3b32-4fbb-4f73-b2bf-8dde107bcafb", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888677, "uuid": "0505976b-59f6-4fbf-ae5a-1b95e450888e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888677, "uuid": "66686122-541b-4769-81bc-505aa5e571a7", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788c3d0d-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884403, "uuid": "263e14e0-3c95-4d93-882a-fea201e99e95", "comment": "Malware payload", "value": "2682718f9ad75aa6831b32cb195c3cd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884403, "uuid": "c16685d2-57e1-4c20-a7f6-0e5a091c3273", "comment": "Malware payload", "value": "84868df86b28156c47013c151c0cada4577e39fa224f064f17dca91631a3bef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884403, "uuid": "80fef8e1-34ad-4696-a5f0-6570e077c644", "comment": "Malware payload", "value": "b288281504b23e6803c6ccf4a7e05c017199bee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884403, "uuid": "0dd2ebe3-78f2-4d75-8652-2cabca89d638", "comment": "Malware payload", "value": "f04aa6855595c76d9f2a37ee4462cfb91f9702aa67ddcf5755c1ebee842390c75e0c94a77e0df7c3901a05ad75f1705c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884403, "uuid": "783d7e9d-a589-4507-acd5-561110a003a3", "value": "T189350152BA295F17CC964279C497C234637BF0818B82B303B548E6797C4736D8F1EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884403, "uuid": "3e8fe591-3bda-4f23-8ba2-3965cf031d1e", "value": "24576:l0tqcI4qN/1sfElJokJ56nrGn+lANswBzyAdCWn9gvzvqjZAF4mWZ:aiN9kiUyn+spyAdrGTqlAPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884403, "uuid": "0c226f13-9b72-4ae0-88d2-89b602ba8a3c", "value": 1074006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884403, "uuid": "59a4cef2-9983-4618-b65f-aca413495fe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884403, "uuid": "58bbbee8-89a0-48fc-8672-982aab523312", "value": "bot.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528c3c13-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874032, "uuid": "ed4fe089-fc55-4dc4-946f-fe001008f6e5", "comment": "Malware payload (Mirai)", "value": "b9d5ecba445ff37df2770a870181baba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874032, "uuid": "2a69d73a-e259-475c-8fc9-e5806e32b10b", "comment": "Malware payload (Mirai)", "value": "85164fea465e06401fe7441a11df99c229f4c37d3fd80050e906532f80df9fd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874032, "uuid": "f0c2ce79-9a8d-4c0f-8b9f-f0b4c191aac7", "comment": "Malware payload (Mirai)", "value": "d95c4d51673e964634865087a0f5bfb698ddaf92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874032, "uuid": "3e83afe9-ad65-40ba-80cb-f38e3793bcc7", "comment": "Malware payload (Mirai)", "value": "1de27378eea9fc46e0852dc0a06a8a812b1ad73deb2636a9ac2ccfefe636728223cb35ac81049b6f6c109709dc93ce52", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874032, "uuid": "b16673f1-d59a-4ade-b96e-dae1710f1347", "value": "T184B56C43E683C0F1EA1206F11117F77799399A190136C9A3EF98AD29AE71742E71E37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874032, "uuid": "8c218d3b-7db6-44a4-9629-0e0e00efc6f8", "value": "49152:mwW6AxqDFU3s/MzrKLvQEMbMmeHWbhOpIkV5L:1AKUCVMa9pI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874032, "uuid": "8a4a54f0-5b1d-474e-bd35-bf297c174d50", "value": 2411388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874032, "uuid": "a8a2469a-e53c-454a-b7c6-23f67dec86aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874032, "uuid": "12dfefc0-cfb0-468a-9a15-16ae74eb1411", "value": "ciubuc_i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16ccec2-3e95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894914, "uuid": "00f6344d-3f6b-4cc6-a9c7-5651e8ff80aa", "comment": "Malware payload", "value": "080c67ef949573321c7ce42442f4d4c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894914, "uuid": "cbaaf61f-412b-447a-92bb-4368b0c59833", "comment": "Malware payload", "value": "85a1a157d26e615e0ad221a962ab7cbdadb3aaa21d1ec0894d112a11b91aab95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894914, "uuid": "cc73cb08-f4d6-4401-b78e-cdb45b577ad2", "comment": "Malware payload", "value": "7272638e09285bcb3873a1a82fc311c3dd816ce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894914, "uuid": "41ef6b3a-25dd-494b-9401-9766f5ac8e62", "comment": "Malware payload", "value": "f8dd36c9c14121d86c73f9a3bd255a6d26abb478710d15633108ca824b67473a6e9018732739771994345a0bb7f65062", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894914, "uuid": "6ffc7099-2fb7-4e99-8c62-17a58dd09632", "value": "T16A465C96BC5DA462D6C976742F6612D53339BC448F82C3232A24B73DFAF635C8F12261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894914, "uuid": "6b6ad095-ba5a-421b-be34-6167642e67bf", "value": "49152:830hbX0/kBX2kxIAH4Ws5AErE3kW7Z149qe+Yu62VjdqW0CuDye5Ef:83KIW4Ws5ZE3kKZ14f+YYn0Ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894914, "uuid": "61f71d1e-e9ac-416b-b307-846def6b624d", "value": 5767352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894914, "uuid": "b775fec8-21f2-498d-86e3-45acc563499f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894914, "uuid": "960dc09a-bf3f-492b-b6a5-aab9dd91b0ee", "value": "h2stream.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e515a67-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882239, "uuid": "9a826fcb-cc8f-4756-aee7-524027166282", "comment": "Malware payload (Mirai)", "value": "c3e0983266c7a822344149e21f731ae0", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882239, "uuid": "5d28772c-7e03-42f6-b887-c38fe1ebdd32", "comment": "Malware payload (Mirai)", "value": "85aa75f81407928f1b6df3781f328fd996c4e4fb2cfc298a41e917052df3b650", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882239, "uuid": "aa8419f6-5445-4166-afc9-e5c310e764bc", "comment": "Malware payload (Mirai)", "value": "4ac720e495bf7cbe9d93a23ec8cac6ef2bf5fea9", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882239, "uuid": "361c7a5b-0482-4da7-9847-981bf22cfad4", "comment": "Malware payload (Mirai)", "value": "bd337c3be957e10f3bbaab91cb476a92feb4511d85e08fec19fe498f7980bcee685a98c5dd7c8dca7dced3c408696722", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882239, "uuid": "94c370f3-8c5a-4f4f-be8e-1db99ea7f01c", "value": "T1B505F1D9F79A2C46C4DBD53A504AC2819656EC6B73F393483E43A5BB34AD3714F2830A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882239, "uuid": "b553892d-caef-450a-a12b-1cdb6c1f22ff", "value": "12288:ZdbvYo+VQgW35WgKu3CkEOm0/8UEoYmZ4/zUWoeXIZyGUaZrW4RzqIfpgpiLEjkX:Z9co5WQPEkYt7UWomIZybOdMc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882239, "uuid": "ffc1ef03-46de-41fa-b6a8-730db590ec76", "value": 859892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882239, "uuid": "2eee4c12-a2dc-4dd9-855a-cfcefdafd1ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882239, "uuid": "f68b1c93-4b45-4b06-81b9-06b4b0633620", "value": "bot_armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0123ae39-3e20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776844260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844260, "uuid": "a687d126-b14b-41bc-bffe-ee36e470f09c", "comment": "Malware payload", "value": "147c8ba94bf2137560b2268b6550ef16", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844260, "uuid": "f747f5e5-b352-4e5b-bac4-acae9824745a", "comment": "Malware payload", "value": "868a626620230c65c0fe1833b54220db90333a498c81097f695584cac501ebf7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844260, "uuid": "d104b9cc-b855-4350-ad85-3207afa937c8", "comment": "Malware payload", "value": "22fd91a92794ae70308ae50a76a39bbb28a22140", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844260, "uuid": "f7612387-3fc8-47a5-9525-1e81711cccc5", "comment": "Malware payload", "value": "411fecac3b3537704b408bff56e2d12c594da1d30191eb202138fb11796f673bc41b95f62e1ba8636df302dba7644f53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844260, "uuid": "fa0cc52c-c507-43b3-9997-f3444cfafa0b", "value": "T124E309DF1A799D2CCE606A677A106DC0AF1738938C17C568B34C502732A9E9F3617DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844260, "uuid": "44025be1-1046-4744-a300-53bb51de4e7d", "value": "192:ugXc8m+N7ZpkcGMOCgpTvEHOJEtnM4ZO7B:/s/+Tu1wuJEO4QB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776844260, "uuid": "2657bfcc-4fbc-452d-94c9-501dcf2ab73d", "value": 153005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776844260, "uuid": "b28d5faa-a596-49ac-b315-ca1889e90c3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844260, "uuid": "f5448686-061a-4094-bad2-63f48925f41e", "value": "win64.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181ee59d-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875652, "uuid": "46563de2-bd3c-443d-92db-ff21551eb91e", "comment": "Malware payload", "value": "853ef8397e8fec6611e80bb0872c51ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875652, "uuid": "a6de3fae-6d40-4aab-9842-1eab712b1025", "comment": "Malware payload", "value": "8781ce07a4b94e71a205561c2f7523eebdfb12e9afcd56882b8736cb58499f72", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875652, "uuid": "3e0eb4f2-fba4-4f45-8672-e8445a982441", "comment": "Malware payload", "value": "1d08e55dacff01c9106282cde6fff57a9e626f5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875652, "uuid": "7e675b19-6045-415a-a6f6-7939ea054630", "comment": "Malware payload", "value": "dd4bc33d1cf86e8d39e3e8333d61d501d828e4c78e0ec082ce1cc42d02a3c994c6353719a5537d1ddf13f93267cbb9ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875652, "uuid": "cb7ba287-caf4-4511-a924-1aee4ac16846", "value": "T163A66B47B8924952C5E42A37BCBE81C433634EB98BC727576D04EE3C7ABE1990E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875652, "uuid": "4475e9f4-dec8-413c-9881-55f72db529d2", "value": "196608:scg2aGnzQP52/6g/3cEfqG5vLCqj4w+WWnb:/02/6g/3c0qGxWqj3lWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875652, "uuid": "7c3736df-5c1a-4c4c-84cf-f71dfa126a43", "value": 10205219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875652, "uuid": "4cd1d261-0bb7-4a02-80f4-f6feba86e598", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875652, "uuid": "3ce10e69-bdeb-464a-b0a8-79019ca0940c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63de1148-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876638, "uuid": "58f0754b-d928-46d4-8333-2184efee5a67", "comment": "Malware payload (Mirai)", "value": "dec02072c5aff0059c975c3407e2b72f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876638, "uuid": "8f80c5c0-af5c-45d0-97d3-f9c532bed8be", "comment": "Malware payload (Mirai)", "value": "87ce108741391ab4a2bd676df5eba1b026b763502a2158a58b9b6d6606f8d653", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876638, "uuid": "d7d9c8bb-df57-4bcf-81a2-a52079a7b579", "comment": "Malware payload (Mirai)", "value": "e3d69b922934406e043c8ced8129a75e68294223", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876638, "uuid": "3d4562d0-b69f-4688-9fef-6368c4ac21cd", "comment": "Malware payload (Mirai)", "value": "0aaf265a061e7641dc4f10b7ed766fc770a91e9a250582b5431a184563740e073703f04919352bf03d9216f53903f682", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876638, "uuid": "468ac640-cae2-4dea-aa02-6878ae396157", "value": "T137834BD7F410DDBDF80ED77B4463490AB131A39219831F3A639BB967BC321943966E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876638, "uuid": "f741e936-c1ce-4bf7-9049-5ed156de9601", "value": "1536:mEOAoGHPYj5HqZWaDX+aZ8oyCsFTNHFFaWonzs6N2uAQJSYh2a4rsvg:mEOAZHPqqcaDX+aTyCsFJiW6zsKAYh2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876638, "uuid": "8596e92c-1e7b-4688-b9a3-cc35bccc6b05", "value": 85804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876638, "uuid": "a1c18044-4ec4-489d-899c-77bba9b64320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876638, "uuid": "5ee7734d-7645-40f2-a8ea-aacb1af00f37", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf21411-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848333, "uuid": "c0a04ea3-4368-4aff-8479-5048f2032e9f", "comment": "Malware payload (Mirai)", "value": "9753a668cbdd16ae64ddc5d13a9cbfe3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848333, "uuid": "026ac8b1-aa43-47c4-935e-768d5501477b", "comment": "Malware payload (Mirai)", "value": "88220667d4473761f6dd8cbb470995ac610616c11c45aad5541833142d547adc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848333, "uuid": "b8572123-ecd8-42d7-9da1-fa1e27c40fa8", "comment": "Malware payload (Mirai)", "value": "9efa8061cbdc8422aae2177195a4272bfade1926", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848333, "uuid": "626a87c9-6e6b-40e2-b1cc-a11a92a927ef", "comment": "Malware payload (Mirai)", "value": "386d3b4a6dc2e8553148d3fbc9ce7ede63fbac67aa6765076d64e5203a28598df610216868d7dd3a999bd57518a040a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848333, "uuid": "0037a0a9-aec3-4369-9e5c-95d5c28bee35", "value": "T14A13F167CF185A2ACFE002B442240711665E5C1C92AAA5FF510D6AEED3701EFDB9891E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848333, "uuid": "3e2bc698-7eea-4295-b823-eb74d7688e8f", "value": "768:lir6qZ28q1OUvoniI2jVzH/fCWY6oMDmgVMjuZFG+rN7RK264kALZqHtnh+4F+Hx:lirA82O7np2F+6oGNG6N716zAtAJF+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848333, "uuid": "49a1eef2-3c1b-4177-acee-b00423a368b8", "value": 44428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848333, "uuid": "b6c6f665-471c-4849-8a01-318dd6685c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848333, "uuid": "91aca47a-76c5-4ba6-99de-1ea1d03f24ec", "value": "luxzz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12da7a44-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877361, "uuid": "9e825b3e-73ea-4c81-a8db-40e185aef949", "comment": "Malware payload (Mirai)", "value": "308da2a9356e221db66ad96dd5d17a33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877361, "uuid": "46baa908-ca33-464e-a3b1-5a2d54baf7a8", "comment": "Malware payload (Mirai)", "value": "8833200bc00ded45694879cadb3e358e5f145a3bfebd5f2b7d775e2fa760970e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877361, "uuid": "a77a33bb-7580-49d9-9fe8-e8cb5dfebb7c", "comment": "Malware payload (Mirai)", "value": "1778e13b2652dcc8f953ac9227b956f6a4a44453", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877361, "uuid": "23c0d808-b8de-40b1-a3af-9c259fdefe5a", "comment": "Malware payload (Mirai)", "value": "532b09053affbf9d5b78c58e5906bda2c07963092d6362fc9e2fd5dd7d67d99e5993c618aa2e3bbe570f23431560bf9f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877361, "uuid": "a09945c3-958e-4114-a84c-bdf95d512b5b", "value": "T115D37C73C829AF98C555D1B4B4348FB82B23A590428B5FFA19A7C2B44043EDDF509BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877361, "uuid": "bf5c65e5-e4b6-426e-9f05-499208ac007b", "value": "3072:RGfMR3jSlZe0tDxIfAQDg1GJLHmWBr+45lMu:RbRTiDxIfxqgzBleu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877361, "uuid": "c4b63d32-2ca7-4d3a-9d7e-89f5f42a429c", "value": 133952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877361, "uuid": "e1cd50f7-c4e4-4062-af4f-a0cdd2d0bf4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877361, "uuid": "7232d94b-fb13-4b76-8ea7-3fdf2788012f", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49568c0-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821905, "uuid": "d0760057-8006-49dc-9781-defb5d6de8b5", "comment": "Malware payload (Mirai)", "value": "258e08c56ed3def70c3ea46a3f3371b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821905, "uuid": "9431841e-da7e-4005-b843-970fdc5682c8", "comment": "Malware payload (Mirai)", "value": "88a9202da70c255a5bbe28eac3607c6a39ae6b3a657a5e6b200871fc82ee7681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821905, "uuid": "1258c829-1509-4dd5-a000-145fd9918f91", "comment": "Malware payload (Mirai)", "value": "630e9b5098735fa50a0f53fa99805dbc2ec698f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821905, "uuid": "74ab1249-0b41-47d1-be44-98103824228e", "comment": "Malware payload (Mirai)", "value": "454315d094b3a4ac11b0b7fcbd8e5b48da8c70932117fb4ab405af958f9d96fe7a3f00d075452c011c3b7f5799b31303", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821905, "uuid": "e9cde0e1-86f1-49d7-8df1-e2b0b85dc31e", "value": "T17A438D36C47F6C98C1484678A8254A746F63F50C81A3FEFA5A8187A59007FBCF6583F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821905, "uuid": "dffbfc64-fd8f-4c9e-9c63-9116d8c7c2cb", "value": "1536:y9Hn7a+9GwtZIQwmMudqtT3Z/NvPQCNRd42+:y9H7a+gaVqVZFvPQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821905, "uuid": "c79514fd-aebb-4609-bcc2-724780b1fdfc", "value": 55564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821905, "uuid": "1a42c875-ea4e-497e-bede-0ed9c96089d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821905, "uuid": "47a38ee1-7cdb-4957-a40d-5175749acbf6", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d4ea00-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876644, "uuid": "50ae4837-6116-41b4-be6d-26e9dd36ae34", "comment": "Malware payload (Mirai)", "value": "92a0c74410fe058677418beea5a98892", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876644, "uuid": "a30b12e6-d756-4c16-9372-ecfd07c0d1f5", "comment": "Malware payload (Mirai)", "value": "88eaad363a3e1f7df66bddbb4ea59c1c6dbd85de734f1bfd43c6eb94866f862b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876644, "uuid": "3a3fe19d-bc3d-4fea-9cf2-7cc502c1827d", "comment": "Malware payload (Mirai)", "value": "ca89c315f7633687ee0ee4f5252991a7ca873ed0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876644, "uuid": "4ab5f53f-621c-4833-83a5-0c2cf1603b39", "comment": "Malware payload (Mirai)", "value": "a3f20aa60282f26b39d1afdac829f7644df2e4409a325834d00544e250cbc42bc4a17d146652b72d2e3dff0aa52c6aa0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876644, "uuid": "ea103d76-0a3b-419b-bec3-bfe45dd5bfbc", "value": "T11F639EB3C9393E94D25541B4B830CA795B53B48481871FFA5A98C6FA4047EBCFA093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876644, "uuid": "d77af4f9-2529-4b10-8c33-0b2da83d0e57", "value": "1536:sa9wtr82FLQgB93HK9QATGRuzuCy2KNdwq61d6o:sib25QgD3q9sRuzu44q7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876644, "uuid": "a890ce9c-165f-48b8-875b-90db3cdf9bcc", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876644, "uuid": "8892068e-69ba-4b37-86bf-9d8c79479aa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876644, "uuid": "45076b86-38e3-4b28-a010-a42c56a1f37f", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482456bf-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877021, "uuid": "86b9fb41-f40b-48e6-ba24-6d348cce9651", "comment": "Malware payload (Mirai)", "value": "43d6cde6f45b590a766fd07bb8b5fb1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877021, "uuid": "f0a5c82c-1c41-4368-8145-672c17d93144", "comment": "Malware payload (Mirai)", "value": "8975c11105d4bc54f03b37f347f677f94fcb509ad621978dd686bbad3fd788f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877021, "uuid": "97783245-6824-4500-9c14-1bf2e06c2595", "comment": "Malware payload (Mirai)", "value": "2bf554bb50c6c11d6f15a71d9a5b77ade4cab055", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877021, "uuid": "ddb98a3e-1cb2-4419-8dd3-d3fb00f5266b", "comment": "Malware payload (Mirai)", "value": "1bef4808039a2f973aaa3939c24eb5adf5e2629262feaea6b273fd76d5a00299a70155a9e846d74f3812f1e68d6bda93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877021, "uuid": "f2498b62-53a1-4723-886c-3f4595dec271", "value": "T186732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877021, "uuid": "f76f33eb-5caf-4078-8a24-8889b9f1b6e8", "value": "1536:86dz9MTC0XU66Eeqpz5brAMjztPz+Sbjt+UvAs/hY:86dS6ELvrAMNb+AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877021, "uuid": "6633404d-ff42-4ef4-85ff-0c92aa7443db", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877021, "uuid": "9b43a9c1-263e-4484-9eb6-889af9ffa16c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877021, "uuid": "9b606c25-81f3-4d7f-9002-231fe16de435", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4def7b90-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874024, "uuid": "2fe9a222-eed0-4e21-a2a7-82f2fa19271f", "comment": "Malware payload (Mirai)", "value": "a1b9214fe3e8f7bbce39cf24e2ce664f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874024, "uuid": "98e4b091-ac5e-43c1-a456-d26a9a70e5d9", "comment": "Malware payload (Mirai)", "value": "89828007d33066d1b3cae71ade5ca83e86b63aa756ef43de07f62e3080452d98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874024, "uuid": "71b05179-e6e9-4c34-8970-b4d8a4a7a8d6", "comment": "Malware payload (Mirai)", "value": "a901d070fd8524d43ac12b90d2cee9ad281f90e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874024, "uuid": "c545d281-4349-4d13-b6a1-448bf03e9caf", "comment": "Malware payload (Mirai)", "value": "71b84d98f64d45d6d85a30127160a1ae009b7a71e52766b33c0be8ff230f96ad683993cafe8a3140a85bf2f6049e1393", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874024, "uuid": "61d12da1-1ba4-4e8f-a0c5-0117e442fb3b", "value": "T17DB55B41FD51AA56C6E0A6BAFB7EC28C33272BB9C3EE30174D044734779A95A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874024, "uuid": "bab809a6-847d-4c80-811e-2dbab1b44ba6", "value": "24576:feK2g5V354F4MEXviHzp4dvY3HnB2FBXcEzDi5afeWnnW4x7L/C6CsgmplvoupWg:feKvMBzCdQ3I8EzyEW41LqlupWvPleb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874024, "uuid": "0fcfefa8-9299-4f3b-a915-149a8a683318", "value": 2494268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874024, "uuid": "b863e4c5-49c6-485c-9885-555d02e28eef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874024, "uuid": "153133f9-52b9-4fec-bd73-4306024d8a6e", "value": "ciubuc_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9671112-3e14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776839496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839496, "uuid": "057ecbf4-a335-42f3-81ed-27065ea04137", "comment": "Malware payload", "value": "b4200911ad8efa8c98343ec2b1a32182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839496, "uuid": "6b787941-c47b-42d1-82d2-2f422cabe8d3", "comment": "Malware payload", "value": "89c763bf31f1bd2e9e78007843b56fa2be59e49988f5fbcd64411688ea6efb3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839496, "uuid": "1a6a92f9-ce0d-4b9f-9f68-fc7f72821ff2", "comment": "Malware payload", "value": "1623c30233766df6dc2e1d41f877149900fe0d37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839496, "uuid": "4124904e-0e4f-46d4-b582-d360e0183f12", "comment": "Malware payload", "value": "b49b970861298694a52eded4dc9d7e648903d00ff567bad4c9dd10b58982f20a56817f2d23a3ef6a5f20877a0699947f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839496, "uuid": "2ab41511-376f-4a7d-8297-3ffe13416a88", "value": "T1A4C25C2DA6A6D3A5DED58AF5F4290737FEE0B0816170031F4720C67E6F17522A91BF0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839496, "uuid": "dbd62e6a-01be-4f4c-a6fe-f1398194ed87", "value": "cb12d737f70331a45875da1d1aea73f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839496, "uuid": "7a919d13-5996-44ac-9da6-fe3e63ca6838", "value": "384:IGp1rKgcnmECj4gNEUmzz6OJNC1wOqNXgZtiAOq2rJr5YJlweNBL5pABHC:ZCbnmEC0gNEUi6+CqR5utiprtiJa6BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839496, "uuid": "bb299d77-4af4-469d-8093-6b27c0b06f1a", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839496, "uuid": "d8b92061-f2ed-492b-9050-8d3891bdc2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839496, "uuid": "40580c8f-bea2-4a52-b868-f30190078e14", "value": "SecuriteInfo.com.Variant.Application.Barys.69539.23496.10255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7e3030-3e63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776873409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873409, "uuid": "979181f1-e0e8-48a2-8a92-fd269701ec46", "comment": "Malware payload", "value": "ca1ab528cb520961438b42b72ab5606b", "object_relation": "md5", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Patch", "colour": "#731766", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873409, "uuid": "7fb154f7-02a5-4919-b07e-93c6cfb681d8", "comment": "Malware payload", "value": "89e382df6016199cbee7bd8732b517b36e2e9b0d3efc54e766d3485b67a46646", "object_relation": "sha256", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Patch", "colour": "#731766", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873409, "uuid": "c3113dfc-5e0f-42ec-af2b-1ce771b8375b", "comment": "Malware payload", "value": "0c261eed0aa5581cfe74053049427f6db3a6e872", "object_relation": "sha1", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Patch", "colour": "#731766", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873409, "uuid": "dfdebd16-1b4d-4d62-9b4d-c928649482b7", "comment": "Malware payload", "value": "3e96c271209d2caad408d274ef79e815c4dcf972935192a1590b0b883d833fe1c7059705a48f0b5acb7e9978cf3a32e7", "object_relation": "sha3-384", "Tag": [ { "name": "AmsiETWPatch", "colour": "#EB2226", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "Patch", "colour": "#731766", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873409, "uuid": "28c6264b-ca01-4e8a-ab77-448d95f818cf", "value": "T1521833063681ADBEC49695736114C1A4F670BCE43ABAB8E9C979BF4F38875C4E34D831", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873409, "uuid": "5a4a031b-6c6e-4534-a3fe-74eebaa75516", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873409, "uuid": "1ecab4ad-c047-4ca2-b4f0-bcdf79e485ae", "value": "1572864:jQ20ub1y5lGWK9Yd9KIlW7M/5c4KdmnisAdIa6bDZGBjogKQgCTsyADZo:jXZy5l9K7pndmisAdabes/CTsD9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873409, "uuid": "e2766036-0f2d-4eda-a5e9-08613cc7b890", "value": 92020236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873409, "uuid": "1ff30f00-e7f2-43ce-9c08-603b92d5c16b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873409, "uuid": "be7067ae-8124-4d2b-9c66-9f8461068a6b", "value": "ldpl\u0447ayer9_ld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7d5e8c-3e28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776847879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847879, "uuid": "46ad79d7-9720-469a-959f-637147e93acc", "comment": "Malware payload", "value": "d0173bbf41329a6ece837b0bab4c7a5d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847879, "uuid": "93a75bd9-dbf5-4205-8509-b211f83d2a0d", "comment": "Malware payload", "value": "8b5a24a04aa630c9b886ff384fea25727e44f111544b642a0e7298cdc13a07b5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847879, "uuid": "3fe9166a-580b-40c8-aa53-993fec39a16a", "comment": "Malware payload", "value": "705f3502b0641cf9ff213ad012786c1137f055b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847879, "uuid": "13fc7cb0-f936-410b-a439-30c76bde3ed1", "comment": "Malware payload", "value": "d008af6bfd21d6b31e62f8b44dff1a8830b0645ee8ed65dc20a4d0a03b406c52568d56d72475062d014e32ae0b2ab91f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847879, "uuid": "49a597ec-b75f-43d6-8984-fad34ce4c57d", "value": "T1B073BF47E9C81462C162217E57313EBAAA74F1BA3605C2EE7A4CDDF1DFC19B062163C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847879, "uuid": "d9ab9128-07bd-4bf0-941d-ccc003bde372", "value": "fb6bd8ebf4e6421b53c55dfe7d3c43af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847879, "uuid": "167e7967-0bb2-4381-8268-b1c7f12bec76", "value": "1536:I5K9dFRKwgNUxos7xacNVpAn/sbof2RUDMb+KR0Nc8QsJq39:HtKsZ78cNgnwofdDe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776847879, "uuid": "f7992e8d-5988-41cd-8784-880b8daf45ec", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776847879, "uuid": "f644c80a-995e-463d-9821-639541337382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847879, "uuid": "39c0787b-15fb-4e2f-81cc-8807928d9e11", "value": "payload_exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3114abb3-3e59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776868822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868822, "uuid": "ed70ebb1-1043-4e14-b2cd-d76e2fe4ec6a", "comment": "Malware payload", "value": "3adeb1a915fa01518aa7e1577eebe75f", "object_relation": "md5", "Tag": [ { "name": "107-173-143-107", "colour": "#5BDDE5", "exportable": true, "hide_tag": false }, { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868822, "uuid": "7894e31a-ba74-4f25-9699-eda4844d5e23", "comment": "Malware payload", "value": "8c4758e6736950e0bf0d80bfd10ca9eba5a9756227a9f2797ebacbf22ff2e076", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-107", "colour": "#5BDDE5", "exportable": true, "hide_tag": false }, { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868822, "uuid": "2a74b8d8-e1cc-4037-86a8-60f7f055f0b5", "comment": "Malware payload", "value": "ca8b241c5f2f2eef87057a564279a6d4f6c4f12c", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-107", "colour": "#5BDDE5", "exportable": true, "hide_tag": false }, { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868822, "uuid": "354f1b24-292a-437f-850a-e0945da1256b", "comment": "Malware payload", "value": "1bba131b41f2779e76b5617e1ae0368cfa44c51885d12779cfc1d5ade8d4ca39110c15fc47120ce1e8acce78e9fc80ca", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-107", "colour": "#5BDDE5", "exportable": true, "hide_tag": false }, { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868822, "uuid": "7c0f8c79-9547-400f-9aaa-4a17a11bfb2f", "value": "T162E2C88A3DDAF492272270B3291FB057A53C6C80760CD561FEE5F0BDB864728D467A78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868822, "uuid": "4af00aeb-2968-4f3d-ae84-38095b5ce83c", "value": "768:KNbNLFZ3caaE3L9PFE68VR7cdmyP7EVDJ7wvvDWex6oTR:KNpb/gxWmyDwDVwvvDWexHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776868822, "uuid": "cf95b70b-5ed9-4ad3-84d5-e63e3b5cb647", "value": 31618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776868822, "uuid": "23dc22a3-df4c-4070-afad-a7520491bdf3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868822, "uuid": "3eaf3a89-ed3a-40e1-86d3-4ac12c90ce75", "value": "Order List.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1930e229-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876942, "uuid": "da9d29cc-5f41-4e73-b90c-840988c75f43", "comment": "Malware payload (Mirai)", "value": "66950571c6036b074e3699ab62acfa58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876942, "uuid": "2a0ad7f4-6a87-4cc0-8f58-7a2e31e2bbdb", "comment": "Malware payload (Mirai)", "value": "8d148a59fb5d1b2a4413b87620f7b757a090b7036c4d947220870dc96842fddf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876942, "uuid": "a5fe4605-519e-40fe-87d8-0c0850b539c0", "comment": "Malware payload (Mirai)", "value": "92b440fefba59c83a84a910ce8481b6fae3819b5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876942, "uuid": "995c515a-9576-4048-a053-f757d5984a4c", "comment": "Malware payload (Mirai)", "value": "812b3da846ad6dfb8f12e33d57dea76ca6d06e0622546ff90a0d6bd31d9cadfea000025f1e6b69249913ea6d7be6f7d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876942, "uuid": "10ad112f-ce7e-4eb0-ac0d-a8e46f422e0f", "value": "T178832A97F400EDBDF80AD77B4453490AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876942, "uuid": "a88baee8-9028-43f2-824c-6922c6d1df31", "value": "1536:quKG91y47gWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTDxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876942, "uuid": "27a6f770-adc9-48f8-8a6a-a34936cdade1", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876942, "uuid": "4d139764-2785-4cee-984c-9d237f4da596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876942, "uuid": "8827108f-cc3f-420c-9bac-e97d49224b1d", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b88803e-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882288, "uuid": "ba647647-0d83-428c-8863-1aaf8823b5a4", "comment": "Malware payload (Mirai)", "value": "f40d90c0a671e1e3679955ada520e8d8", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882288, "uuid": "b1972751-04a7-4f1f-8e18-01ecabfbb2ee", "comment": "Malware payload (Mirai)", "value": "8dfb4b6d9de0426e944b49d05fe8a62d71e34136db12eaaf0daf113d0ca4c673", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882288, "uuid": "346ac41c-56d4-49c2-94da-8044bbfaaccc", "comment": "Malware payload (Mirai)", "value": "b0b8e44a15ef8412b39a4f56191bd00e8f0236c1", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882288, "uuid": "0af26908-47c7-4eed-82b8-87dc9ebf4b21", "comment": "Malware payload (Mirai)", "value": "7198dd8813174b817d04d0ec4de650d0110ee47802ec7ef568bdfa451f470a4826ea608c42d0c7be1092d4a51efa72db", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882288, "uuid": "05fbcc5a-9a2e-4a17-99b7-a66be58e04b3", "value": "T150C50A3B7710EB69D275C63009F25BF0C6B620532AE26462B379C72CBAA111D1C9FED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882288, "uuid": "eda97edb-4723-4580-9bdb-cb2cd598899f", "value": "24576:pomm+gY4dO2RGUKaXrvdVwZ57K4icUDO9zGsN/aydsy:lopOAXr32K4icUDGPiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882288, "uuid": "a3792fa6-6ade-47a8-bbc1-a0b9d5621319", "value": 2506404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882288, "uuid": "52a08c22-5f8f-457c-85f4-1c1b363a5737", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882288, "uuid": "54170ded-8ec3-48ba-bc25-12d5b7d7ba23", "value": "bot_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4d2b75-3e25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776846644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846644, "uuid": "865ff042-867f-4c1d-909e-f8fd21e1a134", "comment": "Malware payload", "value": "d7d8d872de4ce7df5592d36c7bd73820", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846644, "uuid": "0ba228e0-138d-41a7-8426-cdfa8483a29b", "comment": "Malware payload", "value": "8f291b427735e0f54a4fced96554387f1fe7b4d8fcf41226f821e7865456623a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846644, "uuid": "d5692bee-d780-4730-a3bf-5b48936dc10b", "comment": "Malware payload", "value": "31bb41cb1e14fb15a630111767e262de5f709841", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846644, "uuid": "b8fe7da0-9f4a-4803-b05f-659a487cb541", "comment": "Malware payload", "value": "b3de22670402a6255420978407c668db245e337357f69c9e8fd17b524aaa38172ccd9a4135095b38d9855a16c0a81320", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846644, "uuid": "1a136ada-4a6e-4d3c-b358-fe28226c45f8", "value": "T11C47331BB3170C3DE41689B45A0A917796B13CAD1B315AEF46D436143F3FAE0293AB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846644, "uuid": "c95385ff-b479-46bc-b1b4-37c95ffcddd1", "value": "a77c7067284e6628d64c7a38450f7544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846644, "uuid": "650a633a-eded-4b39-be84-fcced79aa62a", "value": "786432:Q9nR4xL1IluXcnHAjET60mwmO7Z8OIF7E/EFEJE:Q9nR4xL1oOWIET60IuRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776846644, "uuid": "5fae925a-7c67-484b-88d9-2b248e13a690", "value": 26357248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776846644, "uuid": "852e75a2-f885-43fd-8c26-df302264c763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846644, "uuid": "33b384e7-59cf-4075-841b-ccc72a1b1ba4", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849c3ab4-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874116, "uuid": "b02c9a78-02df-4702-82ef-1c6425bbdad4", "comment": "Malware payload (Mirai)", "value": "d000e05d599054a9a33651fdd496ca68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874116, "uuid": "eac97549-e0a9-4921-8a83-3b1d8554b350", "comment": "Malware payload (Mirai)", "value": "916e6a3aa9f29d73a22c73d18fd208f2d5d5a170de5460d629c603ab1d37132c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874116, "uuid": "acb01ac4-7a27-47e1-a742-7d2499d3c4a5", "comment": "Malware payload (Mirai)", "value": "e1b869de60bfb1f069e11db9f11e1848cf24134b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874116, "uuid": "2267776e-d815-466c-ae25-0c3b38e73a57", "comment": "Malware payload (Mirai)", "value": "8d9bf7812bd25b6b827df450a93b43a41b6255da3ec3ad9299cc29804a82b836743718662994be8b87eb2a8039bd4be7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874116, "uuid": "44b12b7c-eef6-44f8-858f-46ad40ae793e", "value": "T153813E9A0591EC738DF5CF022757677450C5CE9738E7DBACC88C396984E4910B2AFA89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874116, "uuid": "f484ee15-79ce-4e1d-a0ff-84df0092f884", "value": "48:RSlWS3DN9lWGSsWv9lKSb+9ldSyQ9luSvo9lPSUo9lTSYo919laSr+9lxSmI9lYY:RdlOKzOlXAskEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874116, "uuid": "b678d921-207c-49a6-9370-ba38ddc2c4d6", "value": 3969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874116, "uuid": "e7249999-7635-46a6-acb4-f7bc27b905fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874116, "uuid": "726d3068-59d1-42d9-b90f-4ad0bf5f1053", "value": "diicot.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21869b50-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875668, "uuid": "3a37782d-52dc-4546-98b6-f808fc7f17f5", "comment": "Malware payload", "value": "920b10a96e6e50b78c90bf831009f51e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875668, "uuid": "3a1750f5-bf37-4d87-9247-cb2e6f52a718", "comment": "Malware payload", "value": "91f40e048ce741bca5b0c2eb979570ac2983576c85a7bee32647fd97bd7c0a9a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875668, "uuid": "a41b60b9-74ff-4fa0-b140-3899cacce49c", "comment": "Malware payload", "value": "0716b65bcb9f0cbf674677460e638f510484fae2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875668, "uuid": "15134bde-df31-40bc-b3b7-b2195c277196", "comment": "Malware payload", "value": "2c51c733246fe804faa8012e2e9008aa8291bbc556bd83a617937d6cda06669a1c5c2b87af970762568a5e009555189b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875668, "uuid": "3beec90c-d618-467d-9d08-9f3e633a2ebd", "value": "T139A67B47B8924952C5E43A37BCBF81C433634EB98BC726576D14EA383EBE1990E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875668, "uuid": "b7dca379-2b31-4d23-9f5a-cf1ba92b55d3", "value": "98304:oeRgpANu2KiDTCwwdsY4UbEAo49DfW1+TvZFJG5Y0B:oeoANu2KiDGwwdsNt1CZFM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875668, "uuid": "72b62606-3a8a-400a-95f9-b0ac07d71645", "value": 10210166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875668, "uuid": "ae42953a-219e-473e-9cbe-2a6961697f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875668, "uuid": "8b154357-e0e3-480b-bc57-405bd743a426", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8feafc15-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882295, "uuid": "804a1a49-bbc8-4c9d-8e11-0e0327e60e15", "comment": "Malware payload (Mirai)", "value": "1e38ca3facea41b3d526b359081f866b", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882295, "uuid": "912f17d3-3683-4997-8a3d-4afff30a258c", "comment": "Malware payload (Mirai)", "value": "9215c4dcf9f145ba618b99f024a43d7e6a547e15d80a960c514bdb5be5655893", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882295, "uuid": "cf1a40ca-b826-41a5-ae4f-9e0c919a2fe8", "comment": "Malware payload (Mirai)", "value": "7ce910948e5b839d3ba24353fb3f1dbd5f9e6859", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882295, "uuid": "5af65fc2-9c0e-483b-a928-1bf8aa5508e6", "comment": "Malware payload (Mirai)", "value": "ecbc446709ffb376bb74d6166e47ad6b419b586a22fb019d0a529363e79f3ebef046e5e30eb0bf5df97310ecafbb0ece", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882295, "uuid": "e2b1d1a3-6ad1-4328-a416-c7ea746f4365", "value": "T148756D02BF845EEBC45FCD704A3DC34714EDE8D752D5A63A71BC8A9D7A6920A4AC348C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882295, "uuid": "53253880-6f9e-4d65-8ff0-26e404d4372d", "value": "24576:bWhsVuED65ztnBY4WJVQw0qAIcG01fAWtBsUcNWz/fhwC2Un2vs6VsSsrq:JVItBHWJ29D1Jc6wrEWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882295, "uuid": "6ba0c9f5-a323-4d6c-a6a7-688f3add2b6a", "value": 1614968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882295, "uuid": "ab8a168b-99ef-4fef-865d-3ea97641e86e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882295, "uuid": "d23bebd8-e3ac-4b79-ab77-41a734631a4a", "value": "bot_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b7bf56-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826450, "uuid": "2bbf0c89-6145-4af9-ac7b-e0de005f0351", "comment": "Malware payload (Mirai)", "value": "fb10f8b9491b567aa4f480a3df26d8af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826450, "uuid": "29bd750e-11f2-4ea3-8685-6f5077cc524e", "comment": "Malware payload (Mirai)", "value": "924767f2a315cefb9a044e4b0a17f3d4905f3cd34e531ebf50d99be79547338c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826450, "uuid": "e3c3c7ff-d446-49ec-804a-aa37bd06d082", "comment": "Malware payload (Mirai)", "value": "c59ea30ce29e883d5a829c28cec720fd34feae4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826450, "uuid": "2374f785-8a5a-4967-aee5-0fb59de76dc3", "comment": "Malware payload (Mirai)", "value": "5c0a6c9128959eb526b2203d9763f18835cad501486a044a75fb3f5378c9589d5b1be374207ca9d05b7d2b56623f54d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826450, "uuid": "5695f8db-e810-40ff-bf1e-2052d2e2d2be", "value": "T1EBF33BC7F800CDBEF80AE73748530905B230BBA255825B376257797BED3A0991977E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826450, "uuid": "10d27a38-dfb3-4593-97fe-62bbaed09e6f", "value": "3072:ZV54c/y0cSWqyAl9ed9/1qVM9uBSAsgcVljbiNLHbDL0i:ZV5R9yAfed9/1qVaursg3LHL0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826450, "uuid": "ca4dde81-9f72-47e4-b651-29ecdf412234", "value": 157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826450, "uuid": "eb9db71a-72d8-4d94-bbbe-efa12eced4ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826450, "uuid": "1625592b-0de9-44e6-af1f-32cb51852853", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80be1653-3e1e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776843615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843615, "uuid": "1fcc526d-ca1f-45f9-b49c-664f7bd30726", "comment": "Malware payload", "value": "70ecd8ddecca2417f7d132a3b061914f", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843615, "uuid": "5764389c-bb76-4c2c-b841-e77dd2d08dec", "comment": "Malware payload", "value": "9345917aef897bd10469dbcbdb2b689166f0e60f3b6223e0e9e30d13475fd44e", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843615, "uuid": "4c360813-05a1-4e36-a41c-cf43560879d9", "comment": "Malware payload", "value": "1cc043290e70127f6c4cde097d28a73c841fb1e7", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776843615, "uuid": "5f4a4695-88b7-4836-bc59-0d35ebceaef3", "comment": "Malware payload", "value": "ff5db55b02d659c810844d5c8b007e644b09607bea5341531b9e6ed6dd0ae5f25dee090f81a8bd7a748b3bb3f9693920", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843615, "uuid": "58e4b45a-276f-4a90-b0e9-8877663f079d", "value": "T160129E0A94E3825994D3F0A60BD765306D8E7957311AC46D374C24C50F5BFA3AAA636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843615, "uuid": "69b598cc-5956-4b81-a6df-da30dafbae2f", "value": "192:xvO6Gw12jaezPaRQjBZHB3ybCOgJXEhbi1DXGDmtVonDO:Y6AaPRQBpCgDwm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776843615, "uuid": "420a70b2-0b8a-499a-a272-69286a0592e5", "value": 9896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776843615, "uuid": "4eb59cbb-ecc2-423d-9334-d46905cc89cb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776843615, "uuid": "a75b2fcf-b5d2-4737-9199-8b3af7fba81d", "value": "nhsztisza_phishing_attack_20260421.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07e7e5d-3e63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776873357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873357, "uuid": "acf83c0f-409c-478a-9db5-8c137324210e", "comment": "Malware payload (Mirai)", "value": "e5825d9fc77d0ed0797ba8eb84ed3dee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873357, "uuid": "c373e8d2-e194-4bf6-ba34-a1f2efac47c8", "comment": "Malware payload (Mirai)", "value": "93dcaa659a7c7c783d36b514466f1495d4a0dabd232f09a6d15964b7eab2e4c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873357, "uuid": "52ee2294-fbc9-4c5a-8ace-7399c139a539", "comment": "Malware payload (Mirai)", "value": "4eafb4f85af96f5b6a6eaebde79b8ba1d18a6839", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873357, "uuid": "ba3e2692-8f7b-47f1-977b-904095945f09", "comment": "Malware payload (Mirai)", "value": "25598bba4a1420e9c78747c9b3fb2883afe5c743e26ff00af8bc9223ac572e23d6e098f21ca3902f518f05f879f7e72a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873357, "uuid": "036bec38-e838-4ae2-9cae-399e62a9dd9f", "value": "T1BF33E845BD829906C6D843B7FA1E42CD331173D8E2ED3227DD157F12BBCA52B09AB162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873357, "uuid": "819fbee7-3322-415f-8e55-a8f9cae6ffc9", "value": "768:D+/lwk5gcxOTLDYr6Etl35agtJFTfW+Qlw+3i+5ObXdVs8nnaCTCuxDMiBwbZnU:a/l3gcxOTLDYNbwglqO+3+8ya9awbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873357, "uuid": "f10a1aa1-b0ca-4f0d-b2e0-3cbf91ad0197", "value": 51600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873357, "uuid": "99ca8159-6835-4b4e-93f7-89bc8a4d206f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873357, "uuid": "1d7cbaf8-b199-429d-95f3-ce7fc6e93d44", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269e770f-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895003, "uuid": "d5f579af-30c8-48d4-9b40-9b4f1afe725f", "comment": "Malware payload", "value": "7270f61fa5121347cfe3e2013b3de3af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895003, "uuid": "1bdd0ad7-eff7-4bc3-9234-0b1a1a98c441", "comment": "Malware payload", "value": "94e3cdfbbf81a9218064ade0697f7f7468cc44b1a33d8540d6e56dcd417267bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895003, "uuid": "a7a1ea29-a5d8-4bf3-93d4-cff4591aba47", "comment": "Malware payload", "value": "a6c905e34473a6952618a4068b90337b2d5b5397", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895003, "uuid": "7305813b-3891-47f6-9cbc-b4d4505dc67d", "comment": "Malware payload", "value": "3eff1e72a28812058717cd902530f1ace0a10073f0dc8261b3f697b868076185abe6bb7ad61c6644f52507081853d83a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895003, "uuid": "ba5bfd40-df98-496a-b53c-f4064d64e70f", "value": "T19986FA51BD822FA7C5CC037445EE63A622903E454AA1472723B4FBE83E7773C9F56988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895003, "uuid": "7865bfd9-91e9-42da-aef0-ffc0c76e7bb9", "value": "49152:uCJCCUGd1lX8C6nvDcca6PssG8I0iJtYZxlBkHf6XOq5E2:umCTGDlX8C6gMDNE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895003, "uuid": "4256af81-0ee6-4677-aae1-2599ffb4f148", "value": 8257720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895003, "uuid": "cca38d29-7a72-4df8-84cf-5873e2a1d5a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895003, "uuid": "7ed854dd-0061-490b-bc03-45c92c3e75fe", "value": "h3flood.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768bbb3e-3e25-11f1-a769-42010a9c0008", "comment": "Malware payload (RustDesk)", "timestamp": 1776846604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846604, "uuid": "e5903cdb-c7a4-46e3-a0ba-ff388585b1ea", "comment": "Malware payload (RustDesk)", "value": "758264fcf5413233d4a683d667fcd05c", "object_relation": "md5", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846604, "uuid": "bf1ad61d-8097-45e3-82bd-a2ac4546744a", "comment": "Malware payload (RustDesk)", "value": "950b740b364c7a827be3ca82b77533e419097ac56a5937ad637b3d6177e6f9d9", "object_relation": "sha256", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846604, "uuid": "de82b69a-3406-45eb-b418-c8cf92dc81c7", "comment": "Malware payload (RustDesk)", "value": "d411206e98e1b0cbdf7c835af993a77c0c81339c", "object_relation": "sha1", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846604, "uuid": "98185798-1df2-4209-95a2-702c169e75e5", "comment": "Malware payload (RustDesk)", "value": "7f74cad4d7fdb7fac3b6e44f67b7b8d76a033177e262c7cbd3c91912b32cde838d049c66d09e6a71ab4b29ea88e3883b", "object_relation": "sha3-384", "Tag": [ { "name": "rustdesk", "colour": "#17A0F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846604, "uuid": "283b7a3b-b75c-48ca-bb8e-b88cbe782fea", "value": "T12A473306F155183AE86A8430991596B7A7B43CD907316EBF63D439293F3FEE06B39309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846604, "uuid": "a4269a71-e299-48a3-8a5b-2e1c5996d699", "value": "a77c7067284e6628d64c7a38450f7544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846604, "uuid": "5e235ea2-fc02-44bf-be54-032642d070b4", "value": "786432:79nR4xL02pg4RzodKUtttLxPicrvlu6zSZ8OS:79nR4xLFpdzodtvtL5iadu6zsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776846604, "uuid": "dbc103f0-313a-4b8c-9d80-de7351b191a5", "value": 26367488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776846604, "uuid": "1aa9969f-0079-4aa3-87b6-9624964da1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846604, "uuid": "bcdb3068-3d8e-48b9-8c8b-0c450a6d29f3", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914c8001-3e30-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776851374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851374, "uuid": "afd1ccb5-44d7-4b7c-931a-97ad2f0ca1d7", "comment": "Malware payload", "value": "0a89d9a3b83c7122286b7c6b354b2e56", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851374, "uuid": "8ba2e318-5467-45f4-a58b-084f247575eb", "comment": "Malware payload", "value": "955559db92f38cc59da5829d04207508ad641ad9cb240d1107f20853703bb267", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851374, "uuid": "86befacd-a2fe-4584-b36d-e24b49f3181e", "comment": "Malware payload", "value": "eef7bc820ba8a350cb11210dab10c7a4ebcc8b1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851374, "uuid": "72c7b644-df49-492a-9ab8-4321789e2890", "comment": "Malware payload", "value": "ccc19d2816bbbc942c1a873c3098bbdf020de3794b77a7320291c946bf29ad8d90f122bfbe68bb7e435fefdf15bc10c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851374, "uuid": "3bed16e8-e7fc-4e28-a889-201ebc31d06a", "value": "T12BF030E6A0300AF245107D48F1A5E9F4B8EB51580E635F682BB965FEC239428BD5007C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851374, "uuid": "5c9dc7e0-f8d3-4c5a-8c14-5f16f25e9db7", "value": "6:L6FjmjShtt6FjzOehzR16FvuVPFdoh9316Fv1hx5P6FvCRH1LshVLKil6F4eUehT:r8tzQrVPFd29Qx5lhZyVLKP9ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776851374, "uuid": "e61b154c-5cb8-4a07-a405-3db9679aa5b0", "value": 478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776851374, "uuid": "df4c6be2-7ae6-4db3-95d1-528c59cf0fa1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851374, "uuid": "138445bc-0ef2-46b0-8334-69e6d6fe1b23", "value": "tftp.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b21871-3e86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776888346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888346, "uuid": "6d27dfd4-060b-4e2e-8dee-1d5380c58db3", "comment": "Malware payload", "value": "eca863e5c96a59267878e4f9a7e32b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888346, "uuid": "e349b97b-6ba6-4866-8c50-4bd6a7910663", "comment": "Malware payload", "value": "95cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888346, "uuid": "9e00a37c-1922-4051-95a8-f1bb32968450", "comment": "Malware payload", "value": "ddd6edbf5431b814e6793d9c2ccd0d3b3d8efa8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888346, "uuid": "8f9b7a48-71ca-4f23-bacc-6ea5a5bfb4ce", "comment": "Malware payload", "value": "272be3e9f15d71c4c27b70f23f9d6d098bd07ea552774f70110d05b7c03619a27b84b55c92d7e367c8abc71059a49fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888346, "uuid": "e24528e0-969a-4025-9a96-76df965cdc58", "value": "T105C57C123CD101BDC099B73248F22682BB35BC591B2727D32E91AB782F37BD0597A756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888346, "uuid": "5fd778fa-8d27-4870-b97f-7471a7d928a0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888346, "uuid": "dc608b03-3fed-4269-91cc-3bfa880ee166", "value": "24576:OLwM/JkDsu4XBEiTYtPLaXhdCeGGK64XY23+/W+M0yDMwY8o7TZn2zKptGEDXTzw:O0ykDeEiTlwhXY2u//L8qTZn/p54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888346, "uuid": "d7917b20-52b4-4a6e-8201-ebcbdb08d239", "value": 2621640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888346, "uuid": "4e69d9fd-31d4-4b58-b4ec-66c55f6b6813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888346, "uuid": "64183fae-5a30-4dfd-bf3f-5f87871d124c", "value": "quantium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da3f7b1-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876198, "uuid": "c81a5e7f-8ab8-4c11-b084-81624e7f18f8", "comment": "Malware payload (Mirai)", "value": "e1ee862515433a97a6ab6f1d5dff5bef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876198, "uuid": "af2db0af-7be2-4b4d-8a29-26f528e1087c", "comment": "Malware payload (Mirai)", "value": "95f6d8d8f2b7a9e2982221a6ce8b1d6ad908b42982f425dfe8feb39a81d34d02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876198, "uuid": "3e238f37-7cf0-409e-98e8-1b0cac991cbe", "comment": "Malware payload (Mirai)", "value": "baa710770cfbfbce158b984b0394ba42a5810691", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876198, "uuid": "71b1c0ca-7322-4528-8286-610c7228ee76", "comment": "Malware payload (Mirai)", "value": "6e7eba3273cd0f67b68b9fdea1470d30d82d792ba71a2b1566b282a0b0038420c21923f97aaad9fb3d0495e3b6867d52", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876198, "uuid": "4c134771-cf8c-48fb-807d-b42479e15ae7", "value": "T16192E059C2BD8C6FCC46D2792B9AAB8732102829478F935A7E997E517DF205C13E4E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876198, "uuid": "b47940b7-7680-4fbb-8d94-20cec2e9320c", "value": "384:MGtDvsoTbYnoBZsDJYXSXcLRL2LafB3z/zIPbU6UEIng6dW+:7tDvJInoBGlIQO9zIPbU6UEI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876198, "uuid": "d38d40a1-fab4-4e4a-8c8e-ec69b79ac4f2", "value": 20000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876198, "uuid": "f29a902a-a9db-44f2-af99-78e1cee3555c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876198, "uuid": "4888c8a7-043b-402c-b8ee-5c978a5bac18", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fb8800-3e5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776869959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869959, "uuid": "0bbe448a-8807-443b-ba82-fbfca0641056", "comment": "Malware payload", "value": "177cb7e200e19e8afea0d4e778d21cb2", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869959, "uuid": "d571c0b0-269c-4c0c-b8ad-e0044c5e8407", "comment": "Malware payload", "value": "967486f372064f8edc8695c91660fe436dadb2cd848a251268c8002fccd4f45c", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869959, "uuid": "9d61a8e9-aa69-4fa9-bfa4-0a7c9bf3deca", "comment": "Malware payload", "value": "5c44c374fe8a6a4c7815b5d6d759124730a7ba4a", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869959, "uuid": "c01a26ff-3e60-45ee-875d-f7bc71b00c16", "comment": "Malware payload", "value": "47158b5524b593d0b699566cfb794160d0d554a4271253dc63459d25f783bc11114c69d529b136c81acb2594d508c44c", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869959, "uuid": "9e4bf5cc-92e8-40af-b37b-49cc163ea89a", "value": "T1F9551212BBC58572D07224364BB697501A7CA9710F31C9DF63E469AE6B316C1C732FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869959, "uuid": "69eaf9ec-7380-4055-a103-ddc9c64beb1b", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869959, "uuid": "4b90c1ef-03ed-479c-9a1e-742ba2d8582d", "value": "24576:KN/BUBb+tYjBFHEPxZsCydg7wRaN3umETpU3RX1zJ54D+qRfoBan5Fq:6pUlRhSECyW7DTDX1zJ5w+ufya5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776869959, "uuid": "c34c618a-5f63-4145-bee3-f84dcb4282ca", "value": 1383479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776869959, "uuid": "c6aa74a5-16f6-46c6-a637-36dae90f22c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869959, "uuid": "666bdfa8-e41d-45b5-9c11-d0288175a3de", "value": "967486f372064f8edc8695c91660fe436dadb2cd848a251268c8002fccd4f45c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a655e7d3-3e15-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776839813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839813, "uuid": "ac34585f-4b79-4999-85fa-274cbf01996b", "comment": "Malware payload (AgentTesla)", "value": "508b8edf59a5b9acdfd1b1482c2f5f16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839813, "uuid": "2c69eda2-e2e6-4515-b562-972e9a5f5f06", "comment": "Malware payload (AgentTesla)", "value": "96adde04d7845d0bfecccab55b8892383304c0ad9b531aa08deaad632ecbad01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839813, "uuid": "2ec58320-12c7-4ba8-8997-29fd19e50a40", "comment": "Malware payload (AgentTesla)", "value": "70932d499e0ee18f84638db092e58c1bad7de3f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839813, "uuid": "c907f062-02c1-4102-85ce-02d942705552", "comment": "Malware payload (AgentTesla)", "value": "66ea3a56019f1df12d692fd3686036a5efa80e49b3eb260a964b17ea0abddb62c6eda6317ada39011740bf07ec2e6f80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839813, "uuid": "9934f8b5-c16a-4494-8828-ff9fc6ce5bce", "value": "T13D341F037E48EB11E1A83E3B92EF6D2413B2B0C71633D20F6F49AB6618516525D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839813, "uuid": "d9004666-5773-4d00-a56f-0e63638da232", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839813, "uuid": "2028b0cd-1c22-4035-ba03-e1eeb4e4692e", "value": "3072:clIja/OSw0wAWa93/9oWKc96YaLy5fRZjgC+:eIja/OSw0wAWa93/97KJYaLsj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839813, "uuid": "b27996a7-4b3f-41d4-b400-ef1afb24fa99", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839813, "uuid": "0d3ef611-7ca4-4551-833e-79ed6cef3a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839813, "uuid": "906208b0-29f3-4787-a85d-55a9de95b709", "value": "96adde04d7845d0bfecccab55b8892383304c0ad9b531aa08deaad632ecbad01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906e24fa-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874995, "uuid": "6682423a-deb1-43d7-8fc6-2972e251f3a5", "comment": "Malware payload (Mirai)", "value": "3ba449cb1545b925ac2000f453b57d3d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874995, "uuid": "8cec8fdb-6cc4-4166-82f7-c0e228f100f0", "comment": "Malware payload (Mirai)", "value": "98370a31aa0976e7291d5c5087a8c9770b2927e8c3399bc14a2402d01bc5839d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874995, "uuid": "00e9a1c7-035c-465c-9608-55d9f757405a", "comment": "Malware payload (Mirai)", "value": "d985213aa7514ebef781407e7a612592741fee37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874995, "uuid": "23610aca-774b-4a28-a6db-3e770b6198f8", "comment": "Malware payload (Mirai)", "value": "b3110b5131232f926e702d60de96f314867609f1d8892a24fe6287bf156761dd48fc52c33165b43158896271babce249", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874995, "uuid": "76e2016f-9f70-4f8a-9e7e-1f25c2b375a9", "value": "T151930749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874995, "uuid": "1993ccb9-f0f9-4596-8638-1619699c2595", "value": "1536:wqnZK8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Ydn:C8NUv5nTacgzafVAwe4BNRIbT2gXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874995, "uuid": "98eb0e07-14f8-4adc-a109-ecb9dfda62ba", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874995, "uuid": "397eed84-c5c2-4eff-b4d1-42fc15dbe13c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874995, "uuid": "ccbbc231-4fab-412f-85a7-e72a5621feeb", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9136bb7-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880270, "uuid": "edd15625-ae85-4119-85f9-c35bab564ab7", "comment": "Malware payload", "value": "c0e8a7d3460797752109146ab25c38cd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880270, "uuid": "449f4304-03ae-4cc4-8302-c7d67d619eab", "comment": "Malware payload", "value": "98568d1ac92ad08eb8055fba873b6c9ea8096b0b412f60857e117e669bf9d266", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880270, "uuid": "0295a548-81ea-441b-abca-3933bc3b3491", "comment": "Malware payload", "value": "7750b88fc68d0188dec342ceb32694c0458eb2af", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880270, "uuid": "bde0052c-66eb-4c65-96e6-fc887c62e26c", "comment": "Malware payload", "value": "48b0d9f218767bd1fb70e74ad00da2bd0983f4099b71b14b2c8113f1925b713b78026f4ee9fe5450637efe15c020f9bc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880270, "uuid": "950f1733-4d1a-4fdf-b2c8-a035baecbda9", "value": "T14641630BFE48D338969BC0A665A78C4C98404903151488B7FBDC86A55F6573DDBC63F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880270, "uuid": "1b389389-b556-46cf-8d23-49fdbe20a9e9", "value": "48:J1pJ6QUXjr4qblzMH1XwiH7OjSKD0UWcfhl/B77gAk:Hn6QWuVHH7i7rfhlJcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880270, "uuid": "dc139cbc-93b7-4d93-af05-782ebf7adfb7", "value": 2161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880270, "uuid": "a0450bb5-5809-498f-8e33-d3224fb16bfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880270, "uuid": "0afffa69-d28f-4864-9e68-468858eaba65", "value": "ZoomUpdate_installer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fbdaae-3df9-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776827590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827590, "uuid": "223df066-6865-4fb2-bf96-49243fa29724", "comment": "Malware payload (Phorpiex)", "value": "35b8858f1fb72e09aca7c9e788bffb27", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827590, "uuid": "49143b8e-5d9d-4f30-b476-4077dbd8c7f3", "comment": "Malware payload (Phorpiex)", "value": "98ba0d26044bd6c4239c1d17e678bc1159ed8fa5b9b08b06a7c452f602abbce8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827590, "uuid": "70d7365d-a614-4392-9fe9-7046d2c89e9a", "comment": "Malware payload (Phorpiex)", "value": "655d6d69846fa053fe1f4e1af85fe7eae578a937", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827590, "uuid": "fd6b634a-d57e-4cae-b8f8-47a5d3848a8e", "comment": "Malware payload (Phorpiex)", "value": "adea4ee5cbd7748cf01e622c4dc9b94c7c8dc601ea9f6736fdd48c2d844e9672857c7e8dad494f68b1a24ee795dd9309", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827590, "uuid": "16d5542e-68db-4307-b797-b98448235780", "value": "T151824B0FB942421AD0D100749636867BDAB998B637D814EBFBD08AED1A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827590, "uuid": "8f46bdb4-cfcc-4863-afa6-44ad76dd1f53", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827590, "uuid": "49e493c0-2c9b-48ef-980c-901ba7faa829", "value": "384:XI7MVGASM1KwngSZb7u9NHu/gRhav8U9cs:kQ8Ub69Jha0Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776827590, "uuid": "67841b0e-3216-4141-bf86-3bb58fa05c54", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776827590, "uuid": "4712a844-ed30-4ba8-87de-849f486af8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827590, "uuid": "f98cb1a0-fdab-46b8-bb8d-b5bdb208e5d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db62e99-3e60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776872010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776872010, "uuid": "8e249e7c-1cd3-4575-bf1b-0a18486b7e4e", "comment": "Malware payload", "value": "e9f514cd5b25ade779e7042d2fc06e8a", "object_relation": "md5", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776872010, "uuid": "6a5fc774-375f-4c5d-91ab-ac50aaa31294", "comment": "Malware payload", "value": "98d57bf390e450b02adb5e29a4e7d895df889e90fbcb851f84118fda98615611", "object_relation": "sha256", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776872010, "uuid": "46090b21-fb74-436f-b260-dda634c41d72", "comment": "Malware payload", "value": "32c26d1f0b5be16c5af8d822b9566b697553bd2a", "object_relation": "sha1", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776872010, "uuid": "30c8cbb2-2e9f-47fd-bfb6-2848f08f8f55", "comment": "Malware payload", "value": "b49b0c5b4d5e885611d6b6d012cf7e2b9d798383f925d5733ccccbfe79ccaa0f8550119b429442f8804543f867f4fd9d", "object_relation": "sha3-384", "Tag": [ { "name": "BB5.file", "colour": "#184530", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776872010, "uuid": "958b827b-b4b2-4d95-b3b7-e2313b446da4", "value": "T1BD762345B9C9C5F4C48686E05F0150EE78CF356AC8FD4A7D3ACECC21A6A0D6E845F7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776872010, "uuid": "f97bdfce-6b03-4eb2-b447-33ecffef7f57", "value": "f3201d8cf27e3b4846984664d5bfd984", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776872010, "uuid": "07719811-c06d-45bb-ac33-4822157bd9a1", "value": "196608:fjMZus4IEpbA7JfuHJDlShlaPUb9LoCNB9hdzYxnh0:Ls4dbAR8pShlashtF/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776872010, "uuid": "b52d1ad3-46e7-4dc4-9df6-f7536bec342b", "value": 7605760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776872010, "uuid": "3642e6b0-5f16-4ed2-8f13-9fda7b6e1552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776872010, "uuid": "e81aae26-79fa-437c-ad4c-59669753c70b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf26c955-3e0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776835989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776835989, "uuid": "d767b7c4-3f7c-4a77-bbf1-8541cb4ed35e", "comment": "Malware payload (Smoke Loader)", "value": "7e085b025285bdd2736a1421745bf542", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776835989, "uuid": "387f2c74-a5cd-4738-9912-a0b965e852fd", "comment": "Malware payload (Smoke Loader)", "value": "98f4c865369c0e2a308c0d00df96bda6e9939c5ce907490af2e01efd9e661eff", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776835989, "uuid": "dee22f7c-4ce2-4137-830e-bbfdfd84b8c0", "comment": "Malware payload (Smoke Loader)", "value": "cae8ffaf111e2c58f55c4bf821fedbb9ccfcf4db", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776835989, "uuid": "5427efda-63b1-4ec5-aff7-41a4050b74f2", "comment": "Malware payload (Smoke Loader)", "value": "f8b037e44efd191847e4d3610150246082e5765ea646eed353ac60d77090b5a463c6a0f6ec944af49ccc1e7bebd2645d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776835989, "uuid": "ffba8528-2b9f-44c8-be0a-5275d19c7e3d", "value": "T1A6955B42389105BDC49AB73148F27682BA35B8190B3637D32F91AB783F37BD0197675A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776835989, "uuid": "e61bda60-6d07-420a-b22c-3f0e75d5fb3d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776835989, "uuid": "f9c14375-b7e6-4e9c-bb15-11f6a3296b3b", "value": "24576:1/6y+xHNllicfAJ85/a3BtXvTedeQOxmLMDhqG6WcRDzQG:1/kxHJfA/3B1vTen3ghOJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776835989, "uuid": "d951df9e-0f5f-4819-8fcd-a2d6cfdc6ac5", "value": 1971400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776835989, "uuid": "22b6c483-595e-41ac-8a7c-f926d489a8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776835989, "uuid": "9dd906de-9ec0-459e-a927-5f88b502d8c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f964d61-3e41-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776858672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776858672, "uuid": "681682a2-22d5-4f25-aa5c-766be1f33b1b", "comment": "Malware payload (Gafgyt)", "value": "06c789b8e6a89d461f0ad24e421d54ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776858672, "uuid": "440507b7-6751-4f4c-9008-05217e71b993", "comment": "Malware payload (Gafgyt)", "value": "992befbe4fb11188363057c9414267b1d4876b3115d6cfddafbddb95e0044358", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776858672, "uuid": "5c35358f-12b6-48bf-8770-b34bb961f158", "comment": "Malware payload (Gafgyt)", "value": "20d9cddbf6f6a556bd75dc44aaef871e1fd2b110", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776858672, "uuid": "2a8fc1b6-68de-4a60-95b8-4190df664e09", "comment": "Malware payload (Gafgyt)", "value": "80dea7969766c473392382db68fc347d5f6f2cd4024d04fe8e49b66aa74c125bea4e128abf787e82f58d14302d7709ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776858672, "uuid": "ae29ffad-62f0-423e-a5d2-064c5232b940", "value": "T13503E11D20053DFBFE1250F847C953021EBB8A95C4959E4696F3D63999722733273FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776858672, "uuid": "a0255ac9-aad1-4d6d-a2c3-b47e790b65b9", "value": "768:/zfk3hQeYO76yxLQ3MCdcKurAGfUU6USC98WRp3ud2LWJgGlzDpxYsE:/zMxXF6y5Q8CqzxfUU6USUvRp3u0WVro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776858672, "uuid": "4ed1fd17-ea96-4fe9-8e27-c3bfe2110ac9", "value": 41144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776858672, "uuid": "88614afe-94c2-4ddf-8858-f3a5d7f1fa56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776858672, "uuid": "f8aef413-0ff8-42cf-aa08-a7ef3c47ed9a", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca8643f-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820818, "uuid": "2104b5b1-a876-4293-b4ae-76b72288f173", "comment": "Malware payload (AgentTesla)", "value": "e834210ef263cdf61569004978c29b3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820818, "uuid": "e3d6a704-884c-4a6b-8707-1ddd936fcad3", "comment": "Malware payload (AgentTesla)", "value": "9942ab7aad916e61c96690e6164a4450e7b77a4380b5d52c4117079aa52eec1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820818, "uuid": "6f8831f3-55bb-4cc0-b961-8e732d892450", "comment": "Malware payload (AgentTesla)", "value": "29a02216221b92892d80de5cbbe23772e04caaf9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820818, "uuid": "a1a5afd8-178f-44cb-b4de-32e119bd01a3", "comment": "Malware payload (AgentTesla)", "value": "a172f9112f79a26954b7c22115d5507e2a6c9d9ed3cbc7954b80f6d7abc2b26f875628caaa83f6cd2e65e2b29389fecd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820818, "uuid": "bc4e62db-3f9b-4410-a631-562f5b761dec", "value": "T1250412E0525DF0C014A11829839F93D7462E568A98CF573FD273E9D1B2E1A39C62B4BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820818, "uuid": "3e762d67-d33a-4553-b84d-b7d85fc4dfa3", "value": "3072:AvVQgej51rGGXSR+EbV3mcqdU2Q0mbi11nkVSwgGBpVP1:QVQgej5YvRTZ2LTQ0g6sioP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820818, "uuid": "5501d001-0afe-4473-8ecb-09ee8737db32", "value": 176360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820818, "uuid": "5375f8ab-90a8-4837-b0fd-3b5f0c1d17af", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820818, "uuid": "3ce5be8e-ba26-4787-92ce-7c55f3b6bed4", "value": "21042026_1543_21042026_Scan20260421-02741.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829301b6-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884850, "uuid": "c6a303d1-8f42-466a-91c4-047aa0fb3487", "comment": "Malware payload", "value": "571650e256c09131428812b2b4253ef8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884850, "uuid": "3afb628f-0845-421c-9cbd-0d0032c4f6d9", "comment": "Malware payload", "value": "99eb3db242fe9195e0d63f93ea0d498454841620b556a5f4d7a3aaa336842520", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884850, "uuid": "7e69d8f9-92f1-4812-979c-a476a83aa3e2", "comment": "Malware payload", "value": "ff0e96464e29193603e39a632916da976f569cec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884850, "uuid": "781b2655-d02a-4c68-90e7-724c5b2f546d", "comment": "Malware payload", "value": "7171893c968c6a074a79c1f7f6201ea4d931313489470ee9a06d84b78195cb97b9111cedb7a00cb3bef74ac8fe2f3274", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884850, "uuid": "25a250fc-f9ee-4a8d-911c-86d038b0f044", "value": "T15E665B73905614D8D1ADD974D5152213BEA8388B273873DBBBC076F11BBABE49A78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884850, "uuid": "248e0673-d2ef-4286-a653-f20e68b5722e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ3:cqYUQuVDt0TZEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884850, "uuid": "aef11206-776d-4947-a339-00ce084415a9", "value": 6782976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884850, "uuid": "9f050e41-24fe-4e5b-a012-728ae2e8ff4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884850, "uuid": "faf58af2-9397-42e3-bfc4-07ceaa4e1f1f", "value": "99eb3db242fe9195e0d63f93ea0d498454841620b556a5f4d7a3aaa336842520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868bef95-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1776884856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884856, "uuid": "3c653b84-7288-4c76-b53e-84310dc3394f", "comment": "Malware payload (Prometei)", "value": "dbeb9fb55c04107d3757e48d8ef13645", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884856, "uuid": "e301eb48-7f76-4280-9c57-ab9d9ce1a934", "comment": "Malware payload (Prometei)", "value": "9ada584e6ca9d4163d5e82525db9bc85c1bea2b04db0bf5f904484aae4ff7482", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884856, "uuid": "e5debd12-6671-4363-92c3-241158193b50", "comment": "Malware payload (Prometei)", "value": "0a3e0c79769e0589a9b7ca64642b779a7584763b", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884856, "uuid": "fbfcd6b7-47a4-48ea-ac66-24332d9be2bf", "comment": "Malware payload (Prometei)", "value": "f96eebbd251a80bff6d0c4d2424f3783993076c1212c84d88252fe31b78333a80a6dd0554bb778fef0ead9c093091a68", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884856, "uuid": "df955fb5-44e6-4576-a79b-438c35d083be", "value": "T1998533DE95AF63D8E641FA2DAA4C6BE0B34155414FDF7B03EA04EB61323B0A54F81163", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884856, "uuid": "75b68c49-e60b-483d-b804-23f729a8194e", "value": "49152:/1i462R4WIm/nMY0L6FY4JMdb5sRBYypWw7hvQGBcJQLo:NNp4q/qL6Adb5sokWadkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884856, "uuid": "7704f02d-bf65-45b9-8eb3-e3249ef42d05", "value": 1773384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884856, "uuid": "600d049f-a589-41d0-a951-6b452081e534", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884856, "uuid": "c50086a3-0a91-4d0f-8129-b287b462744e", "value": "9ada584e6ca9d4163d5e82525db9bc85c1bea2b04db0bf5f904484aae4ff7482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b404334b-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776851002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851002, "uuid": "a9145e31-822d-463a-8aaf-f1ec4e4f9576", "comment": "Malware payload", "value": "263fc418eccaf6081736369114223eb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851002, "uuid": "2894b039-ca62-45a0-b1d5-2b05b6be0905", "comment": "Malware payload", "value": "9b11465c681a52062544ce4063782c6ceca86ccdb10884e040f0b3b039fa1959", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851002, "uuid": "fa17c226-4cb4-4705-9570-7640a1e16e5a", "comment": "Malware payload", "value": "901b68f12e5409c60cfd97d195adb4a7de1bf945", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851002, "uuid": "989d87fb-5b3f-468b-af35-37094fa3c0d6", "comment": "Malware payload", "value": "3137cc15186343fb385bc164a617c0ac4bb7a40c9db73d7b8dfe3d047b1330c039c232865d47cfff7d5dec683fd2ecb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851002, "uuid": "e22f14a1-9016-47f4-b9ff-795dd0efa6be", "value": "T1B613E1A2C1CB9AA7C6304DBDF76F0787769E7AE4C1272170A4128F2D3ACA57102D8716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851002, "uuid": "aa28b175-7f89-4e7d-93f8-84e0b4f48270", "value": "768:bvWJOqiYtOxtiPpPCTg0cpIJhBO8UeQ3EEs0U8/GpNiSyUoAq3U7kj:jHoGtiwTg/pKq8UeGsj8ObiSysw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776851002, "uuid": "fd52311b-7588-42c1-9080-f7077724989a", "value": 41444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776851002, "uuid": "d29de386-61c7-459c-a005-a47525cf8351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851002, "uuid": "12675e7b-29e1-4fb9-9b2c-c9c357e3979e", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cde871-3e2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776849308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849308, "uuid": "8b975ca3-b534-464a-a35e-9b0e0aba8760", "comment": "Malware payload", "value": "1ade4416c0208e2c9995b338881a4348", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849308, "uuid": "f7214b15-d6b6-404f-9415-984c10909f23", "comment": "Malware payload", "value": "9b196383cb83c52ed2002f3293d0f654e7a9ffd7b0bbffcd45a939179a6fdc61", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849308, "uuid": "5eba0572-d9f7-4b44-a85e-fd0b771e63c6", "comment": "Malware payload", "value": "a035770c9a5d2fbbe23bd732ad0542bfecef7eb6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849308, "uuid": "dfae0396-9c23-4c9d-8d9c-088218cca565", "comment": "Malware payload", "value": "0d6d32c9a8d04d66ecc96ee39954b026427b81b82246bb2013c75e6a81a997a948ed30937b23ffaeee0a83be482b45eb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849308, "uuid": "962852de-4d86-41ad-812a-8da7ac48b7c6", "value": "T1CFE345B68B9ACAD656C3681CC526187B9FC09933832DDAE47F5FE5D66F5013020CACC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849308, "uuid": "1b8b7428-8ee9-4b21-882d-d52d6ca39ee1", "value": "768:sApT5WlG7X2/TKThRd4FeNi3S8XQYkDYgrPeH35o4JSdnNfLxboTT1L4:nMjrKVTi3S8XQYkD52w3LxbolL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776849308, "uuid": "0e513f06-7cb2-4dce-8bca-789f6a4bca21", "value": 154678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776849308, "uuid": "7cec0f50-39ed-4ed8-a344-ab2955c486ec", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849308, "uuid": "73aadd55-c440-42f2-ac0d-4ac12ba817c8", "value": "Snapshot_Backup_v8.2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b752ccb-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876167, "uuid": "d006fa0f-194f-4d73-8095-35fc135d3d9a", "comment": "Malware payload (Mirai)", "value": "b299b9152fa7eecc2ef4a6a056c692e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876167, "uuid": "a3f6d729-1a80-47bd-898b-645013472db1", "comment": "Malware payload (Mirai)", "value": "9b7d8010b3a117f1944b2bae246c150b008c65d3a5d76346a78a18ad6bce3080", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876167, "uuid": "544b577f-0caa-46f0-aaa5-fc55ed08eb82", "comment": "Malware payload (Mirai)", "value": "a3c4556a2a671150878971338f9dda802fbc251f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876167, "uuid": "754bc57d-65df-4a18-bd21-5af0eb8306ba", "comment": "Malware payload (Mirai)", "value": "2416aca0ac021c5d12a127d845401b0cb03d22e7fb8ab42a75d4eecf7d3ed05293be066b944fa73e6fa0f1e49c31a2a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876167, "uuid": "869d73fc-72be-4915-9d47-6467a950cf28", "value": "T16B23F2E48C257D774091A0B8F4AF80CB44005F757CF9BDB2B9568788BD7084687BE58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876167, "uuid": "a64df816-cb23-47b6-84fa-0f1010fc231d", "value": "768:Jlz/2HAfKhnJBYeSqzT6+570VeSGMq3UirvtOq1T+fHTxAXyiBznCN7z//QdgN:PL2HAf4n1Gk76GttOZfHTxAXv16z//Q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876167, "uuid": "009c9d82-250e-415e-90d9-20bce7235a48", "value": 48684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876167, "uuid": "c4585aaf-6c68-427f-a546-61b5e7941f6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876167, "uuid": "b398add1-1432-47b1-9b81-665c14b22a87", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c42df99-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848386, "uuid": "ea57c65e-a6fb-4e31-8bb1-e6bc5a5c991b", "comment": "Malware payload (Mirai)", "value": "f2607c888630f9f7ce949d3cb791ca1c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848386, "uuid": "950b00c8-083e-4125-8b4e-45c21364a03a", "comment": "Malware payload (Mirai)", "value": "9d40833837f795b6ad954c30e899a31c375b19fa3b6df3091ef0256792946f7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848386, "uuid": "7e18e6e5-5224-4429-9770-945c07471d39", "comment": "Malware payload (Mirai)", "value": "3db9febd12a5d20f327468de48c2caf005e32618", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848386, "uuid": "42399dc9-e998-4382-ad80-ad7d9631a2b8", "comment": "Malware payload (Mirai)", "value": "ca0b3e788864319348c509e0f4221fa8d189ce3d3718d5d4dae7c2a9387e8d1113b96645097383e1c56b43f1ae5b631d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848386, "uuid": "0070faf6-06f9-4f17-b793-1d2d307c6b03", "value": "T1CF257D57B2B3B4BEC157C13447ABDAB2A935B47402227D7B61C4C7302E26EA41B19F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848386, "uuid": "5eda8024-5de6-43a9-8fdc-3cb8c02d518c", "value": "24576:CZkD9oF46Ij1JXKZHjSFKfHukbTrO/j/qrJT:E4446YGSFkukbTrCj/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848386, "uuid": "7348829c-a35a-4d6f-b399-a91022a2bd16", "value": 994624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848386, "uuid": "69295344-82bd-4ac2-9044-ebd5e9063d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848386, "uuid": "32e0b7ec-5b94-442a-8b70-671e1b991a10", "value": "luxzz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab845881-3e34-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776853136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776853136, "uuid": "74aa52fa-a0df-4048-914c-beca0e6139e1", "comment": "Malware payload", "value": "2a340abf76047cf6563325d3b386a2b6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776853136, "uuid": "879dfde8-a40e-4e4c-bb26-3501f17e8960", "comment": "Malware payload", "value": "9d879395cd825f651849e2fcfeb0b2a2fde378e9ec0778190913deae154ef617", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776853136, "uuid": "0f1aa5d4-e663-4d63-aff9-cfc9ca4334cc", "comment": "Malware payload", "value": "8981738293efe289dad7782a6c59f2dc35bbe118", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776853136, "uuid": "25f89e2b-49c7-4c93-8b22-b8a3dfa1d23f", "comment": "Malware payload", "value": "6e32debc2b3dfcf97167ab92399bc1f385ab5bbbb15ac9dfa3034378d9bce95ab56a1e54763c89ea1e607409b466f773", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776853136, "uuid": "635bd298-fe5e-49a0-9cce-f458d9e330dc", "value": "T1AAC733B978C01C37E58ADE3E29346F3E47A2364341BA3813B2633B4591D5B60E5F856B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776853136, "uuid": "9f08cae5-22af-4ecf-96de-e8109a88532c", "value": "1572864:Fr/IqK/WntuifUIbexwhHddu6RuB0BDOGqc8/YGE:Fr/ZKut3fUpxIHDxDujE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776853136, "uuid": "fb146123-e866-4c24-93cc-344a00b609c7", "value": 53108224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776853136, "uuid": "61729bef-7afc-440c-8627-4a906a62503b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776853136, "uuid": "135553fb-7df3-401b-a52f-90cc0eb201b1", "value": "cloudflareagent_2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b02d277-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875012, "uuid": "22fce9d2-bc5b-40ac-8d15-ea684f50459d", "comment": "Malware payload (Mirai)", "value": "8e5580c5555ffddf58f1c4dace1e790c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875012, "uuid": "9595b901-dd6e-453a-8d21-4aa686c218ab", "comment": "Malware payload (Mirai)", "value": "9da85a71f77b26fc02997ff08981cd2a497b155b3515f9179edfb6e910e6aa68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875012, "uuid": "f8a412d2-8c62-4325-8c58-03e7688a1525", "comment": "Malware payload (Mirai)", "value": "42d3e39180a884ce144dba40fc6bca6c44cbda9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875012, "uuid": "e5dbd580-569a-46df-8a48-9b15b529823d", "comment": "Malware payload (Mirai)", "value": "81b6e43c6dbb1b8964793b65634878ae43ebbcbcf1466e8b89008fdf66ab1f015b7481bc987de36cce48ceb43f088f2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875012, "uuid": "c38e8b81-d994-445a-aa35-d0d30c0e43e9", "value": "T138C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875012, "uuid": "a6dec653-e3c7-4cd1-9cda-c233c1e049f1", "value": "1536:UrAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK3J:UEFmSmviqS1Bs0+Nd6lAqktNMxSNbmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875012, "uuid": "b4532255-f4f4-4451-852c-8ed6c3a3bab4", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875012, "uuid": "45b5763f-bc05-4ffc-88d1-ffaeaf3246e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875012, "uuid": "6c5ec74e-1ff0-4996-b605-e8ba3f6ac218", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa96731-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876622, "uuid": "ff9a3997-5f4c-4039-81d6-049ccd474b55", "comment": "Malware payload (Mirai)", "value": "8354fe9554e6b8866e09ed787b4b1342", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876622, "uuid": "c5e7b382-4a02-4cc1-a00e-743499a90dcb", "comment": "Malware payload (Mirai)", "value": "9ed04b31914a3621adfd8e1f9003bcd24e295b211b6074d94474d63a09052c81", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876622, "uuid": "b843da3e-5688-40a6-8d12-7267a2f772a1", "comment": "Malware payload (Mirai)", "value": "86533c738e93df17008e334309680c59e893dfc2", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876622, "uuid": "ef3c2748-686d-4a63-863d-7f9bddac5d52", "comment": "Malware payload (Mirai)", "value": "f71c6d8db1cbdf41f101f6761760674f7ba8110e04aa5f76db961475dd5e6b38224a9fc5bdf08c40a0a33303d0a80776", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876622, "uuid": "ddf5f725-be65-4b41-9644-c46cd2e148ba", "value": "T13892CF2D68E5D062C2604D32C56FC906F252057E52F673E1391682E4AA9B9066AFDBC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876622, "uuid": "b3d35f00-3781-4c6b-a769-fd930175b9bc", "value": "384:7u1uGPCl4YYEJ9yyQ/9ceV14ThC9dDPwFLdOFXcAjce5n0EoW7AxAr1/LhymdGUj:ICl4189Y9csmC9JwdOFXco5DVWAx/LsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876622, "uuid": "ad50bfe6-0ee9-45da-a96b-401fa1c7f1a4", "value": 20868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876622, "uuid": "86efd810-c2b4-4837-a5e5-b341ecbbb1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876622, "uuid": "40344b80-dc5a-4f14-a3e5-5ff95cdc1674", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9badc8-3e86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776888084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888084, "uuid": "2e4bae2e-01fd-4968-b9ca-022f549e7418", "comment": "Malware payload", "value": "807c5c0be268bbc1976d0464e98704e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888084, "uuid": "35d9ef9c-1dfb-4716-afc8-343209c7340b", "comment": "Malware payload", "value": "9fa115d3d46b66b198a3d64fccba76e1bdc13f9fffacf19a9097a7f1cd7e92b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888084, "uuid": "db0d22d6-592e-4c76-958a-c242a04978e7", "comment": "Malware payload", "value": "a372ead74805811ea7f62e372043fdecf9dca403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888084, "uuid": "bda2ffed-a783-4dd9-86dd-976450710643", "comment": "Malware payload", "value": "062956ed9a41167f9ca4804d2abfcdda60e6f95833fcafd92a8d26814a0b8de7a9d28e4e0ac44be24b7f778f61c3756a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888084, "uuid": "e2c673b9-ab17-4cfb-986c-abd0f8cfccfd", "value": "T16527331CD4732C59CD6649F3854A3731FE72BC2A02623D7A22C9D7392B16C6E6CE815E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888084, "uuid": "eae51944-ad9e-4c72-901f-ee8f9aa6d9e7", "value": "43e4d5ad7954540310bc890bf4bd1b1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888084, "uuid": "bae7436a-a5ec-4d27-ac6c-de3720081b98", "value": "393216:IWRuuAvukELfXwFvseAMvKjONJZWzmmDCjIlUc0ylbzWSriGZ3ES+Fu2ohHXOfO:IWRuuAug09PjGjZm2PUaOHJ752O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888084, "uuid": "81c18ce8-0c6b-4e90-97e9-98fe9a675fbb", "value": 20376604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888084, "uuid": "1d13ea6f-8cc0-4e90-8a38-b3552c6fb2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888084, "uuid": "50a22559-e1d2-4433-b573-b6b496988d6b", "value": "fixed_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764739b6-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826418, "uuid": "2dafcff9-bf3a-4652-8315-cab4f65f5967", "comment": "Malware payload (Mirai)", "value": "b69704a706d046d17bde764ca3b6b93f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826418, "uuid": "ff1af368-4ad2-474a-9f55-84ac2ae1b345", "comment": "Malware payload (Mirai)", "value": "a06999d7ae2e1a9fe0f0e99181e0758b5c1b486a351afc164799f6e1dd9351ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826418, "uuid": "b667c88d-186e-49cf-90d2-edc96de3cc30", "comment": "Malware payload (Mirai)", "value": "9e6bb363a78deae5fcbf41ec3d35fb8ae12b7b25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826418, "uuid": "e821346b-9a36-4989-a1d4-17ced224b7a5", "comment": "Malware payload (Mirai)", "value": "8910ecbeeec796c037acae6a539c4c37ca13a93022b15fb7fcd609deb98c808a4c793ace3311383ed4d5b4ca0223f120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826418, "uuid": "892f2cb5-1ea6-485e-8d26-71d831102ac4", "value": "T1EE936CC5A743D4F5E85701B55137E332A733E03A602EEA57C3699E26ECA1950DB0B3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826418, "uuid": "6840a434-19aa-44a5-bf0b-9a963f8a8e22", "value": "1536:7apQddvjjh+C3blBFRC0orLcxtPzU/k7Tmmy5r40YINSN1FN4iGnq:2pQjvjt+C3blTRhorLcTPAeTEr3VkNcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826418, "uuid": "f1b99c26-db44-42a3-9bf8-3a05d0c64f46", "value": 97548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826418, "uuid": "e1b908da-e45d-4e9e-8cc0-d7be2fae9c9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826418, "uuid": "935e5364-b784-4f79-bdd8-3126f9b90719", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3624ecb-3e2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776849283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849283, "uuid": "121610fc-08a5-410b-925d-2cfb32aa0a49", "comment": "Malware payload", "value": "df352c21fd1392a37baa34d982cda5ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849283, "uuid": "08cb6d83-d251-4c7a-83c5-bac8c25e9ec2", "comment": "Malware payload", "value": "a0d9f28b0fb09a618eea25dc8befcf1748fa26b2dffe790d5c5599571c5ef2e6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849283, "uuid": "c9a41d5d-3bff-4298-ba12-77e1478c3389", "comment": "Malware payload", "value": "e4c866994b5a49499bdc90938b845738e6c67722", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776849283, "uuid": "4eabdffc-1255-4639-a4b9-b973997c650d", "comment": "Malware payload", "value": "eb4228b50da2b91bb83ddbb8a74d626b27c3c9df272adaa4eb8ccc9fa96b896e3d9ff7163a4524c7498377d1d89fceed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849283, "uuid": "c3c37f5b-7743-423d-a127-66c054776346", "value": "T12C137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849283, "uuid": "88209fba-c278-407e-8ad9-977a40bbbd0c", "value": "768:bl+b9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bl+scy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776849283, "uuid": "e75629ff-f8f5-4c7f-93ca-75112bb33619", "value": 45523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776849283, "uuid": "8d1d48af-63a5-4c51-833b-e7eb3f99c01d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776849283, "uuid": "5fced335-5d48-45ff-9cfd-ac2ce86d5ef1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27695425-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875677, "uuid": "6a597fff-8da9-420c-b604-db09190edb94", "comment": "Malware payload", "value": "b85df17007983461d713b7ddb35501bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875677, "uuid": "2fb7bc61-a192-4671-b601-38c3128ecf6c", "comment": "Malware payload", "value": "a0f0d318d17e7593ee642f773b82c975fb1d32f9c47219a4ea9de6f69e17930a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875677, "uuid": "6220095d-ad6e-43d0-bf42-c2ce75eb0752", "comment": "Malware payload", "value": "73e9e93c88009830b5ed147275a04c471733dea2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875677, "uuid": "93254f82-003e-4bed-874b-ee3ba8ada933", "comment": "Malware payload", "value": "d99a96ae31033a668dfb3d77ec745a86eb692e95deaf3d651c5510419d2ee866b84ed0d581b598e6ae61f20c3b4f99cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875677, "uuid": "f67c2ea1-7136-43f0-bb60-5d26f47d3bdc", "value": "T1EDB67B137B28EB0EC61862300CB2DE9467661C8501D7A597B785F319F9F20AC996FEF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875677, "uuid": "023d80fd-301a-4544-abd1-d3d6469cd4d0", "value": "98304:2nBnI8x8MUaEn6nUjEHY5ORPgRDRsOclHe/SDxJMAt32Gt:uBnHUl6nvHYSPgRDLc9ymJPt32Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875677, "uuid": "259ab6f4-3491-4049-93c3-26bfb9fb3723", "value": 11060299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875677, "uuid": "efa8250e-3713-4b02-a44f-8aa8e9b459ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875677, "uuid": "982bde1a-87d1-4aac-b6bb-4897d7a9e222", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410ac40b-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895048, "uuid": "89b2c8f7-c4c3-4c0c-96f3-6c7412b5b1f9", "comment": "Malware payload", "value": "261072ef6359e53f7146bfc78ddafd60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895048, "uuid": "e2803de1-c379-4f39-ad50-5ab74d0cbe55", "comment": "Malware payload", "value": "a20ba047d54c20114ebb73d5dd5ac99adcfd4141a4cbafc88645564793724e74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895048, "uuid": "efe1ee66-51f7-404e-bf8a-74e37b4b6e0e", "comment": "Malware payload", "value": "871b452dd8f0995cb59e56c44133f87f2541e82e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895048, "uuid": "16f0a0a1-edfd-4d27-ad93-64eefeaf5cfe", "comment": "Malware payload", "value": "2aa0815a6f9bef7a2b8cb32ca862f37c7038a44370586ecdb167ea983c3aa9f082512ba530ef5a9ac36a190ae5ce79f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895048, "uuid": "448e8398-7606-4076-b532-a5ecfc9f127b", "value": "T15A567C81FB08A126D94A0E324CA30F74B3506D86C2E4C96F5709F76F95B1AF65A4FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895048, "uuid": "f866052e-bbe8-4522-8c19-e62f86e5dc65", "value": "98304:yHPZUImClptgIL2i/KTOu8FHvPid60hTNOKRMBPLAY8RvjEJ:xL42isttdqh4R4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895048, "uuid": "708a7085-6d1e-4d0e-a447-da1ba54db9bb", "value": 6029496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895048, "uuid": "bf0f49ee-2784-4f41-9c19-684e36e11166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895048, "uuid": "177efeeb-2859-4904-9cfa-9f6a1c9e52ef", "value": "h2stream.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8380cabf-3e79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776882704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882704, "uuid": "1768d0bc-8996-4889-8f0d-ab65a2b3cf21", "comment": "Malware payload", "value": "c8f2341e6078971510e60a3a56eb76cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882704, "uuid": "8644a648-2d4b-4ba3-b5ef-a76627256ada", "comment": "Malware payload", "value": "a259bd78cf241d34a4de0f5cb76817d10e2dad456dc36b5caede4b455b47f44c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882704, "uuid": "b1393be1-58a0-47d5-83c3-311824674c49", "comment": "Malware payload", "value": "4db994030275dd6af11b82902ed8e9dba5fa0d07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882704, "uuid": "41d559fb-3cc3-4ece-b468-ca17cb65d184", "comment": "Malware payload", "value": "0ec1298f72bfb95bc755ef2c3a04ad3f496fedde2a182cf245241827511f86e2c6f136ecbd19e2ac2a3ea097bccf662d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882704, "uuid": "65ea1f53-26ac-4169-b650-3dfcd24f5175", "value": "T19607AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882704, "uuid": "3d0ac81a-dc2e-48ff-9195-65bfdce85300", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQL:cqYUQuVDt0TZEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882704, "uuid": "119eeb57-e321-4b6b-8dd2-1292f15f5c88", "value": 17858560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882704, "uuid": "d34bd0ac-f591-4cbc-80c5-5c554bb9cd1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882704, "uuid": "a03b3c88-ae0b-4ff0-ab52-079e18395c9c", "value": "a259bd78cf241d34a4de0f5cb76817d10e2dad456dc36b5caede4b455b47f44c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6e338a-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820895, "uuid": "4f1fd219-b4c5-4a14-8bf9-069c52b04d7c", "comment": "Malware payload (AgentTesla)", "value": "b39e921c03279f47bc1e5a0bef106511", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820895, "uuid": "d1c73fb9-65ba-4530-a7b8-a23f1fe2e93c", "comment": "Malware payload (AgentTesla)", "value": "a3d320f31a54a6e28b1f51d05a46c10da4b5048bc986f997deff5b4068afe1ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820895, "uuid": "9a1db292-476b-4675-8d2a-6808a69e6d2c", "comment": "Malware payload (AgentTesla)", "value": "f2e718d528a425ea8481f8d113adadb119836910", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820895, "uuid": "8aa29513-6488-4aa9-a52f-133b3e7bac36", "comment": "Malware payload (AgentTesla)", "value": "d7601ed67173b1f8e5eb4253f4a300186f68ee480bf024aea09d1d62ab59d863b56540da15686ee2ff661708c08ec9ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820895, "uuid": "6320c4cf-6105-410d-9c80-b9b190781947", "value": "T103743A70CA2001774F87AB9CBCA54662C6ADD315853B05F0E6D98B0D900E9ECF7BD66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820895, "uuid": "7f626564-9319-4438-b075-b6e351601e7a", "value": "6144:CJNFisJNSjkhevGS4cSvH206UBVk6ch1Q0/01SGQpc8Hxq3DZkJRZ+qpFOCcq5xi:CJbw6ZWmV2Qb5Qy8RrH7OHwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820895, "uuid": "534043e7-d3fd-4493-8ced-fd49b0e5625c", "value": 370552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820895, "uuid": "99782ebc-2286-4031-a65d-8731f588695b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820895, "uuid": "f331f4e1-141f-42b1-b903-e3f46af0f46a", "value": "IMG20260421-00215.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f7c7cc-3e02-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776831494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776831494, "uuid": "0c8c95d3-076a-4225-82c6-cdbee94f253c", "comment": "Malware payload (RemcosRAT)", "value": "41795c7d904b79eb1cc5357fe872769c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776831494, "uuid": "bcc39fb6-7417-4c5c-8964-5d7121c892ca", "comment": "Malware payload (RemcosRAT)", "value": "a3e5b1075ae19a8cfda04bbd4ff6035d3282ae1a32a818b5fe40052e293cd1fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776831494, "uuid": "ddbe40c7-7ee6-4a83-9248-12c2e85ed736", "comment": "Malware payload (RemcosRAT)", "value": "e98b5d60e4125dbdfdd658d5a734811fbb696b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776831494, "uuid": "ad5c9a35-2ad6-4bbf-9af5-3d02adbd8770", "comment": "Malware payload (RemcosRAT)", "value": "fc75842e7cdbebf010752e2bd9322832042a0b787850ddd4507aee10a78783c6f265bd3cdf4935798baa4aaf529cbb1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776831494, "uuid": "17d4c1bb-4919-482e-b6fb-2b21abc05209", "value": "T1FAA422212398E911DDA1067B2679AAF95BF67C209502470F5394BE3F7A70F80DD2FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776831494, "uuid": "4073d1e5-8d09-4bba-93b4-45beb73b6b34", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776831494, "uuid": "2dd7b95a-da5c-4e5e-8c53-7ef8ce22d77c", "value": "12288:5TA+Q4GgcipyJ7cY6C5rp7F+6Vt0SGZNu49ezMgI4:5TAP4GNipymdEp7F+kuu8eAgI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776831494, "uuid": "8dc84588-79ae-48fb-94e8-71c5c4802e95", "value": 473658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776831494, "uuid": "fd69b96c-efa9-4cad-9859-40f1a59fee63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776831494, "uuid": "33627048-5a11-479c-b951-4ed75c5088a3", "value": "TranEuropeasia_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75fd5c8-3e49-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776862202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862202, "uuid": "571c79ea-6006-4248-9842-c44dfd2c2682", "comment": "Malware payload", "value": "5f317baa03f9ad16dc3c915bab8bd822", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862202, "uuid": "9110eebc-9247-4584-9239-7e281e4fbc20", "comment": "Malware payload", "value": "a44fc5862479dffdfd7f886c39e322effb28731c208aa849060677cd910e40b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862202, "uuid": "507085c3-0fe3-49d7-99ae-6deadf413ee9", "comment": "Malware payload", "value": "8b0153e93b3453c21b36d946e51634b67e7ee2f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862202, "uuid": "817e94bf-005b-4455-9603-34b30966d08b", "comment": "Malware payload", "value": "83075cea10d2814fc6c2aacb934109c2398df6d7d78177cf2409f837aab4e461d8f019f1124f5d5074980046e601feec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862202, "uuid": "ad9f039b-9caa-4d79-bf5f-5c46f05b9583", "value": "T1C366231AF4818F52C5E224B6FA5F4264732747B9D3DB720296149B343BEB86F4F3A244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862202, "uuid": "76634d52-06cf-495d-9646-a9addf38b30c", "value": "196608:9x4AiH+Cdt5bPbLlhcL3X4dGyYIaDuazj:9x9iH5/5bTLlWL3IdG+ayC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776862202, "uuid": "66d1f6f0-07f8-4799-b007-8bac8d0aec04", "value": 6685458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776862202, "uuid": "116c7a53-2501-4bf1-a897-83b9930aa37b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862202, "uuid": "bfdddbef-708c-46f9-bbdd-65d938f8396e", "value": "h2rapidreset.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a45501-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848341, "uuid": "a79563eb-50af-495d-ae50-42eab80fe077", "comment": "Malware payload (Mirai)", "value": "4fa071c7fba5f2a704a049b224ed2ba0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848341, "uuid": "9f33d463-8418-4476-9fd0-3b96d41ab004", "comment": "Malware payload (Mirai)", "value": "a5036e7785aa6bd235b1f17a5cf9b28b9943a2d7ca7d3b86935abecae4e5dce4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848341, "uuid": "ba0dc740-2ce6-49d2-9585-630acca68999", "comment": "Malware payload (Mirai)", "value": "0a39a1985c1d2a716376b674b29e7b95d212ee27", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848341, "uuid": "ac8b4f25-a3f1-4cff-a5ce-2a0fff2d0de9", "comment": "Malware payload (Mirai)", "value": "75e4faae99f4bb4416b155ddaef1124fd662ac2a774764292715d283bc48bb2f35acdb73b2bd52b3e575fcc298d57ee4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848341, "uuid": "8dee2aad-c9ec-4df3-a470-eae024da390d", "value": "T1DE739D23C8AA1998C25C42B8B170FF3A6773D51056536FF6059ACA7AA047EDCF8093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848341, "uuid": "ee107c57-c425-4246-8f7c-dc4dec336b32", "value": "1536:0/K/lVA7lvTwpyo+gKoJ/U74svhQC96I9hIXm:0i9VUBwpyo+noylvhQNGaXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848341, "uuid": "c47ee48b-e437-4527-ad1a-7bb2aad49fe8", "value": 80380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848341, "uuid": "a8abbcca-2d0c-418d-bb2b-e6131dd8937e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848341, "uuid": "380f1cd2-a41f-4f49-96c6-74dd80c92c97", "value": "luxzz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3854a1-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894989, "uuid": "4243131e-59af-4f79-bb34-609912f89eaf", "comment": "Malware payload", "value": "da7c7a47bc04391f96f765a095a7634d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894989, "uuid": "4bb68511-e129-4840-8132-956b124cfed5", "comment": "Malware payload", "value": "a6767a3a7430bd3041fc0191e1ca272fee3ec905f1af70c988e9ce06c3b63800", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894989, "uuid": "77ace555-9cec-4849-92f7-afc355be1554", "comment": "Malware payload", "value": "99c2746cebed532987ffe0e6ed32025c01cc8e10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894989, "uuid": "23280856-e66a-4b05-814a-dd03a4deb291", "comment": "Malware payload", "value": "6e5a849d34ff29327cf37a2a6cfe5867e073776975cf927500e0d0cdd99d695bb0bee56169b18629bf8c9cf0ea9c2530", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894989, "uuid": "8efd2f20-e057-4d09-8a0e-1fcc83b12455", "value": "T1C58617627F89EE1FC39431358EAAC23433D57D0081E024369762F71D2EBB2A59967DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894989, "uuid": "f4457461-818f-495c-a422-401b83febcf2", "value": "49152:r31dO8h9EtoPJ0esa6PssG8I0qQsYfxQ9eUXCAHxvt5El:rW6RyYgARvjEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894989, "uuid": "0473eb7b-fc7b-4200-a24c-4f45a51f6fee", "value": 8257720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894989, "uuid": "cf7197b1-ddc1-4c9e-a3ba-c89f0614f914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894989, "uuid": "4a60d56d-6191-4b1e-89be-a2f60c22c1c7", "value": "h3flood.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779bee6b-3df9-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776827708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827708, "uuid": "c5ebd4db-f268-4a5f-a033-271d0aed09a8", "comment": "Malware payload (CoinMiner)", "value": "d2392c806ff6b6cdd20128d81b2a0291", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827708, "uuid": "6bcdfe17-9f6c-4b58-a345-5cacefa5fab7", "comment": "Malware payload (CoinMiner)", "value": "a714669b639da80a786bcc68ba53abe1d9ce4444a2655c4665420ec4067deedc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827708, "uuid": "6af2c529-25d2-4b3a-9fdb-111303a531fa", "comment": "Malware payload (CoinMiner)", "value": "83d4c339cbd3333ee80a1fc3da13c0c7e781b5db", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827708, "uuid": "180db271-b36c-48db-9564-6e507ee2c367", "comment": "Malware payload (CoinMiner)", "value": "6fb5da313200bc9052a335eab49a058c019075f840298569b97961c356b57be28f098224c1c86ae22b7168ad6b9832df", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827708, "uuid": "88ab70d5-6405-4f28-aed6-65a2403c6c99", "value": "T1E8427F1D6E4B4331DE5048B4E431824A553D2DE3B396EBDBE273D6CB0AD6E4588C096F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827708, "uuid": "14e99457-0989-49fa-a451-f1a76e24b3db", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827708, "uuid": "43654e81-5c68-466f-be50-22697fbb14a4", "value": "192:RmoaWd5OB7PCxymZKbPFJxTEZmFhk2c1VRpE:RmotICM3bPFwZXpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776827708, "uuid": "43733d4d-01a8-43e2-a667-b86d6cf8f101", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776827708, "uuid": "154de220-be3f-446a-a5df-d39ec0e36463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827708, "uuid": "02a113e7-9dfa-4ad8-a89d-dd430730f389", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac95884-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874985, "uuid": "c1cfeaa7-d83d-412b-af58-db9a582db1ec", "comment": "Malware payload (Mirai)", "value": "19612fe60996113bafbd1be3f3a82d5e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874985, "uuid": "6d87e03d-daf2-4382-a04c-849b6f3b7f73", "comment": "Malware payload (Mirai)", "value": "a753a1e79075fef2c8187d54476b21ead408cecc2e68cd89174ff7f342e024d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874985, "uuid": "b2a72358-9f0a-47d9-aa86-2f175e9aa9e8", "comment": "Malware payload (Mirai)", "value": "e7ff72b6e7896a05a328fd744b25e4a7a6b80b45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874985, "uuid": "3d4bce2f-f6e5-46a4-9dcc-5a9be95a3749", "comment": "Malware payload (Mirai)", "value": "6bf9c11655402c7d6ee58b5f234b66fec00d59603f0bb18e70a76606d85dccdb7a42b22102af1cd350cf7e40b5b0f633", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874985, "uuid": "504c36df-1253-44b3-b2a4-7b5590b73510", "value": "T12BB30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874985, "uuid": "db469d6d-86ef-4247-99d3-696f9409ffe2", "value": "1536:57jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxZ:1zPqF41OUBljSIxecUtCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874985, "uuid": "2f330990-449d-49fa-a85a-856e139b4e45", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874985, "uuid": "7948ddba-4124-494f-8471-a8d36c257987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874985, "uuid": "6caeff07-239b-4c93-b131-5519b8693b9e", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b2ff0f-3e5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776870042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870042, "uuid": "95756265-480a-4c2a-9ab7-6153bb22dec4", "comment": "Malware payload", "value": "607126717e862a67cb3777e918b62584", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870042, "uuid": "aa8cc96f-d01b-42f3-a640-254589e1cdd9", "comment": "Malware payload", "value": "a7733295d854f841b1276442181cb58adaa23ddc6ed4ed2bb9bb785fcf222f06", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870042, "uuid": "fa5fccbe-865b-4812-bb43-32810ad39733", "comment": "Malware payload", "value": "cefb7a6b24cfb769443835a7b000a62c153cfc5d", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870042, "uuid": "9c9c5421-6c65-491d-9f82-e53e3d290c04", "comment": "Malware payload", "value": "61ac34fe8ac3eb6fa1295890155981ebf65eeb213934ff800e10619cfa105aab81f71e3fe6c7ff34029017fec05c805c", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870042, "uuid": "b3cd99cf-f40b-4710-ba56-985b1bdb030b", "value": "T1D724D053F590798FD42443744AA364D0EA32EC177A564B8F3B0AB33A5E32AC1F572C1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870042, "uuid": "c3eaf1a6-b303-41fb-8935-202ef7b3d0c6", "value": "6144:zxEtjPOtioVjDGUU1qfDlavx+W2QnAkYa952DyplEjt2wNNAaz2C76XLUtXyctu:cp52yvEbzAPC76A1yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776870042, "uuid": "f3f566c0-82c2-4609-afb7-1e35aec818b3", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776870042, "uuid": "b0482817-0858-4166-8cd6-ac884875a101", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870042, "uuid": "a4f9bd84-1f42-45c5-a2d3-efe0f6e027fe", "value": "a7733295d854f841b1276442181cb58adaa23ddc6ed4ed2bb9bb785fcf222f06.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd22314-3e8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776891578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891578, "uuid": "d77ac472-8fff-4bab-ae79-033c6497321a", "comment": "Malware payload", "value": "06c7d4ef9101051a691d7fbf1788ac11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891578, "uuid": "2f20252e-25a8-41ec-b5a9-bf7134fc228d", "comment": "Malware payload", "value": "a86214f97c02e40ab21b8cf369acb3c1b6250011960afbc97e04040b2ffa5fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891578, "uuid": "4fbe6bab-1ebd-41de-b286-2d236880da37", "comment": "Malware payload", "value": "f1747bf7a54bbb7f54bb4556e0027cf47a6d0156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891578, "uuid": "eccb9bea-40ca-4d7d-9920-085480363f02", "comment": "Malware payload", "value": "bfceb9b7bd5f12bd9f8cf87f1c05505b79bb534785fbff8c5a2edb5ad7b5a20daab1f480eb9f7df94cc3b4868cd445e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891578, "uuid": "ceac698c-84e7-430a-9a3e-5d5831d2bd08", "value": "T1AAF23A487B98C12BDBAF0E7D75621A50167196621203DFD53ECC64EEFF937048612B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891578, "uuid": "600b9dd9-67c3-438a-8bc5-24e155bebfc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891578, "uuid": "fca0cc87-0b1a-4037-ab43-ad815edcf4a4", "value": "768:imQZqx1lYcTYbFyf8qbIjPjnbaoXbYC10ko0C:i0lYibIjPjRbPod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776891578, "uuid": "2a2679c9-6bdc-4c73-af0a-78d205b125b4", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776891578, "uuid": "a9673877-2332-48b7-a22e-c39cbaf03f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891578, "uuid": "a0d4724e-2089-47d9-a8b5-3d09756c1c7d", "value": "Silentum_Spoofer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397142c8-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895035, "uuid": "1873203d-71e3-4823-adfb-ca80f1b9f3a5", "comment": "Malware payload", "value": "3f87c1e54e8d3817b00b1d6f0dea4365", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895035, "uuid": "d4141d45-1703-411c-9fc3-9967f4207a62", "comment": "Malware payload", "value": "a896a8eb7bf6339d46085b161eef72a7c1304f7dcf522de957843e95c6e36f24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895035, "uuid": "ec3c34a3-4baf-4256-914d-43cbea0b0bf1", "comment": "Malware payload", "value": "eaa0a544e30a6439d81075bac87aef4fa4419ab2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895035, "uuid": "4020f79d-7f34-420e-8060-c101fe97c08b", "comment": "Malware payload", "value": "b2dc1f7913d6d121f2368a3a8e11b1304cf208bf33d65c4ca47bef213f77638c67d0481f2ebbe48a07af76ec7bddece6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895035, "uuid": "aaab64ef-f373-45c3-bb4d-7ce0ca32a6da", "value": "T11D563940FECB54F6E9030D3105ABA26F63325D058F25DBE7EA447F2AFA776A11932109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895035, "uuid": "c4180204-bd5f-4889-a34b-e4105f840cb8", "value": "49152:gVMjQXuNVBS703P8yfdgJ1STG8GFrQlYhWF6E3jRo85E0q:+MQe3E03dmCGL10lE0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895035, "uuid": "e63105d9-5a4b-4f7c-8261-8a1429a73993", "value": 5927096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895035, "uuid": "380376a8-e9f5-460c-93e0-3d03bb0223d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895035, "uuid": "a8ff024c-01bb-4016-a499-941735bbd154", "value": "h2stream.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e027c75-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897566, "uuid": "64d20552-cb7b-43d8-a4b8-66e0e403b184", "comment": "Malware payload", "value": "cf9ddd7f84ca606805ae6bc4abf3cfeb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897566, "uuid": "d301ff30-85da-4a88-ae0f-a572c2d8d178", "comment": "Malware payload", "value": "a91616943b38475c4e311b04faae04931da4d5f7e7a0a2e8d2b4a32e3f89de1d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897566, "uuid": "ede2be87-5cb3-4ded-af39-c07d3bef72e8", "comment": "Malware payload", "value": "efb3d3aaf43e1d607a06f63086369d83384cf5c4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897566, "uuid": "78e49ee5-a03f-4e8c-bfab-83656f506ce3", "comment": "Malware payload", "value": "eb3f56a54bda6ddadc2095248736d8e7845e8357e69dad88dad187c567bd64463e2b1d9dc822f480adb9b489e1e78227", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897566, "uuid": "417f85df-2569-4e04-a9b5-ac302d931320", "value": "T12DD2D1B056CA8022E9667637FF2201E71C5EA146BBDDB23B20750D57742F227D78E20D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897566, "uuid": "b63b81b7-9267-485f-a22d-f40559fb9151", "value": "768:t1TL1VuKAdcQLdXlnsHRRECCkbqOzp39Hc:txLjuKAdcuXF4hBVV398", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897566, "uuid": "7905f6b1-c2e6-407a-bddf-297eb5f1d3a1", "value": 29147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897566, "uuid": "9b0b4adb-fe64-4733-ac5d-a77fc49c27b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897566, "uuid": "21ded91f-b179-40b2-ab16-e9298d73fe41", "value": "FakePay-1.0-.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fa5f77-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877369, "uuid": "40d43d9b-289b-45de-8d8b-ab39b40a41e0", "comment": "Malware payload (Mirai)", "value": "c12abba21589449b03c9c4187ee78079", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877369, "uuid": "20a191bb-5e04-4cea-966a-ff4e747e422a", "comment": "Malware payload (Mirai)", "value": "a9676f16ec5dbe32e26afd37c6b7ad6afec80c4c6c5215ef409307153689cc70", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877369, "uuid": "b218c359-ff14-4d74-8e23-d0a64e5756f5", "comment": "Malware payload (Mirai)", "value": "0dce8d0c27ea1dfb52c6f177baafdbe397973aa6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877369, "uuid": "63ed1ba5-dbad-4b7c-b10b-653c354d1bc2", "comment": "Malware payload (Mirai)", "value": "69d9b9c210c291b00b125fcebf05a4393d9d2991b46690d8944b71b91df3a45f59fadf0b917f498fd1cf8db53afd2407", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877369, "uuid": "941a0009-0bc8-430d-8045-05854104b138", "value": "T11BA36CC5F683D4F6E8570571213BFB369B33E0BA2119DA83D3AC9D32AC91541D607A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877369, "uuid": "1e2aabce-b94f-4946-8d8d-8002c59061a4", "value": "1536:xNxKaizxAI+pIWKM5DXiBVjYZEtt06SIz1t+dG9UKVzSG2ehU:x8ziIYIWKmDSBVjYety6V1sdGC2eChU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877369, "uuid": "924a6f87-8bd5-488a-b5cc-40a1c4ee587f", "value": 105224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877369, "uuid": "0e49ebd2-af69-4071-8129-876d0dd5929d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877369, "uuid": "0748e5b1-99ae-4b51-b00e-ea29e1096ec7", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a20210-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1776884904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884904, "uuid": "9224cfe8-c116-4ff5-84f8-64320ca8e36f", "comment": "Malware payload (Prometei)", "value": "6a20b57564a4e264035291d16ebf90a8", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884904, "uuid": "c0ceee9f-4d92-40c8-828e-6988a304eeae", "comment": "Malware payload (Prometei)", "value": "a98bbc63d809a989033a8d94e3bcf67045077075e7c617866c02d64a96afee9f", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884904, "uuid": "1297c229-033d-4c01-b68e-ba63ac513539", "comment": "Malware payload (Prometei)", "value": "46dbd21c3662e520be5218f839ae39e3637078ba", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884904, "uuid": "a3bd459f-b372-49be-b10c-1e58e5c88605", "comment": "Malware payload (Prometei)", "value": "e40ece76cf2ad3c2abd458c4ab6cad165cfebd34ab0b88b6956fee77b408a8f9ddaead0facc466e26251a8048030bf5a", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884904, "uuid": "044a1046-81eb-4c11-971b-204bb4205098", "value": "T15B9423F4C3779BAAC5872A758B7AE381D674BD555BC70849B3ADE9330138322A750C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884904, "uuid": "94498640-90e0-41ec-b8d1-38c87d8639c5", "value": "6144:3584cmYYMg0EzyNP34/Aam6xbQJPlViUWxUzgFjVyBXH/0r1HTUcm6hE6:35843YYXyi4am6OPj7WaaVyJH/0ZHTBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884904, "uuid": "bd516251-37f5-40df-bf7a-47b409e64775", "value": 436127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884904, "uuid": "63b00a76-ee00-4182-b28e-38ac118272cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884904, "uuid": "09147c41-8763-4d25-8183-7933d7f48b4a", "value": "a98bbc63d809a989033a8d94e3bcf67045077075e7c617866c02d64a96afee9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f6b3c7-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876260, "uuid": "c7b68556-b0c7-4022-b11e-59febae66081", "comment": "Malware payload (Mirai)", "value": "ba36337e8e1d3755a1a57b1d353cdce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876260, "uuid": "97b85bd5-0396-49ef-921c-58aa68c276b8", "comment": "Malware payload (Mirai)", "value": "aa27a0e720e9914054b19edfec0260a9011b9480455e11a75d8da6b9e374d6a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876260, "uuid": "e4bc5d10-6d7a-4c65-9b7a-2a675b8cc9dd", "comment": "Malware payload (Mirai)", "value": "a11e9fdfbda42a5c784007f4bc02fa7c3a28f054", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876260, "uuid": "9f500dfc-f08b-4586-8a04-ab69cc8fa110", "comment": "Malware payload (Mirai)", "value": "964cbbe9229bba910671a8c9a90165d7605a5f1b96e0be47bae17a4f4470c24bbb54cbc86fa20dd0bd730b7f9b3e1b15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876260, "uuid": "d25a12af-4f43-44b8-ae0f-cdcd2cf5f1ff", "value": "T1B7C32956E7408B13C0D22779BA9F43513323DB5497AB630A5928BBF83F837AD4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876260, "uuid": "0405885a-1aee-4191-bbff-0dcdde6d7bda", "value": "3072:BpOadYcuBp9dsp0pQIkVGDRepM/9Hlkee:HOadYcuBrep0p7WGDR0M/9GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876260, "uuid": "79dadd86-1070-4ed3-8f39-05de1866e51f", "value": 119496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876260, "uuid": "2a049678-9d4e-446c-8d40-ca30ea34d75c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876260, "uuid": "170a1d01-f32d-41b5-be43-5c7c5bbe5c1d", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcb9c31-3e86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776888331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888331, "uuid": "15c88c04-1633-4044-9b60-0fd86fdd164e", "comment": "Malware payload", "value": "7822c139a87fcd34a9465f84fc64cd9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888331, "uuid": "7e2fb28a-f28a-4d26-8cd2-4fbe239275cc", "comment": "Malware payload", "value": "ab04a319756557e50d062c6a9112b2fc0e8e4a6c5e619fb6817176cafc6a1099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888331, "uuid": "abffd651-4c4a-423d-97bc-825a14095070", "comment": "Malware payload", "value": "f162f6ccf22d2e8faef874a5b0df9e97fec69a56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888331, "uuid": "2fdd4aa1-44c0-4a32-9adf-66e482e1b181", "comment": "Malware payload", "value": "734d7f559c0900a65c62459ee91a733f5b8cad578886e86158a243287d0caa2a507cc202c0ed8c8981247b37617a9781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FrostStealer", "colour": "#039E85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888331, "uuid": "a6a71177-d3ff-4508-a24d-fb6ac3d80278", "value": "T17D28E01663E112AAD577D138C79BA203EB72B407133097DF729C03652F63AE45EBA760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888331, "uuid": "2a7ceece-e3ae-49ad-84b3-e0597dcbfd44", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888331, "uuid": "3055f486-1e4d-45a4-81b5-0c122d3d797c", "value": "1572864:lVDG5MiP2aVxUXzF5EWkzvVJ2/gy1pMDud3a7xR:lVDG5NVy55Erzr2/gy1JdYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888331, "uuid": "6ea29747-6e52-47ef-913c-2c27155124c9", "value": 95741102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888331, "uuid": "deb01258-316c-4347-8983-d4db3d427ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888331, "uuid": "1e056184-e6f1-4299-9336-dbb90f11e664", "value": "discordidtool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e8a61e-3e1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776842305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842305, "uuid": "00debea6-2bf1-485a-b7dc-1c452a70469d", "comment": "Malware payload", "value": "96517ded54bd0a40c4bd192c7e0ed85d", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842305, "uuid": "c1cf4306-59d5-46fb-9c0a-126425b48cec", "comment": "Malware payload", "value": "ab06c82758b13a66396c48129c580e51e66ea72e9319b4f708f94f0c22e32310", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842305, "uuid": "e95598ec-9ae2-4d31-bef0-7acaa2df6b5b", "comment": "Malware payload", "value": "99b1fe88a0ed70449215fae7d68c0cc6f3889720", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842305, "uuid": "840c8e2d-0f70-4af4-b128-aadbb70b718a", "comment": "Malware payload", "value": "1f7d343191eb6d23787a69c97462b8ce947eaffbcaf022701150f782496ed61f64db88b7eb531cafba7cdf66427442cb", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842305, "uuid": "978a65ad-887f-4b88-89a0-96017ccab239", "value": "T198A54931779AC12BD96215B06A2CCBDF6168BBB11F7250C793D81E6E04B48D29732E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842305, "uuid": "3887a7fc-77c4-47f0-9f35-ee4ceaf1589c", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842305, "uuid": "f2f9ad60-77ed-4f9a-a508-96d2647b81f6", "value": "49152:kfImZfi2k8XXSSRrHWaVFuHT8xyMdVNzCboTUD/Va+FN/BJ9+mIY:MImZBk8XXSSRr2aVFuHIx7XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776842305, "uuid": "4e414bdf-f88c-4d10-a9e9-51553e09368e", "value": 2189312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776842305, "uuid": "8f0812a7-f5c9-46a2-953b-95270fc039c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842305, "uuid": "2b9733f0-5aca-4fd3-a61e-dd85755acbd8", "value": "KISSofSIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba364b72-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776851013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851013, "uuid": "728f585f-3ca1-4485-b6d7-c30e30ec0731", "comment": "Malware payload (Mirai)", "value": "f6786fe65bdc0fbbc87599e511d91716", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851013, "uuid": "c98da572-d42c-4abf-a522-f4b2d6e8c06e", "comment": "Malware payload (Mirai)", "value": "ab7f10170e78a21139787ee9118d91d66de7cba42415ae7979ac90d2d553c368", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851013, "uuid": "d9fc9a60-b7e4-4c49-8841-86254b60c901", "comment": "Malware payload (Mirai)", "value": "2c3d22116ab4dab56b05724763d39e42e5a6192f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851013, "uuid": "6545a6b5-3637-420a-8a0b-201317ac3753", "comment": "Malware payload (Mirai)", "value": "126b4f9c7cab5edb25fa5fa589d1af46ea74112f948d1efb88bbfaadf984a3269a1e021117b09919e17148c5e84337ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851013, "uuid": "808deb12-61f5-414c-95dc-b13e282a75bb", "value": "T131F0E2E6A13017A3C101BF09FB7683E4E15269CA1282AD34B6E4706FC63C468BAA1218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851013, "uuid": "08b42bb6-8afd-4e34-8daf-9df61927968f", "value": "12:p+rM4+y+p7Ai+rNIh5akJL+7cKLKni+We2:QrUhp7AxrNIfaks7XKxWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776851013, "uuid": "39e645cf-e4a3-487a-a976-c09769ee7045", "value": 509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776851013, "uuid": "432b2808-9dc5-46a1-91ee-6bb00510fe31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851013, "uuid": "5add1244-d650-4345-ac45-41f374df8340", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b883c6b9-3e1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776842850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842850, "uuid": "934c1b7e-2d0c-459b-b215-d81c7fe1df49", "comment": "Malware payload", "value": "b11084e6cb11b00a78cfc5d909f1270d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842850, "uuid": "552bc26f-e20c-4747-8ad9-c1c574e32201", "comment": "Malware payload", "value": "ac09ab998bad811e567f250ae8e93ef189e62eea17ea630990f368446a944a8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842850, "uuid": "fae0e98e-d417-4308-93b8-25e0f0ea9fa2", "comment": "Malware payload", "value": "b9e8224deb862084b100871a9e8e7f2d7230f105", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842850, "uuid": "cab35626-cb82-4bb4-8853-0328943711b4", "comment": "Malware payload", "value": "b60813fd5ed2decaa5db5bc6a338568a7c98af50f9be82a1ead866565ba7fd930fb00785b856410ee4e1cff84731da5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842850, "uuid": "93f125fb-6628-4d23-8a2c-ac843463b547", "value": "T14CE45B7B91686589DC9B72B46BC73AB7FC11BD393320D5D65E03032C9DF06369A2821B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842850, "uuid": "046886fe-2199-480c-9110-4fb6f26cc2b4", "value": "6144:rU7HX6JxtMMy/Oj174Kfiu7n0EZGSpo9D6v/JPCBs5YNGj9TXaot5uS:rULutW/Oj174KfiuL0Ipp/JaBs5WGdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776842850, "uuid": "1cffbe74-c6a0-47c1-b64d-806462ad9ae1", "value": 690528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776842850, "uuid": "6455c41d-e584-4cb3-a057-bebb11c2088f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842850, "uuid": "22bec1a2-6ce2-41a7-9674-a6fa1f00a96e", "value": "gPasskey", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b7aed0-3e79-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776882565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882565, "uuid": "57ca1d66-345b-4e40-b022-b519bb0492fe", "comment": "Malware payload", "value": "9c04b18e66a2010615e453afce18c9a4", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882565, "uuid": "92729bd7-48fc-45ba-bd42-aee773e3907b", "comment": "Malware payload", "value": "ac132e2f02f64d2623e776486b6844f93edce4a08dbd0879d8748fd4671e637e", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882565, "uuid": "719ab8c5-dcad-4c1a-a9df-bb6eeafeb29f", "comment": "Malware payload", "value": "ab6150c3dcea529d28ba30665e1d8f36e1403c4d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882565, "uuid": "b2028bcf-d37c-4ab3-99d5-e45708c46c8c", "comment": "Malware payload", "value": "555efce0235c1dc8ef87373d42de854caa6d06197cd252176e3fe1940d8e2242ed0effdfead49567eba81ec6992eea31", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882565, "uuid": "f6bcc622-f131-4074-a489-76c0eed59d67", "value": "T1FE634A0376E0C072E8724E3519F485518BBFBD529EB49D6B3798029D4EB26C18E38F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882565, "uuid": "bfda6ff4-fde4-44f6-941c-234ae2d15620", "value": "80b89b18f355b889f93accebdcec4bfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882565, "uuid": "9c17fc72-87ea-46ad-958a-6321d0ff6d7b", "value": "768:Hu91QojVMNCvvzdnBGzJ/YNSNK0cNWIioLsWjcdRPBu7mLIjum9hTQ:Hu9fCN+dnB4cN+asWjcdbrm9hE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882565, "uuid": "c41462a7-38e2-4dff-8ef6-55b8e785afd1", "value": 67032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882565, "uuid": "d22ed911-c505-4482-b644-cee133c99b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882565, "uuid": "471bfb3f-a4b7-43dd-bc78-06b0f3578c5c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdcf6c3-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820791, "uuid": "2025cda5-5662-4a85-bef2-6c6035805528", "comment": "Malware payload (AgentTesla)", "value": "0ea192e3607b83e9b97fda2e2304f39f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820791, "uuid": "7e8befae-f040-43a4-b07c-0e4545f757a6", "comment": "Malware payload (AgentTesla)", "value": "ac2dfd4519b1b8a229335e4d6f27a39400cc9e55d387958f58d17cbe2167dc11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820791, "uuid": "4211637e-39ea-4cc3-a169-77ec339a525e", "comment": "Malware payload (AgentTesla)", "value": "e641f9c5cbf7eeea5580417376e7cfea93d2b556", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820791, "uuid": "76102297-5a2e-4858-bb23-940bf1d9d69b", "comment": "Malware payload (AgentTesla)", "value": "20315189eb1f416cb2c044237a8f21aadd9bb9997a941f1903da8d0dfbded34e888efca4fec5e61b350689546d5b4ecf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820791, "uuid": "3bf8bbe9-f31b-49fe-ae56-6ede5d43309e", "value": "T107743970CA2002774F87AB9CFCA50661C66DC315867B45F0E6DA870D900A9ECF77D66B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820791, "uuid": "8efaec7f-8762-43ce-a89b-8afdd5b7637f", "value": "6144:zNdWzVrrxjNveevD4+OW266aWh5jEE81MjUTyF5Z+QqGXB3jVts0IvZoESznhx26:zNcfz5zq52MwsZfqWQuEwi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820791, "uuid": "597cc3da-efcf-4c95-b699-11457c97a2c6", "value": 369446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820791, "uuid": "b116ce62-658b-46df-ad5d-156e8cf5e4c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820791, "uuid": "30027c39-ac64-4f16-ac29-5f22d714814b", "value": "20260421-02741.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8ce8c6-3e63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776873408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873408, "uuid": "9f5ec9da-878d-4d93-8d46-11b0733a3ca8", "comment": "Malware payload (Mirai)", "value": "cc982e122674279b85ee0ca2044e78ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873408, "uuid": "360e812e-1088-4a6c-820c-6a2aade4950f", "comment": "Malware payload (Mirai)", "value": "ac98429bc3b61be71bbb6e864d568ee8078b53b1889532cb1b29d0284bcdd501", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873408, "uuid": "17d92e8c-bdf1-4981-bbdc-e44ca2d8acd9", "comment": "Malware payload (Mirai)", "value": "985219699494e74cd6ec864ea1e037d95971b499", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873408, "uuid": "94dc4be5-9221-4506-84fd-08a572b3235d", "comment": "Malware payload (Mirai)", "value": "45400d1c8f4d4db3a9deeb7964e375baca90d0d35a829c75e5c7bc6ded686d528f550969a37ad87ec94349bb6cf564f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873408, "uuid": "792cbc68-c620-48d9-9999-d0d755933757", "value": "T1AC63501E2E618FADFB6D873447B75E21F24863D212E2C640E15CE9015EA034E785FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873408, "uuid": "9985871b-2b32-4e1a-9c3f-95f17cdd3c93", "value": "1536:qZSWtG1Oyu8jDZAjvDSlgCziwZwnfwbZnD:+G1OMlAilgCziwZofwbZnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873408, "uuid": "7cd99cc4-b883-434e-977a-8ed1003a9061", "value": 68008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873408, "uuid": "a5560994-57b8-460c-b240-5d5cb63abf52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873408, "uuid": "2d9cfaf4-2984-4796-acdf-315aaa68347d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06babc8-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880310, "uuid": "f4461b0f-3f52-468f-8963-48c0c2e8ba2b", "comment": "Malware payload", "value": "b612290f6f671c943588ef66bc4e470b", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880310, "uuid": "9331b0f0-3e86-4241-b1a0-8d96fcc9a12b", "comment": "Malware payload", "value": "accf72d78f54cf6576189ea7765e9929974aa9444d33607d99f663a2cb35d6f7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880310, "uuid": "cf884de3-8f88-465c-98b2-6893e463284c", "comment": "Malware payload", "value": "2faae3f21689b2a2cbad6cc6adb880d69d25ac6c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880310, "uuid": "4e0ab0f5-5ebd-4d3b-9ff2-8eaaea102bba", "comment": "Malware payload", "value": "727a9c1181fb4d81bc979de7bd0df86544f7f1e6bf9c08440e7a81100c7cbeaf79edfdf537f7e7c1708c83f0913988cd", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880310, "uuid": "b828337e-8b71-4861-8661-5a3f7c1874b2", "value": "T1EC362332AD44086ACAD14336B05B3E316EADB743078C94DB356DB2863B96FD0D63F4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880310, "uuid": "5c486017-4c80-4cfb-90e2-369212028091", "value": "49152:TZtyfEWSpQJMs5cJTWpO+X8s0MXv1rCe4yiGnKUKek/ZbaB+h:3Za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880310, "uuid": "3aae1674-9d44-45ea-9b2a-764aef20fcdf", "value": 4872192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880310, "uuid": "ce07fb9a-52b2-4934-9b79-d44d5630224d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880310, "uuid": "95009701-b1c9-40d8-87b2-f5017de02417", "value": "sP_30465386_CmbEIMUEB-23969.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a266aef-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776882312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882312, "uuid": "8abf0d2f-8f49-4b10-9fce-71e8085ef58d", "comment": "Malware payload", "value": "f1dc5f7d00388128a559b7a28b30a695", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882312, "uuid": "c4dca737-a12b-4ede-aad2-5de9f7ceb158", "comment": "Malware payload", "value": "ad5cfa6a75be9ee08001b4a46db7b89c53e4c19836a600507efb8a333670b4ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882312, "uuid": "a8944172-941f-4b2e-ba4c-64f0163ed349", "comment": "Malware payload", "value": "18fb6788d9f5a531c95f84a25044feb4f0d540ae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882312, "uuid": "91a7fcf2-4186-4dc9-a720-8f0d0d2bf4ff", "comment": "Malware payload", "value": "e80b21be73a0ae005bf16ec9a8335451bbccd2bc6728c00b6313666394738dee5c98fcd8c7c342f9d0c0bdcf2225a80b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882312, "uuid": "979f44b0-8f75-4ca1-b7a0-7845ef513124", "value": "T116215BABB524A9B6B49FC1342A4A21016545011F41915C39704FEC7D2FD83CCB5FC6FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882312, "uuid": "dae30658-14dc-4721-930b-9c0d89193569", "value": "24:zuWWDjIJIKECPCQ5Xl+/ydjv6d/gSxL5x:zuzDkeKEcCQC/Ir6d/gSxL5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882312, "uuid": "cacfe7c5-4773-4501-8bf1-1dfe7c44bdc8", "value": 1230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882312, "uuid": "322c37ba-b4db-48d3-8b03-a369990ec255", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882312, "uuid": "205c5594-0c07-4edb-b161-6e6e399032ec", "value": "check_bots.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d33e557-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877351, "uuid": "3b06f44b-d2c4-454f-ae5e-70f77719aa57", "comment": "Malware payload (Mirai)", "value": "3d68d416d40a61b831159c28bb5f19dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877351, "uuid": "66cdbb95-9b70-463f-be0b-8fc296fc1b6a", "comment": "Malware payload (Mirai)", "value": "adc4173f12b8d59c145d3b624a6a07ab3204692b87d09a3da579625497f7f9ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877351, "uuid": "2ad23dfc-2d48-4a93-97df-b0224de56b4f", "comment": "Malware payload (Mirai)", "value": "e2c2bef979ab558e82c4885441c2d92ddc679ac2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877351, "uuid": "7c226479-a579-43fa-8716-d4db108cada6", "comment": "Malware payload (Mirai)", "value": "b81222a8b4efe0b741078d1c8d5edee0f5e76296093fafa9dd6ac602bef248d617164362fb2562e134c9ee8a8cde07ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877351, "uuid": "d619a7ff-f9d6-4646-9684-05719182e07e", "value": "T12F14C709AB910FFBDCAFCD3706E91B0139CC644B22A43B357674D528F54A54B5AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877351, "uuid": "ff059e00-5228-4468-950e-d6b2e8305ed0", "value": "1536:Mu/hOZZNY/nz30kswX+UNofrUcu4t7tMJ+SnIoGvjuxR+9oPUkWZ089SZM+fTfDh:Mu/hOZA30YoDZTHMpKoPFWmTfGZhmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877351, "uuid": "680954c9-c8cb-41df-97f2-8c1fcf817246", "value": 198280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877351, "uuid": "62bd1f98-d99c-4e1e-ab5c-8368c605056f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877351, "uuid": "96075c8a-a6fc-4430-838e-62222578c095", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3ccf89-3e55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776867039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867039, "uuid": "6b76157c-6ea2-4cb5-88b2-a59f7493b6fc", "comment": "Malware payload", "value": "5b6ec12d8988d81a98fbfe207a5182c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867039, "uuid": "4df756a5-d8c7-4319-b8be-ac36b975bd0c", "comment": "Malware payload", "value": "addae6c82dd407f54d8c0fe9ee223d69011dd2f03cb3428de7ff411924a30f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867039, "uuid": "78081436-dab2-41b9-af5f-9032a8199dc3", "comment": "Malware payload", "value": "36994d08f88baa92b1142a753f065fb64a809cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776867039, "uuid": "ee12881e-f926-4a3c-8861-7e7e71d2b2ba", "comment": "Malware payload", "value": "210043dc0d91d2f7be69fd3c0e3880aacd57937659587d1beedfae61f83b43fc02c2a244f2533b6090c4d4f48d1ce400", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867039, "uuid": "ab427a5a-83e4-4f99-a87e-ab07849aafc3", "value": "T1BFF57C5AA7AC1194E5BAC17CC9574637E3B1B81A87B05BCF08A6C1780F27BD6273DB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867039, "uuid": "2d91c5b3-4213-4406-aeee-8c4555be7c18", "value": "6faee67a691b5510cdbffa2f65fadb6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867039, "uuid": "ddb81927-ae0f-4afb-885d-c9d876ca5fb2", "value": "49152:/VwASOCVIU6i/8GtlqOWOh5P2T4FI90g1ZPGgPnokygk6Z7y/tXrkV0d6NPiv/8x:ay+udPPzb3hqY0c8v/8t1CPwDv3uFfJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776867039, "uuid": "ad059f99-e9cd-40aa-a8a1-e1f8e2e6b40d", "value": 3430672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776867039, "uuid": "d7ae6d9f-e336-468f-a583-c854c165d0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776867039, "uuid": "64df1989-953d-429b-81e9-280c06e8e824", "value": "addae6c82dd407f54d8c0fe9ee223d69011dd2f03cb3428de7ff411924a30f98.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56eb49f8-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874039, "uuid": "695c75aa-9f47-402b-b565-0a91459431bc", "comment": "Malware payload (Mirai)", "value": "9475dcf1deda59469e6ed7244d066a8f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874039, "uuid": "3394bcea-2d18-47c1-88be-ddacbc925b4e", "comment": "Malware payload (Mirai)", "value": "aed006430f23964e3ad5d4d23665da72d838ac160f3909f8b35d6d1937b015fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874039, "uuid": "0ba9f2e8-71db-40af-aaa2-ac8d79099274", "comment": "Malware payload (Mirai)", "value": "1c37917ee648753423f918cd399f28124e64abea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874039, "uuid": "c451e1e4-4778-4146-92c1-b8e9e38baf4c", "comment": "Malware payload (Mirai)", "value": "313afd828ca0722f3f2994f1029268030c9fcf956b82d1f7d674ea1b76c2f110ed68ec35893ad1f7f6fbae2410663069", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874039, "uuid": "4692bc94-f228-4e31-91a1-19e342864ac9", "value": "T1D7E5F81F5E319F6CF7B487344BF34B34D7AA22D617A1D980E1ACD1085E6025E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874039, "uuid": "cac80989-9fb9-4d87-81bf-b1775c5eeb7d", "value": "24576:UyLWBpYoRsWXLnH2YcsV++/ApG+dkTmxMU+RtBvypk8uBATgLjyDg8zH3o1KTIAM:lWjaYKwmhZxMU+ypkNonTkivPM0Dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874039, "uuid": "e65a5ea4-c9ed-49b6-9926-f9f884f781d1", "value": 3168540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874039, "uuid": "0946fece-f631-4555-8d8d-83da1df6951e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874039, "uuid": "08ec9719-b03f-407f-9ed8-907bf85e62b0", "value": "ciubuc_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238f718b-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897575, "uuid": "e7df94a3-f188-4696-850a-9f50d79a4a32", "comment": "Malware payload", "value": "252d9e0cfe80d9f0bc4a2300284ae6a3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897575, "uuid": "5aa8ae8b-b1d4-4b96-bf37-88a6a2c75b18", "comment": "Malware payload", "value": "affd48499021eb000aa3701533eb8d540bf64787f257fe2577c028df919a367a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897575, "uuid": "415da294-185a-442d-a43b-69ee47a76fb1", "comment": "Malware payload", "value": "e7de39636aaa8ffa4991e5f77fb2bd49c645afb6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897575, "uuid": "e809a229-6411-4997-b716-4e70004290ed", "comment": "Malware payload", "value": "c93db4972dae0e1317c7430275422c3076a5f5f17537aa2b17e697e4a3f54c1d152b2ee94697efe55351b81b755152b0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897575, "uuid": "8e45f6e9-5768-4122-8f79-1510b2cb258f", "value": "T1E943D033322D6230DD6F7FB6C42520F2199D0B90E426723A607427AB1F5F8B9E756B24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897575, "uuid": "8a9a9920-e988-466a-bffc-76136d3387c9", "value": "1536:O/FjnlhqoLtXF+BX0wMNK/wRID72ou1vliPZjrRc:ONRgYtXYdUNKYCZud4jrRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897575, "uuid": "3585542f-01f8-48b5-9d8e-833fa21dafb0", "value": 59020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897575, "uuid": "3296ef44-5b70-4f54-8c9d-a319e1b88b8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897575, "uuid": "478f6d0e-52ae-4da9-89aa-389a7d62b314", "value": "FakeSkelly-V3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fba68b-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876727, "uuid": "8e2d879f-9486-4e94-b574-59dc88b3ea32", "comment": "Malware payload (Mirai)", "value": "2a5d1e9883144e0aae3dadd1ade63b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876727, "uuid": "4737b1c3-5535-4aec-bbbf-1aff99c7ac8a", "comment": "Malware payload (Mirai)", "value": "b0abc24aa336b024606c67d3fba716c8c869a496e5c6e689e878bdfdbfe4990e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876727, "uuid": "c20d9dc5-08dd-4e12-ad54-5a50c079a50b", "comment": "Malware payload (Mirai)", "value": "f6a1319bab4384fb7e5bcb07fef40e5000a76c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876727, "uuid": "563f1d37-4eac-4271-81ff-9b860d6a6882", "comment": "Malware payload (Mirai)", "value": "c088615f6b5852e94b06452cf4de3127e560ee3ab9e6ec259b3d97c2f527106a311b57544be4752e158df1ae82fd4a1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876727, "uuid": "321e3df4-24ea-4db3-898f-a3367a42276f", "value": "T1E91329D2B8C29B37C1E0127AE56E805D3325A7E8D2CFB717CA156B417A8A41F4D77B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876727, "uuid": "2b638e81-7989-4c8c-91f9-c9cd730e3d30", "value": "768:fJlaRQ8XJe0q0QZWHsdzstNgMZeijbjz+HyFlMGWowq71dUx:fa/Xs09QWNgeRT+yF3w61d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876727, "uuid": "6c2dbe10-3879-4614-adad-11538ce81176", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876727, "uuid": "b7248bfb-270e-4996-889e-5858ce3f0b33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876727, "uuid": "e7cbb9c0-e586-4522-aebd-944910a9e06f", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8431778-3e8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776891436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891436, "uuid": "8d4e8148-ab69-4d31-a016-1aa54c3fc3d4", "comment": "Malware payload", "value": "7d1118e9ceea84cb5bc4b4fe42ad1b76", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891436, "uuid": "6e1e8241-d790-4a65-b058-eb46c34604c5", "comment": "Malware payload", "value": "b0daf3c20b12df60f4e830c9ca775ce5d1f191c92237107bef05ae3ead8282ab", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891436, "uuid": "9cb72a9e-37b6-4d29-9cae-b5025c06359e", "comment": "Malware payload", "value": "1b14afcc0eb1f5f1392c4ef30a22699b64c3f1a2", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891436, "uuid": "05827d6b-19bc-45eb-b9b9-00b2b0a086a4", "comment": "Malware payload", "value": "3caf8688d9d6eb18d764d3d4267a6d00cebcdb141848ca3165ba2a9574cea1e2ee9b6498271e3d5834d089d8b21c0b63", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891436, "uuid": "a838ea52-89ea-47f3-bba8-883588fd0e65", "value": "T155E4F236BF9048F9D127C077C6450A66FAF274860B22A9EF125442392F6B6ED1F3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891436, "uuid": "bdfe9a36-d0f8-423b-bb1c-bda28ce0633e", "value": "99caa2a3cd26103c5461ceb6805bb5d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891436, "uuid": "1dfea91e-1408-457d-ab0f-a76672e13eff", "value": "12288:cKgRJivc6VlTDf/V3YOwzkIKhCETR7323oFIDnZEfPWWtph/38lP:cPivJvV3BwQNhzZ323oatEfPz78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776891436, "uuid": "e4afe6d6-52f3-4854-8405-b129a60273c1", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776891436, "uuid": "8bce4f48-f06e-4851-b8f0-18f5608ea056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891436, "uuid": "33cb393c-006f-48f0-a0af-676afbd142b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ceaf233-3e1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776842803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842803, "uuid": "da681b24-cb46-4167-906c-828daf449fe8", "comment": "Malware payload", "value": "e8d9277fd279da18666c283e55d44808", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842803, "uuid": "e1ae1d0b-b833-46ca-8635-14426b40afa6", "comment": "Malware payload", "value": "b22f84c5292fea15b55c4b1cc8c8506c9da2e110f2a9c0a9daa902d8d5aa4f73", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842803, "uuid": "43c76ab3-bb31-457a-9fbd-0d62a7213f6c", "comment": "Malware payload", "value": "891331afe3e1b069e264614d2fca2d004d8047cf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842803, "uuid": "85252037-d84e-4e21-bb21-9007efdafe94", "comment": "Malware payload", "value": "47548247d20c498b1183f27340c8a503644209ae58abfb119429917ba67407cf935b7b4bcb620ea5cc8a2e8a47753e4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842803, "uuid": "38b0f7ab-942b-4d55-9a7c-7e09873a050b", "value": "T196D43A3B51F9E900CD0BB278BB873977AC02B8B823B0E4D64E074639E9E5771969415F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842803, "uuid": "2229965b-5f43-4ad7-97b5-b1749811a5f3", "value": "12288:/MxeOvxTmvn2TN9X4VWSWra0au4g0qE7moES0oTluWPx:/Mx1xTE8rajgZxoES0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776842803, "uuid": "79b0b7fe-604c-492d-9944-49b70468cf1e", "value": 640560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776842803, "uuid": "bcb48342-8e0e-4864-896c-0cce5153d7cf", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842803, "uuid": "08df4e3c-e277-43e0-9229-16f5ffd2a3ab", "value": "googleDataExport", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78622d83-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848325, "uuid": "1bd17989-1d2f-4882-ad48-5ed241506744", "comment": "Malware payload (Mirai)", "value": "08f52191964e26cd96ea9c87116bc392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848325, "uuid": "511aa076-7dc9-40c3-bf1f-4d0d44f819f5", "comment": "Malware payload (Mirai)", "value": "b3b725c32a315322fad97f696ff64cd40212213e397e643737a2819cad4236ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848325, "uuid": "b7da1e6c-9846-498d-84a6-c9f0abffd815", "comment": "Malware payload (Mirai)", "value": "5e1b96a2b94ab060666c0a31daeaac7da9b167ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848325, "uuid": "d3508621-a991-41b2-895c-9197a40d1a3a", "comment": "Malware payload (Mirai)", "value": "9e16d4eebcc32a8693a257674bbe56b537b93f61d1b9ef9a5746737cc30beaa8eefa27eb6f89d7cdfd5a64d07ac52b16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848325, "uuid": "471ebd42-7000-4eb3-9337-042d9bd8ac6f", "value": "T1C5432781FCD2996EC2D4137AA73E358E33A1B3E4D1CA3613CD585B25338A68F5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848325, "uuid": "8268edd1-f68b-4be7-a130-6445a3a2e3ba", "value": "768:7cyHonuEHsf/StW3cQoyHEFM01Bh5g72S8kTIMAcLD6IoNTitXDMfg/BNxTWnDlI:7WnnHs36AfnEFMqgNcMTLD64tXD7tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848325, "uuid": "3d805ea9-3e1a-4b8d-8f06-3c139ce48115", "value": 55888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848325, "uuid": "ce7d7d7a-4177-4021-bf89-e97a5d075639", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848325, "uuid": "8fb71f12-6c66-4ec4-93de-c7b30c563539", "value": "luxzz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e5c9af-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876240, "uuid": "dee46810-7484-48d7-ad25-473a6fd97ad5", "comment": "Malware payload (Mirai)", "value": "fd65a444c9d0405a2370c5adf91d23ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876240, "uuid": "7f891d80-f84e-4ee4-beef-c3b5b272c89b", "comment": "Malware payload (Mirai)", "value": "b41e43021ae1df49045ee9fb03de6255481c475852a2835c338ebe6ddac0d55f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876240, "uuid": "0a4a2d2b-427c-4729-be59-7ef02fd211ad", "comment": "Malware payload (Mirai)", "value": "2210c120057d5af87672b21fdd58144892a9373a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876240, "uuid": "57a0d5e7-3678-4293-b464-ab2dca6519b4", "comment": "Malware payload (Mirai)", "value": "fcfbec285c79241a8fa4b10d7720e70c6c442bc72e403d558a3f849a96cc250abd251cecad77a2a4d6fa68986b243723", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876240, "uuid": "e840c660-a816-4d61-af3c-62bcd57bf1e9", "value": "T19B034A92FD418B13C6C1117BFF1E828DBB275358E1EA7302AE25AF21778355A0E7B152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876240, "uuid": "950a26e9-7d47-4436-9338-ef32344a8c92", "value": "768:vhicfd5rcVGU51zMa5IspWO04VebH4lNS+MzdmSJvTGjI:wed4oa54OJn05Zjvyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876240, "uuid": "e01683a6-e5be-4063-b52f-2bc2e8117a0a", "value": 40324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876240, "uuid": "c6f84126-c1d9-4167-971b-b53d207498eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876240, "uuid": "62d89029-d149-4fdb-a9b7-00d9db40f5cc", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2adbc833-3e15-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776839605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839605, "uuid": "0e2b9fa8-0325-484b-aa6f-2cafa89b629d", "comment": "Malware payload (AgentTesla)", "value": "23ea87c7aa4b4a438e5efb6a152458a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839605, "uuid": "5a570693-0afb-4a25-ae70-e455d9dddf31", "comment": "Malware payload (AgentTesla)", "value": "b5208e91338567d9c4d2011b40ce6763c0385f0f783f79ca5d992662958715c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839605, "uuid": "c2232719-6328-4d39-bb4b-50dbd5b76c3a", "comment": "Malware payload (AgentTesla)", "value": "ef9ff61ea0048e79b30f0a91227f951713f39394", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839605, "uuid": "92e2aeda-6bfc-44c3-859b-ee993cf10a29", "comment": "Malware payload (AgentTesla)", "value": "b217b852cc3d394e3369a679b93f92d2213acaf870278ca1025b60601077c5e3a689813c54c854bacd00b5694d6381f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839605, "uuid": "c5a18a5a-3d6d-42b1-8a3d-8f530def9066", "value": "T19E35CFA683607F95C73C23B6C053B97493F1CEC6D512C74A9CC06ECAFB16246BB8519A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839605, "uuid": "cd71a00b-b3d2-4f28-948b-8f3841a6c053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839605, "uuid": "259bcabd-297d-4c61-a175-8d51b26f99a2", "value": "24576:PUOxEciMCINDoLHlcweoLwB0QRNNMx2F3v76QlQa/S:xxEfsDgcwZLwBNRNieT6shq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839605, "uuid": "e7705125-4235-4ea3-ba12-29cb60f1e78d", "value": 1160192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839605, "uuid": "4362cd84-8242-44be-aeb6-95962e4632cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839605, "uuid": "7569d4ba-d3e9-4d77-a65a-30516a5fd0e3", "value": "doc_11208633111111111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b507b8d-3dfc-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776829030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776829030, "uuid": "2295e7dd-2832-473a-b75f-2c607bf5ef79", "comment": "Malware payload (Stealc)", "value": "3bb0c4b6437329ee9ee9b60487fc551e", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776829030, "uuid": "48f23d21-d375-4827-9f3c-878602215da1", "comment": "Malware payload (Stealc)", "value": "b5574f8f533af6789ecaf9a164aee99dd1bc506b0fcd3a71aa26dfaeef6d1df8", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776829030, "uuid": "ed64d266-c9ad-450d-9f21-62702ae2b106", "comment": "Malware payload (Stealc)", "value": "2c1a87b9ab35ca416aee922863e76af87c5a64ac", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776829030, "uuid": "051b046e-784e-42cf-962e-3f7c0ec01cbd", "comment": "Malware payload (Stealc)", "value": "f31e2a3c27a498643bf1399632322ddd2d8e7b0d79b1de4576cc89b95025a71fa41b24b630e708b795808518b3a9099d", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776829030, "uuid": "340f6210-cb19-4ad0-8dad-5d04543e311d", "value": "T199C25B2CB7622165DCD58AB6DD2AA73BDA6CF881F310D25F0791C60F1F6312E6358E09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776829030, "uuid": "63376cac-c699-4fed-9ee3-419f5ca76b83", "value": "662100e15238685f709170ddf515005f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776829030, "uuid": "f026e44b-38bf-474e-8f8a-5578e81c4bc7", "value": "768:mTIoaC7C2A9VR64qo1REtiericiXOI5m3AIyuqW:mTBaYu92ieriRLmkTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776829030, "uuid": "f7e50635-673c-4d2e-b642-5fe1c121e577", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776829030, "uuid": "5374f41b-d5f2-4ecc-9681-f38b527e53dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776829030, "uuid": "c9a4f1e5-f5f0-4ce8-b7ce-0d6603a65b1c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c718f51-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877350, "uuid": "649a07f6-d5fa-4cc0-ac9a-78062e4e3f15", "comment": "Malware payload (Mirai)", "value": "6f259fd5947a5618cae64c08d45c531d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877350, "uuid": "5202dca0-4421-4d58-a03d-bf2c82918313", "comment": "Malware payload (Mirai)", "value": "b562e65d5ad485494cee16ec220e496c334fff7d5f100f2180492404a91e3ab9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877350, "uuid": "3d39d434-eb43-4553-b067-87f05d4d5b31", "comment": "Malware payload (Mirai)", "value": "a521dc5f916ded20c52b8b625d15ef96f5f0b6eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877350, "uuid": "e0f85402-77f2-4067-8719-f04772c7ec88", "comment": "Malware payload (Mirai)", "value": "92a4d0edb3032f743bca9ecda819a5329327cc19574a90d863cc14b220b10ae56e3a752c8b569feb599f7c3103397663", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877350, "uuid": "aa01b3d4-9038-4bc1-a829-0f41b7841415", "value": "T1A814A81E6F228F7DF768873547B79E25976C23D627E1D640D1ACC2102E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877350, "uuid": "bc932abc-7411-4068-8f41-6a5430f42556", "value": "3072:XAZ8k+O2ELg9zQLwpJsI+qyumG+UsVHRKr8aZycT2P/Q:Qq0noQUpJsIxj4RRaZjT2nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877350, "uuid": "55368a6f-0569-44c1-bcc6-e93f752ee5b0", "value": 194184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877350, "uuid": "0e05e563-2659-435b-9e0a-2a67852890c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877350, "uuid": "bb448789-eac7-47d7-b7af-5f3be5e73bc8", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64ae0ea-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880266, "uuid": "fcd10295-e57f-46ed-acf9-56de69195196", "comment": "Malware payload", "value": "11fe09fe8bab18b53f5fff0ef7d79724", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880266, "uuid": "1efe1ccf-a099-46a4-8584-b259d170d4c5", "comment": "Malware payload", "value": "b5b771bd9796284faa24f4f9c45d1e77567432049b1e897416bf6f6534b659e9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880266, "uuid": "c4ff32b7-d330-442b-aa97-ff6c291ba058", "comment": "Malware payload", "value": "365d0ffb52eae1771e29ed8008dbd86fdd475885", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880266, "uuid": "6735274c-fcd7-4a5d-8a90-01c95cd4da06", "comment": "Malware payload", "value": "054bf79b431925d3b148e2e80ce508040c9fa1a7dd72847013970d3981a399241df2ac83e02be0cd5636cf99bcd59243", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880266, "uuid": "09fb3948-4eb8-4368-8794-33414e9d0589", "value": "T18EB19509AA535126D5334739D8DAB008E979081B3D13617835DC82D8AF7ADAC83D5ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880266, "uuid": "41d00493-47f5-4c0a-8b5a-94a1520356c6", "value": "96:RdJVygH2O1bMbdgcUC8SXNqk8FkF0mPEVtWciupXGzzNSNRBnlshu5lVifC5l1NF:RdrJ11tcUCnXNhG4EVtWcPpXGzh0RBl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880266, "uuid": "183d4d6a-d7f9-4419-92e7-646bd06de0a6", "value": 5330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880266, "uuid": "b7f23889-5114-4402-9038-f27c4edd913f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880266, "uuid": "b4bcacd1-fe93-4190-a48b-43aec80f7464", "value": "4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded3c1a-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874990, "uuid": "eae29c80-0820-43ab-953a-ef42808a2c86", "comment": "Malware payload (Mirai)", "value": "719d60e26d2a083bf1cbf715a592190c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874990, "uuid": "04040d70-b77f-4616-b632-75c8810b2304", "comment": "Malware payload (Mirai)", "value": "b606999038c82f8e9f517dd1b40e585d7c565dfd5ad5dba95fc0c4b56546c833", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874990, "uuid": "8f58a8ac-2304-430e-9f56-2eea7f4bc693", "comment": "Malware payload (Mirai)", "value": "bc3c06f2cecc6bd9d1123272454c27cbba757f02", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874990, "uuid": "373b67e2-de9c-4fed-8647-2ae0840d8856", "comment": "Malware payload (Mirai)", "value": "f646b8fef479320db2d2e1cc6d2de11cb3a7b3482cecc324aecabea02ef60e3312cbfd736c7d97519e8c950854df2900", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874990, "uuid": "2087a77e-9ceb-4cb2-a0c2-f0abf768c2aa", "value": "T167A328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874990, "uuid": "608d1ae6-5e52-4505-b4b0-299645f9449d", "value": "1536:71ufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAt:wbU2RC4kPCtSzWu3/3L1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874990, "uuid": "aa631d11-3bf0-4567-a944-9d5e5c588167", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874990, "uuid": "7c31582d-936c-4822-865f-a4afb1b8a949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874990, "uuid": "4f6122b1-631d-4385-97a4-35aa45c0b300", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cb9a14-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776877386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877386, "uuid": "6a5bab36-631e-4e5c-b90a-0d4beb616033", "comment": "Malware payload", "value": "1cb8a6950c37231e24cee7b4a247645d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877386, "uuid": "54a3501e-31b6-467a-80fc-253f72cbe3ce", "comment": "Malware payload", "value": "b691b80189ddec3e164e3f69a6bdfa91aacbd75e21900d0d385cdb25b15923f5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877386, "uuid": "ce03ab1d-293f-41c9-9820-5ca5a7d2f999", "comment": "Malware payload", "value": "8c4923521e86d7ba5747a4ececf871031f1aa6bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877386, "uuid": "e0492356-c18c-41d2-a5e3-cae5ed96d18a", "comment": "Malware payload", "value": "d479993bbd6941249c97a6f73c8e10b24181c3314f14151da52742dac210d4483e4b04fc3f295a3a5caa881fbfe000c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877386, "uuid": "7f3f22f6-8572-4d5b-a363-3c676fcc866f", "value": "T13EB65C05BCC42BBAC46C4A7154EACA5122B05E100AF2976A2565FFECBC772397F578CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877386, "uuid": "0aac1d0d-1c25-4c24-8dde-8a0c9efe2d00", "value": "98304:XLHubIo2sWfcsQ6znDBbZFuE7hwYYTe1Z3UwYHTY0Wy3eZF0JkKddOxXpckB:VQgDBbZJ7hfY6Gz0mJkKLeNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877386, "uuid": "2dca83a8-c7a8-447c-90bd-00fb66323e22", "value": 10897711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877386, "uuid": "97cc4db5-a041-450d-864a-2acd35631cd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877386, "uuid": "0ae07f6c-0095-4804-b165-c25ad49501f2", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bcbb21-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877341, "uuid": "9760f331-8fba-4b9d-b3b0-8232516e8fff", "comment": "Malware payload (Mirai)", "value": "3f2b2c546413273ef0fe9ad525fcc13d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877341, "uuid": "d2daebc9-0fd7-4d17-8118-96f7b24834b7", "comment": "Malware payload (Mirai)", "value": "b6b9c0059471ab8e332c493af43bc9e9e7e060e7e498fad74ba76ae969628f6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877341, "uuid": "eefbc479-39fe-4a2c-ba07-eee58aaa685a", "comment": "Malware payload (Mirai)", "value": "0c3bbfeb9259c32582d2f9d656afff66502434f0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877341, "uuid": "768bb148-9d2e-4c30-98b2-d07371669033", "comment": "Malware payload (Mirai)", "value": "7b5a798414c614b88f73db6e7d97248d3bcaca31250a4c337e242f260d54b79aaa2097c1042667d77cda0399c47eed2d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877341, "uuid": "6d452302-5c86-4298-bf5b-f1ffd26548e4", "value": "T16BE31945F8414B27C6C612BBFB5E428D3B2A17E9D3EE32039D216F21378696B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877341, "uuid": "9f28d4ce-c0ce-444a-9e42-40ffbd9dfad7", "value": "3072:gCDNegwwlgT3uBLtvn8u1R4rkBjNHhW0cIJva0Gju:gCDNeEysLtvB1R4r2jNBW0X1pGju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877341, "uuid": "4a7c3477-81bf-4ed0-8ba6-9e1a1a782876", "value": 150304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877341, "uuid": "466a9b25-ee38-4dc7-8c2b-b2f3f3d3d93f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877341, "uuid": "5956ebe8-896e-412c-b1b6-6e271cdbf22b", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5d7535-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874075, "uuid": "c65b0394-dcd4-45ae-911e-930ce3f36c11", "comment": "Malware payload (Mirai)", "value": "0c37da3f52942a264646783385d36de1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874075, "uuid": "0a317115-5ffa-47ea-b946-4b888c4a94c9", "comment": "Malware payload (Mirai)", "value": "b72cec8422a5793ec346297b19c1ea8b3176b5ce345115388d679c5ca5eebdf4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874075, "uuid": "1e3a1d59-4c1c-4eed-b710-a550d83a8f30", "comment": "Malware payload (Mirai)", "value": "6eaf6b1bb65d4cfea5843a3821388be485011ed6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874075, "uuid": "93065a23-09ce-435e-b368-122a43c8c813", "comment": "Malware payload (Mirai)", "value": "475498f59b680b02a53eec7df87de6b47a1234c25b32fcd7db4b5b956ba39a7431d8c0f9a002f503a0027880c209b06b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874075, "uuid": "d01af6bf-8eaf-444f-898d-b9dacb46b8cb", "value": "T16DB55B41FD51AA56C6E0A6BAFB7E828C33272BB9C3EE30174D044734779A95A0E3F541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874075, "uuid": "f18ec104-df30-4f40-a88b-1316374fe85d", "value": "24576:3e38USshHX5I7u/QsidPg2cJxnVDD5gmDHMd5b3mJzK7C9vu/vKFA7Sso+pWvPld:u3oumdI2AAmYUW+v8s+pWvPles", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874075, "uuid": "8929fe2e-88d9-4cf4-988e-7878cddc0a1f", "value": 2490172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874075, "uuid": "47dc329f-f04c-4c86-966d-92114574b101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874075, "uuid": "06a86be0-1ce4-44b7-894f-009a4d817b48", "value": "ciubuc_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e94ab5e-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876951, "uuid": "96377f61-8f40-42b2-9230-412d52e20aca", "comment": "Malware payload (Mirai)", "value": "d7ae27db442015c779e88c3903e7c402", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876951, "uuid": "7634eba1-a96b-47fc-938b-0e7df8478a36", "comment": "Malware payload (Mirai)", "value": "b75c277497ed9416e9497528d4dffbf2b1fdfb72d602b40d17c1afc413bf4cc4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876951, "uuid": "f5331138-3575-4483-a20a-d4480543a44f", "comment": "Malware payload (Mirai)", "value": "cb915707e15b9f6d1ef0f1d47f51d5ddd894996e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876951, "uuid": "780eb056-1b45-422f-a8ab-ba2d2c8d51bf", "comment": "Malware payload (Mirai)", "value": "7dfc721cba3610c140e644510280e19fafdbeb293012f449f75b97c4e4deeb5f15e69b500ce26e7ba58b27dc67df4066", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876951, "uuid": "facc93e8-29a3-40b9-bfcc-24bf6e57f6b8", "value": "T12003F2CF6AA8B5DFC0DD59B921AD07159B8472C03257874CB30588AD7B3616F789C0EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876951, "uuid": "82d95b00-67c9-47a4-801c-6477855630d5", "value": "768:jVyIwYjG0JFk3J3QwV06tNOsPNvr3cNr+kACdxPCR/o0JkauQ/WQ:jVyYjXJu3JAwEih3GJHC9LuQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876951, "uuid": "602d562f-b843-4e04-812f-48bd9f753314", "value": 38096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876951, "uuid": "e061be84-983e-4423-8e4a-b86427d0b116", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876951, "uuid": "a3acdcf3-e0a8-4f1a-9150-5419e5622f92", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0186deca-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877332, "uuid": "8d6ef99c-de2e-4ff9-b458-0cef3d315052", "comment": "Malware payload (Mirai)", "value": "66775f6b1590169ce4bfdd3453792fab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877332, "uuid": "14367347-fe44-4679-923a-c580bbacf7d4", "comment": "Malware payload (Mirai)", "value": "b7867079ab1526387fdfd5156d08803ac1c360d52adbecad61f22c4d1b1ea71f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877332, "uuid": "8c236c3e-7bea-4575-8ec6-b9ed01412868", "comment": "Malware payload (Mirai)", "value": "1539140482eb909dacfacd020e16513aa3833dfe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877332, "uuid": "fabcba72-ec34-402c-96e3-589808d1d2c9", "comment": "Malware payload (Mirai)", "value": "95b3b4c859bd0c1d5cf99459b961ebd4e28cb541dba91279e477d65eddcf345e1383cf3b51d55cbfad9af47882950168", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877332, "uuid": "65b93e74-4eac-4b89-94e2-73aa8e194954", "value": "T1BFE31945F8414B67C6C612BBFB5E428D3B2A17E9D2EF72039D256F20378686B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877332, "uuid": "f767b736-73ed-4699-888a-0d1d509a4087", "value": "3072:LphIqDNU5maG/raUN/FWUh45kOXDAlwOhCJDe9u:LphIqDNyZUNtlh45JXDowOcJDe9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877332, "uuid": "043cb8bd-5edc-4c3e-9a99-f986471561e3", "value": 146208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877332, "uuid": "adaf69a1-6ab5-4f81-a5ba-3ea3f7754928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877332, "uuid": "d5139f70-c0dc-44c0-9d69-bad1b5914a9c", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978b7939-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880160, "uuid": "f38a10a9-ee40-4007-855b-37173f14ae4d", "comment": "Malware payload", "value": "d50b34e5d9f859eb5f2af65ad3799251", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880160, "uuid": "728d4a31-19ca-4bdc-b31c-2323a2e2768c", "comment": "Malware payload", "value": "b7f197095b51c351421ddeb179e4715991aac5b61f5164146b329f8190b86208", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880160, "uuid": "b5988f74-f700-49d7-8bbc-a18ba8b5cf04", "comment": "Malware payload", "value": "bbf82576651f5a4f085996c9991c2936c3ce1b97", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880160, "uuid": "9c4ef01c-2c7c-4e79-a1f9-5d8218fe9010", "comment": "Malware payload", "value": "afb992d30d75bb8dd711b6435933d850d66b7cf398613bee81e86e9c97fa64c2f3836d76cf23375308bae9787bcdab8e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880160, "uuid": "a7bdcf24-7ebf-48f2-88fb-3ffb4f06350d", "value": "T19BC59D217585C137D5AF03702A2DCBAF46797E603B7744D763E89A2E1EB0AC14231BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880160, "uuid": "515bfad8-72b9-4eab-8a2d-5513e37c3794", "value": "49152:hPqYaZrf5jSTUialmJrMf+7UVZDEFen4vLNgmUESIEjPMN2lv+oBNYnMa7MV3eVs:CjSTBtq+W4veHjPMNaxYnMqMV396AJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880160, "uuid": "3d52fac1-57c9-4024-80a9-4a3c11affa50", "value": 2675200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880160, "uuid": "2dad05b1-78dd-41e6-b32f-e6ed3757ab65", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880160, "uuid": "212cc838-162b-4340-8a6a-52e4b0cb7c43", "value": "util.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a302d97f-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848397, "uuid": "95aed960-dac3-4db5-be2d-30f87fd6dea5", "comment": "Malware payload (Mirai)", "value": "c5055ee55d5c154993891833f1c09a5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848397, "uuid": "93e0d3b9-39b6-4de6-9345-93f99ab8bb47", "comment": "Malware payload (Mirai)", "value": "b804571b075790c88a7f7be5008f429385ec87f0cc38b8b43d5014e6f67cf233", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848397, "uuid": "0138fab7-5e49-4264-afd4-8c7bdeaf91a8", "comment": "Malware payload (Mirai)", "value": "21eb65b6aad11833d31d4579145e0957173eb57c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848397, "uuid": "8baccb12-d840-42cb-ac6a-7bcdd8006e26", "comment": "Malware payload (Mirai)", "value": "92906c2a61c638ed54e6bf7b6d2cde75bb105f844236aa242368b9d372be7632e7c96d89869d3efab5a043bd02438b73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848397, "uuid": "e90ad30f-2700-401c-8a36-c520f4f5e1f5", "value": "T1E5B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848397, "uuid": "69af2545-eb0f-4405-9646-d28572fa679d", "value": "3072:3dub7djS5HECBQ1XezRRhFcDcmFhhcqpxt:3do7djS5ECvz4DcmFh7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848397, "uuid": "d4c1b6f4-c59c-48b5-b20d-bbff53f4cd4d", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848397, "uuid": "bc42042e-c024-4599-9db7-9c3a3368ae72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848397, "uuid": "af7d2f8c-a1fb-4ef2-a757-b562c898c376", "value": "luxzz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429f5eb5-3e15-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1776839645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839645, "uuid": "aae52a1c-9f9d-4529-a0d0-1990770ebe38", "comment": "Malware payload (DarkTortilla)", "value": "0a6a3373f5f8981564c9323e71b4acdc", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839645, "uuid": "47bf26c8-6cd6-4cde-8c5a-c75589def817", "comment": "Malware payload (DarkTortilla)", "value": "b818e801557ada6c7dc5416acbfa8360c9f240a20a94fb58a29c2754d07218e7", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839645, "uuid": "d44946b8-e63e-445c-bd69-ed43dd26a0d6", "comment": "Malware payload (DarkTortilla)", "value": "1eb330d6cceea4711d9ad4691fef8c172f8e82e3", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839645, "uuid": "003705a9-d2db-4796-b737-d46b8ef772ec", "comment": "Malware payload (DarkTortilla)", "value": "983f08dc01827e46fcc3123da1299316bb5d3242c5ba6e9543856869e0ad1cb4f7fe9314587eaf601ed3aa453df2299e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839645, "uuid": "37d60668-98c5-4188-af1e-f15f0f5249ec", "value": "T12A55F1AEE704ED56D23C4675D517222863B5E0C6C516E357B8CC97F2FB122C82A620FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839645, "uuid": "8ae57ece-041b-4220-8cc4-6d859c11e86b", "value": "12288:oOV8Ozi0sHrzS4pQzFa4mgm8Wd9ahCpj1j+AWKD6EwCY2Au7UPV:onmG24pcFaQ6jkqj1iAWKD5Fp1UPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839645, "uuid": "f28c920d-343f-4d8c-ab1b-c138787455a0", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839645, "uuid": "14d71926-bb76-4ade-aa53-612dd887cac3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839645, "uuid": "364c783a-4c97-4f1d-b7f6-3ddc612060d4", "value": "b818e801557ada6c7dc5416acbfa8360c9f240a20a94fb58a29c2754d07218e7.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1ff7aa-3e38-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854610, "uuid": "6d784c3c-3a69-4bb5-bb08-cfe5b2ca3ec1", "comment": "Malware payload", "value": "a0abf4de1b4b85ac8f8e0508e018b4d9", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854610, "uuid": "8ce0dd4f-dbcf-4c28-82f9-607617e108a1", "comment": "Malware payload", "value": "b8afd3a380348bbd5432a6955330377b682a1f35335600501f3985fb3e3719b1", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854610, "uuid": "9abe6860-52f3-4363-9829-98090e0c5e8e", "comment": "Malware payload", "value": "c3ad0d67503f1c495325170e5cffa393e253a23c", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854610, "uuid": "c4f3e755-6f85-4848-9278-d55943b0ca61", "comment": "Malware payload", "value": "ccc2c0aac590e7ab4768097778dcf9fd2af30e31c0b385a2fa655d5c1f2b0ee0bf80a574f6ae28b8cae15583c52b8f6b", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854610, "uuid": "7770094c-9293-44e1-9c4b-010b7b1d7061", "value": "T1E634C34D1CF722215263B2B98B2FA40A3175E5072A0EDE147F5C93916F8863C96F6BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854610, "uuid": "de7b3f03-0fe9-4c71-8092-9c510f1c671e", "value": "6144:RE63mQZJwE4bkCo+vtrHLqrPugh1AKWoL:RE6+vtrHLqrPughyKWoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854610, "uuid": "61beab52-8623-4ea8-82c7-132512326bf4", "value": 249364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854610, "uuid": "289ba075-7ff1-4eb2-af26-d07a4b749470", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854610, "uuid": "7ba07906-7763-4e96-b0a2-9b36e8a7e13a", "value": "51_28p_win32.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207f3467-3e6d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776877384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877384, "uuid": "1e8a7b75-6f0d-486a-8ff7-ec07e701914e", "comment": "Malware payload", "value": "8352d1646778a1452f72013e13716eee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877384, "uuid": "f7abdc93-1bcc-4ac1-85b9-dee13d91dff0", "comment": "Malware payload", "value": "b8ca0bd6ede154a6b3830e899e52118339a716e608b448e85793c295732648c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877384, "uuid": "f230b9d7-03d9-47cd-8f73-2caea2ac43a2", "comment": "Malware payload", "value": "67cd0c42faf6c75217bf3a1da02b1b6a383c4e90", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877384, "uuid": "24bbf12f-37aa-4384-a50d-8c486e65aaf8", "comment": "Malware payload", "value": "7487c5a47f2fa1279546adacdefa70803180c3c9265b55725fc698fa6b4da6337d9f6813c353bb7253cffe8762fa2b51", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877384, "uuid": "e6be3bd2-7a57-49c0-b316-340804e31b73", "value": "T17EB669137A6CEB0FC62822340DF2DAD4276A1C9601D7A557B385F319E9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877384, "uuid": "bd7327ce-7591-48a4-b913-cbb00eaec81f", "value": "196608:gdgxL5f5dWwaGHnPJ9n7HDUKzldwknvd01zUdtsTZz0C:gdgxL5f5dWwaGHnPJ9n7HDUKzZnvbqCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877384, "uuid": "d9fc381d-69dd-4837-8eee-716abca44581", "value": 10965611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877384, "uuid": "9ed29325-f0ca-4380-b839-a086d27c114f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877384, "uuid": "a4b6a7d1-979e-41c5-a7da-e59e9e9b7448", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11949653-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875641, "uuid": "ce8a8439-2110-4866-a5a4-0f8db0530b67", "comment": "Malware payload", "value": "f6c799ea0de4f00ceb4da5e3f3d56945", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875641, "uuid": "eacd5545-4423-484a-95ee-de16ca8b0a8b", "comment": "Malware payload", "value": "b8ed51832e0c153ec4844e8d75c0ea40261a7c107e045ecd35ef0002f40a0c78", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875641, "uuid": "f183c492-4f2f-4063-8a1d-d71b25ec8fae", "comment": "Malware payload", "value": "3a1a17d1c41f5546b6da133cd006498cc95c3ce1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875641, "uuid": "ea44d55b-fa53-4dfc-a696-5db3b6b09a8a", "comment": "Malware payload", "value": "2641961b529d182874c1d91e954436f1d844c392af749d1d732e8f812024ad0ad27f8e93de3bc41d51328b383cdc3554", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875641, "uuid": "0620423e-e363-4358-b7b2-09a18003b821", "value": "T1F8A69C42BC1D6473C6C976355FB31294723AAC089BC2C7176A24B77DEDF23488F626A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875641, "uuid": "6da49c8e-68b9-45fc-a454-00cb2c411102", "value": "98304:o5zjZuGnfXw5/UZvJ+YwC+PE+8UUSmM3KRzCDATXqtJr:oBZu6zv5R+3eM3K4DAbqtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875641, "uuid": "2b4ad5be-e212-4c34-8996-75a25fed223d", "value": 9834792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875641, "uuid": "d69e99d7-aabe-4728-8a78-535fa22e1915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875641, "uuid": "901df303-efb7-4dca-b894-5aa3f0bb96bb", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f388174-3e38-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854591, "uuid": "03938988-6b10-4bef-95a5-8b40af2f7185", "comment": "Malware payload", "value": "657f2af53b17a3e6e09a95eb01bf33fa", "object_relation": "md5", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854591, "uuid": "57eb5caf-7ea7-4f52-88be-1eb028bbd39f", "comment": "Malware payload", "value": "b9406f9490c3faddc109eca46d2781925a3b9bc9e04488e48013d29fd0e1f1b8", "object_relation": "sha256", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854591, "uuid": "5baf0e45-bfbb-4bd5-8ff1-6c6d3948a3ed", "comment": "Malware payload", "value": "7a368fe4b9d1b1e36fc1dba3c9722fd5e316814f", "object_relation": "sha1", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854591, "uuid": "9b7ee493-f255-4ba0-9ccb-f0a1e2b6ef72", "comment": "Malware payload", "value": "5c5ed33996ba4ff575afbb81ef498a7301e6b5e9880d94c00a83e02cfe483976b3c64732f912bb0d5594948f7dcce968", "object_relation": "sha3-384", "Tag": [ { "name": "cryptocurrency", "colour": "#0DDD71", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854591, "uuid": "aa929f59-d7ca-4f49-abc9-80aca2e3aa29", "value": "T1A634C34D5CF722215263B2B98B2FA40A3175E5032A0EDE147F5C93916F8863C96F6BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854591, "uuid": "d860d661-632b-4e56-958e-1d2ee114f2aa", "value": "6144:RE63mQZJwE4bkCo+vtrHLqrP8ghMbKWoY:RE6+vtrHLqrP8ghUKWoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854591, "uuid": "1df67c74-ceb2-497a-b5db-8c82cf662b58", "value": 249349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854591, "uuid": "084add1f-b2c1-41b1-aa73-70efc64c2e11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854591, "uuid": "78f35c26-ec63-4985-b9f8-9bfc4c4620bb", "value": "251_6yg_win32.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd0574c-3e5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776869756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869756, "uuid": "99ec1f4b-331d-4368-9dd0-20b0326b7f91", "comment": "Malware payload", "value": "4ea1d81fa5a11e17659586c625c1dfc8", "object_relation": "md5", "Tag": [ { "name": "107-173-143-107", "colour": "#5BDDE5", "exportable": true, "hide_tag": false }, { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869756, "uuid": "b0bf3f2c-f17f-4afe-9699-67ba56f7408f", "comment": "Malware payload", "value": "b95f31100a5e8a33f26615803fb1fe62b5f7c1f0eaffc25e4e7504936c843dd5", "object_relation": "sha256", "Tag": [ { "name": "107-173-143-107", "colour": "#5BDDE5", "exportable": true, "hide_tag": false }, { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869756, "uuid": "9a3c5820-4fde-4b8a-a23f-626123e8478d", "comment": "Malware payload", "value": "671504e70e4bd35bed1db2aef15d681b3631d348", "object_relation": "sha1", "Tag": [ { "name": "107-173-143-107", "colour": "#5BDDE5", "exportable": true, "hide_tag": false }, { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776869756, "uuid": "2e371673-3007-42a2-b4e3-cb4016325380", "comment": "Malware payload", "value": "de66c8a029d0906172fbacfe8d25567ba4277a87afbe8eaeb349cac830d19dae42c8d631394b5ba9a7bf183821dde7ac", "object_relation": "sha3-384", "Tag": [ { "name": "107-173-143-107", "colour": "#5BDDE5", "exportable": true, "hide_tag": false }, { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869756, "uuid": "bb2f06af-a306-4bb6-aec8-dc597f103b9c", "value": "T14BA533616EEC2DFDCF54B70D30BF1F550BF24665D004ACC782E924C61AADF2A592389A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869756, "uuid": "a48d5900-6fdc-4f29-ad75-e7f573616123", "value": "24576:EsyTL7uDaK78L/PVeuczMp5E+HGVfG9zywL77JQK5tHq3ViXZmlnjOlBh+a6RZq/:EdTLM/8XCzu8wShF4ZVCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776869756, "uuid": "54811fb4-5d76-4aa8-89eb-2b1cbfa9bdf4", "value": 2081732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776869756, "uuid": "212810b2-72fa-4040-875f-c97a5dcbed9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776869756, "uuid": "50a7287e-9238-4f7e-bb35-44e77a1f05ff", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706d74e5-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888685, "uuid": "847d74fe-96fb-412c-aa43-dd3a12da8b32", "comment": "Malware payload (Gafgyt)", "value": "77f1df7d046201749c855fd483dd7cfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888685, "uuid": "39ffc12f-674b-4fba-833a-b4033d597cda", "comment": "Malware payload (Gafgyt)", "value": "b99c0cf485b3d1b69330628f5e602365fd5b67c8e82c87dc2e5b7903375eb0e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888685, "uuid": "a92c53dd-0aca-49fa-8cb1-cffcf3015f1a", "comment": "Malware payload (Gafgyt)", "value": "ac998efb84c845aec983288a5f44be486b35248b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888685, "uuid": "1878a360-cf2b-447e-a4df-0ae4e02f6de5", "comment": "Malware payload (Gafgyt)", "value": "f54235866cc9576665d91d48f067105696432597a100103b7cbd1eb08bae2eb22b78856a958da6fcde62defc7c289e1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888685, "uuid": "c5290078-943a-4b71-ae03-a617a58449dc", "value": "T1D6C39517BB618FB7D81FDE3305AA8902108DE58A12D96F6BB2B4C52CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888685, "uuid": "9a1df6cb-f50b-42d1-b5bc-893a3e207e46", "value": "1536:/RHeTECAms/Y8Zm3lKYA43gMJwSkJ8EplyDzUh8rmW+IFB1Df11hR/:/R5LqAmgMJM8EnyDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888685, "uuid": "acf23282-24ef-484f-9a93-a047ac718d62", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888685, "uuid": "743ba342-79b2-4ec3-9123-81d6cc1c2796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888685, "uuid": "05dc11c1-7c8a-49a9-addf-9076f3124ea0", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8df748-3e92-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776893267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776893267, "uuid": "67e70295-0a7a-4298-b079-3747736599ad", "comment": "Malware payload", "value": "7a34fcb81d649e728401b14dc9b3cf61", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776893267, "uuid": "3b81d7b8-0394-4a45-9d48-afdfe072a0c2", "comment": "Malware payload", "value": "b9addbc6ed3f643d6141e15ffc6c2bff9633edc8bdac547a98efefd8eef4a8c4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776893267, "uuid": "00a83cd5-3fbd-4a79-85af-cb442a04cf0d", "comment": "Malware payload", "value": "f22d0c169c5577b037f95818abe0ee55b089b03e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776893267, "uuid": "5a5df8e3-dc0b-4bf1-baaf-83ea9bd44692", "comment": "Malware payload", "value": "3e88c083d4d1478f865f349b2f42a1d7f85c5f3159fe9be806bce7109bb3755d9c4fb88b87abd792d703b61c7d03f9e7", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776893267, "uuid": "493f4ed6-a7b9-4312-b123-3c1f0be8703d", "value": "T175A6339B8514B1DAC5920D0F38241D20C6E399369A58BF76421B43A63FBFBC61FF950E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776893267, "uuid": "10d9ddd1-8612-4d33-9a1c-2a2f2aeecf88", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776893267, "uuid": "f364f4bf-e11e-45b0-83fe-434fc3da3545", "value": "196608:OQ+b8yzWKMyBU8IvlzG/PJPfv5ZHPSmKstIA2ftmGeDIG5SUWr:OkxtX39zGBPHPKaI0Lsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776893267, "uuid": "8cbfaee8-858c-4f3d-a90c-11972e1025cc", "value": 9694208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776893267, "uuid": "cccdf6d4-6575-41e6-b0af-9c18fdba8d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776893267, "uuid": "ae73b82e-5754-42c9-8d43-df9d25b1ff69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4427235e-3e22-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776845231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845231, "uuid": "7d81b354-f896-486b-8455-861ae6c8a8a2", "comment": "Malware payload (Mirai)", "value": "838d34759a153f54daa5fba8ba8c9fc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845231, "uuid": "71575058-7da3-440f-93cc-df1135665c18", "comment": "Malware payload (Mirai)", "value": "bab0dcfda381ca364b3b2d943e975c700cfca7e5a32ee8294e88c5e846ce758c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845231, "uuid": "ec3bea11-e872-4947-ac92-bb38c94c0183", "comment": "Malware payload (Mirai)", "value": "d5b04c1c43485ab1cc49eaf5c8ba8ae2a6247649", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776845231, "uuid": "0ce2c35e-e52e-4d53-9137-a20a648fc244", "comment": "Malware payload (Mirai)", "value": "04a6f7fb2d63423aa9680204d2fac394ee5c0bb64b20e12414923b543f237e7a40ec3d7dd0c585cf9abeb9b6890f4c45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845231, "uuid": "aec8629c-c2a3-422e-8a71-27528dacf1ce", "value": "T1E293E683FD01EFB7F40AA77A059348197230FFA60E921A72721738ABED361D51466F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845231, "uuid": "ba659b14-d7f6-467e-849e-1aa4901b9b05", "value": "1536:tTzT5feu+h7JP38wGvT7rSyrQbR8kmOK06KQSHLuNNM1YHG6hv5gb:tTzkh7JPSTfSyrQbRzKxKPP2HGwv2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776845231, "uuid": "44937eb8-4cb1-49e9-88d6-24f8925c566f", "value": 96068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776845231, "uuid": "a7c26c4f-63a3-4779-ad35-3f1ca8e2a556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776845231, "uuid": "81b91426-8aad-4203-8162-230b8f544215", "value": "M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f095fa70-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821898, "uuid": "3e6dd90f-b067-4723-942b-583645baddad", "comment": "Malware payload (Mirai)", "value": "51d1fdb57babc1749f297949b30670d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821898, "uuid": "21727916-d6b4-4cf5-991b-b9f104012bdc", "comment": "Malware payload (Mirai)", "value": "bb0becde56d9412563a2bfe4fa7cd4dfe15c5124055f70f55c54116ded37ebc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821898, "uuid": "f76dde29-b1d7-41fe-ae5e-896c24b438bb", "comment": "Malware payload (Mirai)", "value": "6031265c126d8c67bc0cbc3550aa17ab81ef84a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821898, "uuid": "ff4ef1b8-b3eb-4080-9482-8fdefed8915b", "comment": "Malware payload (Mirai)", "value": "695832d6af0fb80f784797e329bca9aeb038b81c0b1f793826b40063ecf4520cf8bfa08fb409859d598dd71e0e576a6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821898, "uuid": "e795ce9d-8904-41b4-ba12-ae16dcad55a0", "value": "T17673A70A2E35CF6DFB9A423597B78E219758339626E1C245E15CFE021F7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821898, "uuid": "7a2ff435-bbae-4072-811c-7c65db2c3fcc", "value": "1536:AoA0LSTuI7u4XyXcvCEyUAFpRH2gd8VU+xo/WU+a2jI/bdLiyId42+f:Ao7STuSCXQHcpRH2giVU+xvU+a2jkbdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821898, "uuid": "e4cb08ab-294c-43b8-9e9f-bb58c2793c08", "value": 80540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821898, "uuid": "e0d9a68d-354a-43aa-810f-c4ff213ab3b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821898, "uuid": "b8ccba98-57c4-4f91-8f60-5d9ac3e05d36", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a86b9f-3e13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776838956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838956, "uuid": "82ae2881-7d6b-472f-9f64-268fc2c0ed9e", "comment": "Malware payload", "value": "3691623e488817b1102f2aa20ca3eb96", "object_relation": "md5", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838956, "uuid": "195d2b69-85e5-4937-a360-aa345c88cf16", "comment": "Malware payload", "value": "bbcbe7fa01c597f3d37ef3a0c9077b6def10c7986ece115a65852592e9c8fbd3", "object_relation": "sha256", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838956, "uuid": "a81d4d42-f06f-4de5-9863-a354e416f1f7", "comment": "Malware payload", "value": "09cedc7853ee54142232e90c6770a54f3301d4ec", "object_relation": "sha1", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838956, "uuid": "907b89c5-ad06-47c3-acc5-eae1fbdbecb2", "comment": "Malware payload", "value": "8b5ddad49d0c5a36e647532805bb7104b396646c77cb86e6921bd31896de2a48331cbc616d303e00b22df5fe06093a29", "object_relation": "sha3-384", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "crx", "colour": "#4396A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838956, "uuid": "b5cb70b4-f757-412e-bb2d-2161d6f9c422", "value": "T10BD312AF20A38D9F8CAF4D3438E051C3ECE65D57C39560F9D406D40709876ED359A3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838956, "uuid": "8828c63a-c8c5-4293-a57e-b939431909cf", "value": "3072:B5EgcrU0O+jCo1OtD/6Ds/F0CkfWVKRjXK8DUox+OdGmlR7klFHECd:Pc1nx1yD/VkO2KKJdGmXkvkCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776838956, "uuid": "96a235e2-43c6-408b-b04f-55fbcef06fb7", "value": 141955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776838956, "uuid": "a7af2ba1-2fba-40e4-bd83-f1b463c4cd47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838956, "uuid": "e081d194-3c2a-4f8d-bb5f-5b7b6bd4e1f1", "value": "GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571aa47e-3e15-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776839680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839680, "uuid": "156bdc41-0c4b-48de-baff-62fef066341e", "comment": "Malware payload", "value": "42c54a674b3af53da93b2bdc7a493a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839680, "uuid": "d135e36c-0200-42fe-81eb-63be65e2f8a4", "comment": "Malware payload", "value": "bbfc30bef51d31999c92bbf39b262df2e6381b7aa90abd761b4c441a35f133db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839680, "uuid": "602f42ed-e0fb-43e3-a334-f4057e32477a", "comment": "Malware payload", "value": "0b9c5577c3d8e6c3b63a63ac429e7ee757fe5750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839680, "uuid": "46fc5ef9-8753-491b-9089-672a1405a89b", "comment": "Malware payload", "value": "6395bf2797c9685ae5f256543ae8619867efeb659526bd938087820bb8899eab47bf80548d40b91de7b6e962cdf76a3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839680, "uuid": "63f2f9c2-28ce-462a-aa54-e41b12266105", "value": "T17F441F037E48EB11E1A83E3B92EF6D2413B2B0C71633D20B6F49AFA614516525D7E72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839680, "uuid": "c7473a4d-0d56-4764-9f3f-01f08ce6c8c7", "value": "3072:clIja/OSw0wAWa93/9oWKc96YaLy5fRZjgC:eIja/OSw0wAWa93/97KJYaLsj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839680, "uuid": "2c81df6f-5ef3-4bab-a0a7-110348efe35e", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839680, "uuid": "4ee27618-f43c-4ec6-9e0f-b7fdf26108bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839680, "uuid": "b31f6fd8-4bc4-41ed-a99a-12da92348c9a", "value": "bbfc30bef51d31999c92bbf39b262df2e6381b7aa90abd761b4c441a35f133db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fe0983-3e9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897500, "uuid": "634071ee-90d8-4330-b2f8-77da9d8160df", "comment": "Malware payload", "value": "05de3b7db36116757174f4a7f27a4e2f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897500, "uuid": "bcff7e76-c0e6-4637-835d-b0d1b793ad4c", "comment": "Malware payload", "value": "bcc5efe8897c21676d5074d859773c9816c20e685e61055d59808dbd28f794cb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897500, "uuid": "7aecedfb-7859-4d00-9753-0c0a6dcfd4ce", "comment": "Malware payload", "value": "ee66c36499cac6e5da638671e111121465ffb93c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897500, "uuid": "2152c117-6ab4-4ab2-bf40-f511a4fc39de", "comment": "Malware payload", "value": "1ef14a768e6578b0800ff83590f517e6c3fedd57ef4c077e6fea7b23b3edd24b7efd8c17cab36a13e0fae3f09ee4f666", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897500, "uuid": "8dbf1068-ded3-4b8d-a791-0a9943e0d07c", "value": "T104D52336E2AC9639DD077335D2A71F61EE2D43D2E1B732A732A4B6A26413CD55303B18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897500, "uuid": "bfd8afe5-2f0f-4fa8-a98c-274a0638ce32", "value": "49152:hfmz61np9Dyfq98/WwPwW33YxTCJ7qBwc4a4qaamfGSyAU3VYBb:Rz1nmM8/HPwSYxTa7qBUbVZOVYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897500, "uuid": "77e76f85-d83a-4678-a87e-f05374a5a273", "value": 2895818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897500, "uuid": "bb228d2d-67c2-4b6f-be93-4f8591bffdb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897500, "uuid": "7eb107cc-6534-4833-b5af-c67dc8e9a9ab", "value": "Chorus-1.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10724743-3e5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776870055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870055, "uuid": "51ca8552-432c-4d0e-9966-469d0892dced", "comment": "Malware payload", "value": "7189382b959ce23e84e5fd5950cf01af", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870055, "uuid": "bd7025c2-bfa5-409f-962a-ff02b171d236", "comment": "Malware payload", "value": "bd3bd82381c8288576a60f3a92d291dd60b930c72242f08925176fb55057073e", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870055, "uuid": "b18065e3-7317-451d-a4dc-8a93d3d6b585", "comment": "Malware payload", "value": "a679692b41581d7b27dcb996fbf2cdec1694ea91", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870055, "uuid": "f1d49717-be92-4b26-a26d-222f966993d6", "comment": "Malware payload", "value": "d8df2ba8d69af6477245397b178c74e5410ad51385bbd2f25bc156c4904ff70b10849286a709400d4284fdab6cfe1c1c", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870055, "uuid": "8197dd78-2bc8-4981-a4d3-e3327ceab028", "value": "T16494F192BB944B01C25449F6C4E7A93107E2E8CF7A73DB053F84139A4F127E4DE96B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870055, "uuid": "c1d34f2d-1f65-43ab-8934-4f7e7a25dfad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870055, "uuid": "ddea2964-b2b6-41c6-87a0-0d84ac7e1c5b", "value": "12288:G8knfAsUp7fRT4rV6WQUHkQzyq02teGPmYUiv/rW:G8yfAt4uSJt8d0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776870055, "uuid": "6667e659-2022-4098-86b7-a4fc49f97643", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776870055, "uuid": "682d3870-4f5a-4ad1-9864-d48ddb67f2a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870055, "uuid": "0a986fcf-7b03-4eec-9017-c1b8f8702b83", "value": "bd3bd82381c8288576a60f3a92d291dd60b930c72242f08925176fb55057073e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480ea900-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876162, "uuid": "da465630-00cc-436e-94a7-52191ac7d2c6", "comment": "Malware payload (Mirai)", "value": "14d064291855eaf254c7fa50ccd57c5b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876162, "uuid": "c7a94ae7-3391-4dc5-92a3-8f5841705359", "comment": "Malware payload (Mirai)", "value": "bd659035de64932c9ac4461ebec6d2cf00c2d93a3a7e3c7819426f6d4d4352bb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876162, "uuid": "5ecd720b-390d-40ab-89e4-186f299068aa", "comment": "Malware payload (Mirai)", "value": "d6253d31075806a3521e46307d8ef8f6bbbc7440", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876162, "uuid": "cd70c526-a4cc-4a9a-938a-b8cb12e33bba", "comment": "Malware payload (Mirai)", "value": "5e20ad821d44850a6331f3f6fdaaeab3017aaa30f49276a2431ccaf0ac7da7057a2d6ffcfbeace63a8e0de700f5d4afc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876162, "uuid": "2491678b-794f-4c21-bd68-f216bfc0d080", "value": "T123D1ADA4D1302471F83ACAB3102FA8F77716C12AF6D9047B22A067563F5318EEB130D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876162, "uuid": "387273b1-8fc9-42b4-ae2c-88a616a3f6dc", "value": "96:3zpN+Ig9R0h+zp4wlEAv1XeBy9q6fvo2nsOvJL3cUapdYpr+sOMjR9fuSAj:3V+wh+z7zQBy9qAoQdh7VapdU1j2Pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876162, "uuid": "5b9596d1-3224-4a26-b26e-56a775196c7f", "value": 6500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876162, "uuid": "15c18433-f155-4ef5-8ca8-dfd86afa53ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876162, "uuid": "ff3ad910-1082-4be2-9720-11c0e441270e", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783537fd-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882255, "uuid": "0a074b40-b707-4d0b-a012-2d6387e43928", "comment": "Malware payload (Mirai)", "value": "b7627bc728194c672189ab314ddc0b6f", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882255, "uuid": "dcff189b-f1f5-4de0-9bf6-ed9ba64b0787", "comment": "Malware payload (Mirai)", "value": "be0f28fc95a73db76b219941b09e9562492edcf6f290b7ed9da8116702fc2829", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882255, "uuid": "fe295a8a-6157-4976-9bde-404f510a9b90", "comment": "Malware payload (Mirai)", "value": "4c45398ea486931da1dd35b9658ec6f9e1f4e84e", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882255, "uuid": "4649c02a-ac8e-4aa3-b66e-cac30015778c", "comment": "Malware payload (Mirai)", "value": "f8c993384a04f69add43385f6d84598d6cd76280b25b118f0111a229a0b7c4c0e3be0a4c6f784c5f885f78d2e33df731", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882255, "uuid": "02797999-727b-4a17-a2e6-69bd2960ebbe", "value": "T197857C98E7C794F0F26300F0065FD7B71624621A5053F6F2EF896A97B4337527A2622E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882255, "uuid": "8fb6ee9c-5276-4f0f-b311-8dcb7ddd6169", "value": "49152:D+ZSVvWxCnSQ7Z33hCEhhzxoqJi+TloBK9oqa3:D+Z/CSQ7Z33hCEhVxoqJi+T59o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882255, "uuid": "27fce3f8-6ccc-44c2-a318-74d75075b420", "value": 1719748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882255, "uuid": "fcd8b903-dad5-4269-88a1-809cafb3ca08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882255, "uuid": "b2d543c4-f6b0-407f-b4e9-996b42dd86cf", "value": "bot_i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04914ffa-3e74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880343, "uuid": "af549d5c-d09e-44ca-ba0a-6951ed3a341a", "comment": "Malware payload", "value": "b7ae70297e7aff9f4cb90a4a8395a5cb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880343, "uuid": "84b788fc-b378-4b7a-b927-45058bdafc9d", "comment": "Malware payload", "value": "c01cd8c2ea51e554e1a49356a0253eefc1931aeb91fb8b9fc168b8aac37bb661", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880343, "uuid": "00133cce-e683-4de9-8a6d-dbdfe9c8927d", "comment": "Malware payload", "value": "ce1eb2bc48401763d8efbb1141bcd58c792d4556", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880343, "uuid": "5e6fbc6a-4d88-44d1-8dce-6ab4db8b919b", "comment": "Malware payload", "value": "243838ce350df80c45850b983426c7d4ccd84c668d0353980400708c2779534125ee5455a30419dfad5143e3015a5654", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880343, "uuid": "5e3decd0-f19b-41cf-91e8-91e55b58589a", "value": "T13E42A447638523B705730152BA5C70E6E72A907C633BC664B86D863D2BC5C3866FBADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880343, "uuid": "bc6d06d9-4f96-430b-99cc-03f24dd48790", "value": "192:23MBcTpBxWc1iiX2MB7GdlywfKkAlhNd0SC3ejLtvjmVK9uoWXCRSyEBX3yb:Y1f92MxwfPAlhPCOjL1mVKIaRsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880343, "uuid": "42750fe5-89b6-42c7-a037-ec6fd2a526b6", "value": 12411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880343, "uuid": "c79bfc0c-1c26-4d6c-8235-32d41c6f4ba7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880343, "uuid": "717b5c39-77e7-443e-955b-4953a5e31b41", "value": "DS4C1_577888.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2af710-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876192, "uuid": "3d9aa8c4-ddc0-445b-b6f5-1d47f2627454", "comment": "Malware payload (Mirai)", "value": "e635095a3de0848fedb8e3e9fa0cbaf9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876192, "uuid": "1bc07913-52cf-44c8-b2ac-8c4d18165f91", "comment": "Malware payload (Mirai)", "value": "c05dca7c231d66f896d6a018c9ae8f2843b70619bb3a3dabf3f735509913638e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876192, "uuid": "f1edccec-ed18-402b-8bac-6c2c9a3eddf7", "comment": "Malware payload (Mirai)", "value": "aadfd3b94a22c34495a74d30811877194cb526d4", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876192, "uuid": "0b14fab7-bd25-412a-914b-9ce6e440707e", "comment": "Malware payload (Mirai)", "value": "6f64d2b1b65e5f90b70d9796e33cbb4f51b58b6b542cf7bc5181144da01bc3391b2178cd0bb6d9d87535bfa1f1bf398d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876192, "uuid": "fc4f3572-584d-423d-a271-2880acb37381", "value": "T101133A36FA621C3BC4C599B561E30735F2F6839B24BC4A2B3D610E8CBF65A4036537A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876192, "uuid": "2534ac58-e8be-4ef5-8e6d-c3efe87638c3", "value": "768:uElft9Hp8kr+zO+Yk5X0tp4I1Qw/6gWdt50d9zyIp:uEFt9pPiYk5s1Qc6ntOzy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876192, "uuid": "bb50960d-2053-4af7-890a-543c7eddd0e1", "value": 44464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876192, "uuid": "48ff9642-09ff-46b6-aefb-44d709a968b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876192, "uuid": "cdc62fe2-9955-4779-baeb-c6e8b5a40f2c", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b54f101-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888757, "uuid": "8fe89f4b-35b2-4d75-b15f-70a4817d2f2b", "comment": "Malware payload (Gafgyt)", "value": "7cf193f6bb7ac9c5d2fb2d7bd43cf3b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888757, "uuid": "b2d1c29f-ab85-4837-a526-033b7de59eb2", "comment": "Malware payload (Gafgyt)", "value": "c19726ed570a5131152659995b1d5d7bdf9171b6878c54b99fae7b6d8e337a8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888757, "uuid": "95f0d8a4-676c-4067-b740-50919ff5537a", "comment": "Malware payload (Gafgyt)", "value": "544ac8a07f3b7ce974d9d3d405d473ceecea7e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888757, "uuid": "84dc7f49-ed6a-4a6e-bd9a-c398400e93a9", "comment": "Malware payload (Gafgyt)", "value": "9f7d76953a9aa77f5eec43cb7004d21fba1f43768186f235d98bfb37e59056ab75eb7b5f9c742f56acb32f5c88ddd9b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888757, "uuid": "6f1b9b55-559d-4b38-9b94-e081c91787f2", "value": "T160C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888757, "uuid": "361662e8-85f2-4606-a015-a625313349e0", "value": "3072:WkYPgPggnAb0JWaY/VfYEDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8YEDW+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888757, "uuid": "c66fcbe7-c414-49d3-8c82-9ede11b41521", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888757, "uuid": "d694f3f1-b5f1-4ef9-9d69-482de5dccf87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888757, "uuid": "26c9eedf-843e-4ace-a3a9-546cb3f13989", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9930ae97-3e13-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776838932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838932, "uuid": "efd4a745-c368-4efd-9d99-d94fdb579c4a", "comment": "Malware payload (LummaStealer)", "value": "08be2de8021ec0a7b3e7b7cea0a8c180", "object_relation": "md5", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838932, "uuid": "a53aa506-534e-4ba3-b002-60c55461bb56", "comment": "Malware payload (LummaStealer)", "value": "c23f8dd49136a471a5d6632272ecc09041efec0503716f8a3e513a4e8e9eee26", "object_relation": "sha256", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838932, "uuid": "ee567260-4ac1-4813-bd9b-9d259b7a29da", "comment": "Malware payload (LummaStealer)", "value": "4fc5ca67d714fbf9f43a8d7e460ed2b5cd6c9462", "object_relation": "sha1", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838932, "uuid": "86776e0a-5cfe-4496-965d-4ffddbe9d6a0", "comment": "Malware payload (LummaStealer)", "value": "82a19c1f85d680157c4b34e12d71b69cd69325bc24d9e5535ab8fe352f827b556d8de48204896ea59883da7a4b1f29d7", "object_relation": "sha3-384", "Tag": [ { "name": "clients2-googleusercontent-com--crx--crx", "colour": "#C61DBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838932, "uuid": "773535aa-19f9-49e9-b161-c309a9315051", "value": "T180A56C00FECB64F2E407573659AB62BF673498094F329A87EE403A78BD772D50932749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838932, "uuid": "5bc91bcb-9f7e-40f7-b558-0f8d10c16527", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838932, "uuid": "29cf1949-ec25-41fa-bdd8-225357a41bfc", "value": "49152:jOgSllLg5/tk+vafHyTxdaYq2wMObQjtdO:CVjLg5G3HyXA2wGju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776838932, "uuid": "edc2ec52-ffa0-4d75-848c-dbbac110f9ef", "value": 2171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776838932, "uuid": "330d762a-3644-4bd1-a3e6-54b3e68add86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838932, "uuid": "924aadfb-0d8c-414a-a5ee-b528fcca59b2", "value": "c23f8dd49136a471a5d6632272ecc09041efec0503716f8a3e513a4e8e9eee26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ca0373-3e70-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776878674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776878674, "uuid": "ac55e893-4a3d-4fb8-be3d-fee0fdae4000", "comment": "Malware payload (Mirai)", "value": "27d303dd9fcb13319a4cbc061eac6e39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776878674, "uuid": "4974ca5e-cfa1-4905-819f-a1d889b70c0e", "comment": "Malware payload (Mirai)", "value": "c30a0d9a140523270c92019f5c1435e075057c9ef2816d5402f4a5a0b331dd32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776878674, "uuid": "6a88d50b-8b84-40c0-87ea-dae5ba786eea", "comment": "Malware payload (Mirai)", "value": "afdea171896ac7e9bd6aee5f6a4b18a63afe7569", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776878674, "uuid": "0256b763-06e4-4ed5-8667-266e6caabe27", "comment": "Malware payload (Mirai)", "value": "098717459df609d3908a9eaba91c7ae7b85d783b2419259d2acf2e949e50b6fcaca04010c180419e33ab163c5d961302", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776878674, "uuid": "519e2e8f-a067-4100-9ca5-80cf15c721ea", "value": "T191F02B85D49D1C360E7886139224EB1820811063ABF17BFCD5C4E7604B0B9347311BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776878674, "uuid": "d067d411-5c22-44f3-b700-aa6828467afc", "value": "12:4Ck129Ov0GyVyy0yQowq9pGyo7Ty76XB+03Zd++5+EwbA90W:4Ck1kOv0GyVyy0yQtq9p9o7Ty76XB+6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776878674, "uuid": "678dd965-4777-4780-927e-21b204e28895", "value": 549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776878674, "uuid": "9fa82cab-3198-4518-8268-96d2ec9da6da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776878674, "uuid": "6e83b46f-4a72-4ec5-9a28-b48e168e5b18", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1270df-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848303, "uuid": "c9064d3a-197a-4a31-918e-727de5d309d5", "comment": "Malware payload (Mirai)", "value": "4668d0075c6c748791a9a03081f5e6ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848303, "uuid": "d7f33582-a4f6-46ef-96b4-a29f2274c2c0", "comment": "Malware payload (Mirai)", "value": "c377615f57f295e64a8240af54e6c607e1061028e8e0e5cce6642344d5483012", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848303, "uuid": "5ae4ab59-65e3-4628-9d1e-c72358ff8b7f", "comment": "Malware payload (Mirai)", "value": "a4c02ceec6530653b365074468c9edf2e90df2c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848303, "uuid": "d76a7e48-1283-4a0a-9465-e82ead94b264", "comment": "Malware payload (Mirai)", "value": "c776e752bf4bb2f9a71934ab81bcf19b0ba0ade6cf950970d162ebabeea43fd763bdb9debc40f835a2a858669da4ac3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848303, "uuid": "870d9ef5-8eec-40f6-89fe-da7e393fb89a", "value": "T1DB13029C65B7CE6ED8F35231A2F805DE4DF1B9775D1A941237DC26C60FFB11600128AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848303, "uuid": "f2d309bc-a181-428c-8981-e6b22bd0ed3d", "value": "768:WHQa5QDovTv4hl6NvNeh43agxtACwt7UVjp0DgG2jnIqGV5q2IysDr:pa5ooLvUl61N3y3piFDIDJIyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848303, "uuid": "57522f4f-ea1c-4cc2-8a38-54e450bc2a8f", "value": 42096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848303, "uuid": "83032e52-6b54-46fb-82f5-6fdbf8557f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848303, "uuid": "a799d418-5853-40ab-b4fe-3647e972eda9", "value": "luxzz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee65467-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876254, "uuid": "1d1acfb9-e2dc-47f0-a653-0f52eb2a2e06", "comment": "Malware payload (Mirai)", "value": "2352d601d926d19687dce14ff60af6a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876254, "uuid": "ae1d38c2-f8ff-4bba-a843-bd8c7c38903a", "comment": "Malware payload (Mirai)", "value": "c37cc2036aa58ebe34f8a40a71fc139c0de709addfe9700acb91e25ccda81865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876254, "uuid": "f7fc0d86-0340-4210-a912-2d498a1ab125", "comment": "Malware payload (Mirai)", "value": "be8b4633f853214dfcb9fbbc4f3d9f5359d4d98d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876254, "uuid": "4cf8d28f-9c03-415a-8b2d-a4cc0167c224", "comment": "Malware payload (Mirai)", "value": "535f4fcb6dc2785125340d6c439f954316685ae0a0a1af0c0f006b9379b4bf65f8a9c6d82d759ff2772be736bfcb5be5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876254, "uuid": "5eb87789-0f9c-4e67-afb9-f0a2448d9f10", "value": "T1E4332966F9819B11D5C1117AFE0E128D73230B2CE3EE73226E24AF3067875AB0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876254, "uuid": "ec5f45bd-251c-4d88-bc98-89c9ea2ac8e9", "value": "1536:7WnxrDPaiKjMiBb4MS7aS5TzzPfymx+KYjs:YPa7b4MSWStzPfyHK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876254, "uuid": "135fe07d-a5e1-48ef-9bac-331b77d6b835", "value": 52368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876254, "uuid": "2fa9647f-f297-48dc-baa0-4aa8f43a5069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876254, "uuid": "5c886e5b-611e-4789-af02-481a6d21cb61", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fcd32f-3e95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894920, "uuid": "1768a89c-c201-461b-b5ac-fba959db2e9f", "comment": "Malware payload", "value": "afce7d5cf910f8d86861ecdf50ad2aad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894920, "uuid": "5f905200-abdb-4835-bbe3-3ce9d67880a6", "comment": "Malware payload", "value": "c403bb0db632967b5acb8bd1d5c5c135e3ea65908e665c3c22b2ca17f8cf7740", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894920, "uuid": "5d8db639-3f01-4c5e-90a4-980c4ab9bbda", "comment": "Malware payload", "value": "660e0aee7a35ade1451d3675a1242be894a99d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894920, "uuid": "5c81f5a4-594e-4ed7-8184-71cb28c56402", "comment": "Malware payload", "value": "f3af20f5591e50b086fe4c3987cb1a992e715845d587d55256ff5ff940fc5f851fc3590dc98d16e54c9525dd5e6353f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894920, "uuid": "29674715-dd91-40e3-abb5-b541e5c8513d", "value": "T1A46618137A28EB0EC25821344DB1CA946B7A2C4942D79517B391F329F9F20AC5DAFDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894920, "uuid": "00c87ac7-fcf3-4df5-b3f9-0745f37c98c3", "value": "49152:UJoroz2N5UaOuTlE6fHzSY27n1Q4y/XHIuJ5gQl0jb92b8l+VPlWvQfNiNHxvt5A:eYMSgQl0/68CTfNiNRvjEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894920, "uuid": "689357d4-1bb8-4e7a-89b5-7bc8c4521a9b", "value": 6815959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894920, "uuid": "8646b0f5-602d-41bb-af56-aee2739d100b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894920, "uuid": "e57b42b7-7a9a-49f3-985d-3f9ccf23277c", "value": "h2rapidreset.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac996f39-3e89-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776889645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889645, "uuid": "d6b6e341-956b-48bc-b2ca-da62ad0a98e1", "comment": "Malware payload", "value": "8d00c99738a46b0b7fe16d59d7362003", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889645, "uuid": "22211e65-0e97-469a-864e-b875b3984cdf", "comment": "Malware payload", "value": "c46d62376ad7643d67a7167c05ca27fd90e3ba8844dbcdab63633b62a433953c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889645, "uuid": "463434f8-2bd8-4dd5-b6a5-5711f57f14b6", "comment": "Malware payload", "value": "2442be105e2839788e909fba7ec30c7cf4f1d2c0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889645, "uuid": "92e5f367-2523-4d59-bd7d-2a50a7e62d23", "comment": "Malware payload", "value": "58f2bba49dc1938dae2218d64e9fb77f8707c33274e05f987280299ba6509793c7a3610268008d334ef4b03af266135d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889645, "uuid": "6a050d35-9a46-4f58-ab92-9d9a70780ffc", "value": "T166A79D0773E501A6E5B3E1388AA74103E773B4635731CBDB329D03542FABAE49A3A754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889645, "uuid": "8f6f41c7-4723-4f66-8688-a7b7f4f5f650", "value": "393216:IPLJBg+yAw2GVN31QaLJCsQo7GQnSgbS74aWFe+fQailnp1efgvRMCKYERDUwYf6:Izyoe0pNTKhIn2juUSty0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776889645, "uuid": "3bc8aa9a-dec3-43bc-88b1-d511639bca53", "value": 47210496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776889645, "uuid": "7fdf8fdc-0b97-4e17-b453-770a5aa7984e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889645, "uuid": "361c2cb8-f27c-48e4-ab37-961d9c99186e", "value": "HydraCheat7.5.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcbb17f-3e8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776891771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891771, "uuid": "f9a82049-9e44-4b92-abcc-f3710dbe9b89", "comment": "Malware payload", "value": "b0ffaa321159660b754249a441630727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891771, "uuid": "c36ce126-cd7a-49c2-9d99-a29fc363e90f", "comment": "Malware payload", "value": "c6cede0e349a1bde1022f45e6ec215136e8335d32a50c038c3e22ae4f67eaae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891771, "uuid": "5aadb2d4-9bc9-4c4c-b3b3-aec7e654a576", "comment": "Malware payload", "value": "823ec405af7e85062869e93692daa30750413e4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776891771, "uuid": "14471711-9c03-48f0-b468-c95ccc95d6f7", "comment": "Malware payload", "value": "0c787581a10dee626b71ef2749749272afdced1b4bfcdc9815fa7943d7d1a10eddad926cbbbdd23ac54630129eeefc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891771, "uuid": "ae88d9c3-bcfd-4b50-903b-0a9545be5cd6", "value": "T15FD20B67EB23D8DDC6C693B871D6D9B0A470FC6508609928436083353EAB7589F7DAC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891771, "uuid": "6e34e1a9-34b9-4a01-8375-3e260df2449c", "value": "f4d27e71028819770b9ec1db4c55c326", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891771, "uuid": "68d04a46-9f58-4766-9b0d-f787523ebe7b", "value": "384:i9PjDNMabIuiu8ZW1+8EwmgdZgctDi0Ko+6KJj9ygeiRQeQzGSBrHNn:i9PzlAQ/rVDi0KxJjEgfQeQzTBRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776891771, "uuid": "761c99f8-a62e-41eb-8a67-7dc5bf479c92", "value": 30713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776891771, "uuid": "a7a96ab3-09da-49e9-abe7-f4145b88cd1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776891771, "uuid": "abad9119-7859-4e1b-abea-d97b23f2baf9", "value": "stager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d518c4a6-3e49-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776862225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862225, "uuid": "524d00d4-54c7-4806-9f44-f059685076e1", "comment": "Malware payload (Gafgyt)", "value": "e935ff56d68754d4b7b4c5bca612b5e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862225, "uuid": "f154b1e3-2e04-4600-90d2-d463537e2b55", "comment": "Malware payload (Gafgyt)", "value": "c6f112beb875598b2aa747fe555f6a99ffc9200857906b20bc12f098435ad050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862225, "uuid": "51ce3f9f-98e3-40c6-b522-af63deeb4f90", "comment": "Malware payload (Gafgyt)", "value": "82b0e1ea37d48fe33933ca7080a485d881cdc34b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862225, "uuid": "95b591d9-71bd-4b1d-ba4e-2aa86c010ecc", "comment": "Malware payload (Gafgyt)", "value": "727c294cf8c474b45fc854a02d2ee85dc4ce933fd71fece229cfea730512087d268f5a48ef3aec643569940a71c1957e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862225, "uuid": "f420e09e-c175-410c-af16-eee762e83ebe", "value": "T1A5F2E111909635A0C97028B4C52A7F82EB460BF5D71B5EB31970166C9ADB0276CFEA73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862225, "uuid": "5fa5e3a2-f713-4e56-b9ec-8e6b99ee32aa", "value": "768:dUPzLkB4EtU70vR/2g7+M8rL42XL1r5/oFSZq5NoWQ3Ug:GPMBbUAv5crcuTcSZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776862225, "uuid": "b03b9a45-f30c-481e-829f-e4d05450cdc9", "value": 36036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776862225, "uuid": "a4a053ed-112b-45c2-b209-db36599e4e06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862225, "uuid": "991c2ecf-55e4-4773-beac-cd59211ac5c4", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c939278-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897537, "uuid": "3d2287b0-1f19-4da3-9f7b-7e9eb627bfa9", "comment": "Malware payload", "value": "16fd40dd8a64231dfdf5f0089f779eb4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897537, "uuid": "f095cd03-a344-4c5b-8a7e-04a20c4c2ec6", "comment": "Malware payload", "value": "c7ca28ee95521c3d138b8633cf52f69ccfd4078587833e0a2d0621495a1d9b60", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897537, "uuid": "8e41ee23-5e39-476d-8909-f6ad041ff2c0", "comment": "Malware payload", "value": "5e0898ec68498f617581a99d95c67c5a5cc5dea4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897537, "uuid": "399adee4-8ea1-4268-a938-4faf2cdb2e32", "comment": "Malware payload", "value": "6efce120613e8cb62602b7e1238b5ba943008dde8f8b639743e0568bda6fb0fa08acda632fa3715ea6dcf832dae776e6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897537, "uuid": "6dbab00e-c418-41b8-9eb7-9b30b7e580ba", "value": "T1333412B08C53A906DBF744347BDA94B6EA43C9598DB7C132783499622CB3E07AAC7345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897537, "uuid": "62eecb10-94d7-4e0b-8267-fede3fb99ac2", "value": "6144:jodLqTrK+B00IEHDH/+7gQ+DEDA+/7/3jJdpkIyjcRHaA:sRqTUTEjH27z+GJ/7/GIWm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897537, "uuid": "eef011c6-4899-40c3-a02c-30fdcefaecaa", "value": 230484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897537, "uuid": "05b9a387-25ac-458e-bd6a-3485a4e20462", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897537, "uuid": "e690d1a4-3684-47ff-867f-7247d8c74bd9", "value": "Example-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2043102e-3e14-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776839158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839158, "uuid": "f3a6d8ee-7ceb-4daa-8484-4beb7b9e1f7d", "comment": "Malware payload (PhantomStealer)", "value": "a13636f1aad18abb6feaacffc22657fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839158, "uuid": "bb0cd6cf-560b-49f2-830e-2beeb0d9c72a", "comment": "Malware payload (PhantomStealer)", "value": "c916f289ff9a05d74d72f28582ff03690d415fe64a4195b4f47195fe286c6d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839158, "uuid": "f140fbdc-b84b-4ede-b9ec-61a367d18636", "comment": "Malware payload (PhantomStealer)", "value": "4830096bed9f2c61cf035f8ea62e22bba1073dc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839158, "uuid": "61a36ca7-2b44-4249-b065-a93dd16048da", "comment": "Malware payload (PhantomStealer)", "value": "b694b682d1d4f878bbab8a86ac4c34fc5aa4785f731cf647f2f981e3486ddc5aed65331a3cef648ab91f004870669550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839158, "uuid": "b738cf61-4b13-45a1-838a-4b0307ceb61a", "value": "T14AF4DF1873EC5A00F1FF5BB294B59D51AB35B513A962D71E11C081D80EB2B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839158, "uuid": "3b5a832a-e273-4765-a573-3b3a80eb46d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839158, "uuid": "47c3ec32-7b85-4604-ac2a-4a4c2dde5445", "value": "12288:69GBhcjkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabi3NUW6:69GukqjVnlqud+/2P+ATAS/JYeg3NUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839158, "uuid": "17f95fbe-e34e-4718-a004-f17cb15db431", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839158, "uuid": "1be7dc8a-5e96-4487-b522-85d54b870550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839158, "uuid": "5694520c-21e2-4e55-a2e5-b3fd3a092972", "value": "c916f289ff9a05d74d72f28582ff03690d415fe64a4195b4f47195fe286c6d2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28264958-3e5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776870095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870095, "uuid": "d61a1790-08d6-4d06-9932-bdbcafccc5d6", "comment": "Malware payload", "value": "3bb5d4847035cd4ce5deb600919588cf", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870095, "uuid": "d91db792-9253-40bc-8270-515167c2f0d7", "comment": "Malware payload", "value": "c959450de69ce46c804701a977355d81c55ff7db98e48940ad46264276363b15", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870095, "uuid": "7a73475f-910b-42de-a983-f0b3e61c62e5", "comment": "Malware payload", "value": "d0d549c141b1d10fc2f382195d985ee3e18f8ded", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870095, "uuid": "91e48c75-c4d1-4235-b32d-02d81d272597", "comment": "Malware payload", "value": "6005fd2e7f14e4215a67737fcb453f1e51b97ea7f8ee435dd86290d3a1a513754568d1d6b5c5f626b140dec4c317afc0", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870095, "uuid": "e79b84d4-d483-477c-bf00-7c75d60de729", "value": "T187D49E6B7E5B4E21D1C42333D4DB894063B19581BA67E70F71C813A526873FADE4A2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870095, "uuid": "6f3724af-926e-4a0a-9808-919e06236e00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870095, "uuid": "4389c5c9-f134-4a61-890e-6e913ba8c8d8", "value": "12288:TewhnYDJEQw1FMDsFw3iiPXycOt/6AJPiYY3TzTYMT09:TrYEQw0DsFw3uzJzY3Tzj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776870095, "uuid": "5924a9e0-71ef-43e3-be37-30a5b6f9f106", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776870095, "uuid": "dbc0c70f-cff8-4672-bc34-39cea5b77c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870095, "uuid": "55bfd801-e63c-461b-9019-2a7a61a870db", "value": "c959450de69ce46c804701a977355d81c55ff7db98e48940ad46264276363b15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8c488e-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826428, "uuid": "1b7e565e-6742-4405-8c12-2a9213e2d966", "comment": "Malware payload (Mirai)", "value": "aeb3a9caccc5eb120899adc4aeec499d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826428, "uuid": "1cfeb5aa-d1a7-4c3a-af48-2a91f7c92163", "comment": "Malware payload (Mirai)", "value": "c9aa8359dc6b56de305504b55b100d35747a1ce68f971ea3fd42600d02b07e24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826428, "uuid": "cfc672b3-c969-41f9-932c-255cfc653339", "comment": "Malware payload (Mirai)", "value": "497d2c078dcd263b6512cf6c08f27977bccc5438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826428, "uuid": "88858382-ce48-4db5-ba6a-9cbe090c5231", "comment": "Malware payload (Mirai)", "value": "3a2d81ece5925d5bb7c66b2d1dbc77b54fac6984943ade74fb2c48e08929721e8ce9c53b40640eedff33da8f541f0398", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826428, "uuid": "65e0851c-96c4-4b20-9b93-d88949591227", "value": "T186D32A41F9414F23C6D612BBFB5E428D772A17A9D2EF72039D211F25378686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826428, "uuid": "b20bba17-9887-442e-b60b-fe0b9d4fa8c1", "value": "1536:a3Du4G5c5BEsqEh6u0eYWgAMaz4V/HFTcVmAWTNPdmOAISeSxLme42Nfly8wywMF:a3DiGqkKXWgq4RFStWTlTMNmevmZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826428, "uuid": "e6ce7c2d-1266-47de-9da0-bc89b4aa0e15", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826428, "uuid": "053f8f95-99f2-4c1b-b3bc-126b20c8807c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826428, "uuid": "ee0af092-7820-4d32-8d43-725b11be8a6d", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0bd185-3e44-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776859931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776859931, "uuid": "da3924c9-d1a5-47b5-8cbe-015b1a81bc13", "comment": "Malware payload (Mirai)", "value": "1b104983d09a6c020aab153095bd6440", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776859931, "uuid": "565468e7-b5a8-4622-a241-307ff9e1b2b1", "comment": "Malware payload (Mirai)", "value": "c9e211618d4338948a464596c1a43b672da0bed15216f902d28f6c33c8edae4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776859931, "uuid": "59ba032a-4c6f-4a76-9ef8-9cee8dc174c6", "comment": "Malware payload (Mirai)", "value": "163859930c464ac8a00d1a9981a716d27f7d6d86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776859931, "uuid": "efe37663-7eac-4000-9f3a-f8dc13d1ac7e", "comment": "Malware payload (Mirai)", "value": "dafe78fb474318127ca8715cf4ee0a3bf27114fb55023ab589ce535206a22b638e9fa03b461db82527fd3f51b3e45f01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776859931, "uuid": "c785a82c-dea1-43b0-9b10-e567fa357f56", "value": "T1D235BE22FA366B2BC8924235819BC2342377F0815742B7036648F63A7D6736D8F5E7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776859931, "uuid": "815c1a4a-823d-4d7b-84de-71f7834c9ca6", "value": "24576:l0tqcI4qN/1sfElJokJ56nrGn+lAN+tuQiOgSXztaVyoy5GBn+heNm:aiN9kiUyn+ZJBzoo4n+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776859931, "uuid": "a6d81b3e-a2bd-4c51-b7a1-09f2b4a16cef", "value": 1136696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776859931, "uuid": "5589c571-295f-4b17-a5d0-707dc07e85e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776859931, "uuid": "fa1c0c4b-d8cc-48fb-8b3c-21e971dac340", "value": "bot.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8d2b93-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876631, "uuid": "73634cb3-d19c-49a4-8d87-e5a139597e61", "comment": "Malware payload (Mirai)", "value": "70f30a412c7c5f5b1308ed93337ae0ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876631, "uuid": "8d0fe815-ea43-4c86-b28c-577c7ae2af14", "comment": "Malware payload (Mirai)", "value": "ccd36d14706cceaf19cecf42d00aa0f067f5e0b6db5b7814f3a72dc52cea18f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876631, "uuid": "99561826-9168-4722-923c-2ba970537230", "comment": "Malware payload (Mirai)", "value": "226dbb9f0d7d13a95b62382f5a0c1fe7fb51b839", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876631, "uuid": "9e9201f8-7712-459b-89ef-eadfaf462dc1", "comment": "Malware payload (Mirai)", "value": "9c5339db5bf0dabc4238e415d2c3aa463577760b2f8d2051272b3dd123c0e2d0b5ad4dad1cc4b4d5e0b10c1aed7ffb14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876631, "uuid": "da956211-d06f-41ea-b642-3e8477b3a2f8", "value": "T17703E06D78D47892CA7D3D3731AC23F25314A2E9369F278101468CD8E778A97FD4E468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876631, "uuid": "aafeb336-d604-472d-8dd1-016aed32f64c", "value": "768:aRbMN2q8qb06Ds/ikwkKVaAgNorLP8uhdRYE7nimWTRyIWu:aRgzPb09Ia4rPTaEBWtyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876631, "uuid": "0d520e34-06ad-48a3-ad68-00bc7aef4683", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876631, "uuid": "63deabed-046a-418b-82b3-f1030d8b4ec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876631, "uuid": "3bf109b0-e3a8-44cf-a865-6e21ac1d1e5f", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c526bd-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876644, "uuid": "7342b806-c097-48ee-b04f-b102571b5849", "comment": "Malware payload (Mirai)", "value": "c5891af47951df6dcb1d0b81eedd2703", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876644, "uuid": "6e5a3b44-2f0d-495a-b490-ac8ed0f6a25c", "comment": "Malware payload (Mirai)", "value": "cda9bc158fe4d2cd26d002b7b99b2e5ac0c75bae354afa936073ee90739b5485", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876644, "uuid": "eced51a4-248c-47d3-9968-a7570cd90865", "comment": "Malware payload (Mirai)", "value": "7c265e4702c6a829d56b484166a3c5094187f093", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876644, "uuid": "396e7cfe-c992-45a8-958e-0388a5f97135", "comment": "Malware payload (Mirai)", "value": "b8a78cb907d53a6efa2a290cf00db82de520b9ae726e48d1771cdb3c9808596506868009eb549c1292515b0343399bbf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876644, "uuid": "4de82ac1-7d08-4dda-940f-55806f20e703", "value": "T1FBF2E1B0E0955B23EDE96A28A951CB806BF985DE7266C8C51DC71F10130F6273B3DE90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876644, "uuid": "9f9d363e-1504-4628-a65a-b4138eaa507b", "value": "768:XtuamiJLv9aBlP0K0fdYXCATRX/Oc6g961KPNU5KQAPxdmHX94uVcqgw09M:XtuHy0l8KyWd1/O5g961ENUKQALsX94a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876644, "uuid": "ef44fb1a-1e18-4022-85e9-44ff491c36ae", "value": 36260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876644, "uuid": "81b13202-9ac8-4821-b4b7-f28c39ef35bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876644, "uuid": "c63346c0-7fe9-4df5-912c-07d576333f67", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f3488f-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895113, "uuid": "aaa1393b-d1fa-4846-9f7a-b53b27eb29a4", "comment": "Malware payload", "value": "7e3f5f67e0c517e90d3295f8658785f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895113, "uuid": "4c89aeaa-7dcf-4fbe-b9d2-74a815788087", "comment": "Malware payload", "value": "cde76c433dedc1da0f60f03b4b403601433985ee2387a06918f24f267a629388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895113, "uuid": "b0ac4376-52da-498e-b0e1-24ffc33b49f0", "comment": "Malware payload", "value": "5b642388251547764c621f24ac4ed11e02bfa360", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895113, "uuid": "1611d2c9-3e70-4f4b-9524-341a13682267", "comment": "Malware payload", "value": "fb9776128c9d221555f55b7f22693e128bf88c10eca02343927fb71b81edfba612de331dd3d2534d9a4a62a8d34bbbde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895113, "uuid": "f2bee7a8-136a-4962-8b9b-7c7ae712c933", "value": "T13C660955BDC32F66C19C137445ED626662603E454B96433323A8EBFC3A7773CAF4A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895113, "uuid": "5b92fe02-bb71-44a7-91ef-eb0fc59f4611", "value": "24576:I2BNKJ/+FY+fkW0XIrMuL7S4EtKIuZt7+tfo+6Cd0rAwi3O5lfqOW7bgi/YkZrzk:mJcY2xtL72tT6C6eQubguYkZfuikZ5Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895113, "uuid": "9514bde9-7c38-418f-9e3d-2bb311922d32", "value": 6750392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895113, "uuid": "96a41084-7356-4098-95e5-2f54858463e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895113, "uuid": "12a6461b-eec4-47d9-b8c0-6804794bd589", "value": "h2stream.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89046d0e-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876271, "uuid": "1311fe0f-0c91-4347-a36d-c5c79527952a", "comment": "Malware payload (Mirai)", "value": "fdfb99fa65b0fb1090adb6b2166c7c35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876271, "uuid": "cf91ac82-d12b-4e2a-8dbb-210d33f4a2a6", "comment": "Malware payload (Mirai)", "value": "cdf8c10b91b8f283da568177da031ae3196960224b2af55401b4140970d87657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876271, "uuid": "b4bbffd1-a160-4a74-bd9b-791e1d28ebdd", "comment": "Malware payload (Mirai)", "value": "a0277d7500654ce032fa0cacab9d765f61a804ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876271, "uuid": "4850094f-b820-470d-b3ff-5bfa4462d234", "comment": "Malware payload (Mirai)", "value": "e32440a4138b1a83de1332da6dda8452df8b495f21570886abe4f4f272b5c91efb70170acb9efe978beb71f4ed275006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876271, "uuid": "9fc8a0f2-7e7b-42cf-a190-f6d2a479df92", "value": "T157132B49F783F0F0DD4A0671015BB7BD96348F025114DE6EEB94FE62AD32A22716BA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876271, "uuid": "b2fc9f91-1b94-4e3b-b00a-370236a29e43", "value": "768:5iyGNynU55gE2zEcxkmpRQQKmqDNWdi194FJS1lJcV7U2d31cX9nzaKyEr:5tGkU5CE2BxkmYvZWSA2G7US31cX9nuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876271, "uuid": "902cc04e-4119-4150-889e-dff5dd4073eb", "value": 43276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876271, "uuid": "84cc9b0d-2223-4ac0-88bc-6a19fc8aafbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876271, "uuid": "24c91a14-cce4-4f44-a5bb-910fd25f78ce", "value": "boatnet.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1a2fbb-3e48-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776861460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861460, "uuid": "37157772-c1eb-4fce-bcb6-1cf9d4cadbf7", "comment": "Malware payload (GuLoader)", "value": "938db4df6a0e927f4f41b0a31217581c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861460, "uuid": "71d9732e-65e7-47cb-9186-12371545625b", "comment": "Malware payload (GuLoader)", "value": "ce1285f6f87bfc3c2a7f51f1f9f4829d94fed5504f9b892f7e2a62b6b4acf4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861460, "uuid": "61074021-81cb-42b7-8b5e-f8d5500b83b9", "comment": "Malware payload (GuLoader)", "value": "2f35709941e29f6f40605634b2fcfc54d3cc95f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776861460, "uuid": "f9c427a1-a356-4b22-a7a4-586784ede7bc", "comment": "Malware payload (GuLoader)", "value": "72d8593d67ecec319e9b26fec78f1df0005a5e75e8705fae1fc562aa97c8d64f980bb36c0081b3820b5bb23f3c26230e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861460, "uuid": "f332a675-208c-4e7e-a68d-87cf2ee07218", "value": "T1EBA4231023E6F852ED6306751B3B6AF766B978605179470F23957EAF39B0B80E02EF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861460, "uuid": "15a16fc1-6cde-43c6-8c92-da4986f9e132", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861460, "uuid": "f10b9928-f529-4d33-aa78-830afe3eff0e", "value": "12288:5TA+Q4NwA7qpMVZhWCxScT+6Vt0SGZNu49ezMgIz:5TAP4Nwvojx7T+kuu8eAgIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776861460, "uuid": "aaf7cddc-e118-4cda-8e6c-7c8a7cb9a0d9", "value": 473721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776861460, "uuid": "65719e46-f291-4881-889d-57f0e50e0e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776861460, "uuid": "787bbfe8-3335-4b30-88ad-41c247c95791", "value": "Juniorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe2c472-3e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776855264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855264, "uuid": "95add0ba-33fc-439f-875d-5a49b8af24d8", "comment": "Malware payload", "value": "df8b671dd2be90d0fca97953e3cc0823", "object_relation": "md5", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855264, "uuid": "3e1298c1-8a41-46d9-b20c-e04a8b2d4e90", "comment": "Malware payload", "value": "ce4a84006f9d106e9b32bce24ea9088475e4bf7774affcaeb1421d71a112946f", "object_relation": "sha256", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855264, "uuid": "5e0ca1d5-53ae-408d-85b4-897d497f1de5", "comment": "Malware payload", "value": "0eb8a229b95e1f11844bc76c8806cdeb174854ff", "object_relation": "sha1", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855264, "uuid": "43ed8cdb-6c71-4994-bdeb-c1c335d5a648", "comment": "Malware payload", "value": "30d970171f79009036a7c4cc931ad2fd63e775cdea3c0f74a99314e9cb8b87371f210ddc42eb4e7b8ffbf01b88b19685", "object_relation": "sha3-384", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855264, "uuid": "5db23b0d-2002-48b9-b390-a377a0351ea2", "value": "T183F4B5486EF721559263B07D9F6FA0067234E40B2909DE487E1C97E05F8963887F6FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855264, "uuid": "31417de1-13f9-4efd-b6a2-f5bab6d38dfb", "value": "12288:UEkjHaYhu/UwoxFBJvtpuL2BBz1ARUhsv6uIFTLCNAuKSwD:IHaYhu/UNxFBNBJ1AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776855264, "uuid": "822c339a-42b4-4fce-aa58-4901b53c98d8", "value": 773944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776855264, "uuid": "c6b5cd4b-6aab-4ef5-a248-50001a9be799", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855264, "uuid": "c7336c61-ef51-40ee-ab1d-ddb879081a0c", "value": "51_cal2_darwin.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d181f6a9-3e49-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776862219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862219, "uuid": "d42f3107-9deb-4592-a350-b7b5c4272de1", "comment": "Malware payload (Mirai)", "value": "82c4ad5ac520775fc0e457b338832312", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862219, "uuid": "64552b7b-b82e-4058-a7d7-eba2c1994526", "comment": "Malware payload (Mirai)", "value": "ce58f79876dea15a64464368ab684d4172ccba4d947e23734a3bdb7abc6b0a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862219, "uuid": "f842929f-6745-4a28-8d37-d8d6593ce4dd", "comment": "Malware payload (Mirai)", "value": "46251e8237cff5c15c9dc12e9703050bc7163ccd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776862219, "uuid": "be874d77-c19a-49a6-917d-3da897eba75f", "comment": "Malware payload (Mirai)", "value": "ce18257798acb0efaa50082ede2907e84b7a8790b3154ed056f631a8c1e85164c64d3b9bfdbcdf885f77be4218661dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862219, "uuid": "dde45bcb-cba3-4770-8702-f422ae26d67e", "value": "T1F523E198D70DE5F3DC91493EBAE3854B3162881DD16737C2B42041BDFCDA9A992B92C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862219, "uuid": "bddd0db2-2670-4a6c-bab2-b154058c9391", "value": "768:5ITT8VxmP4oVRwdPofD9zv4EgjBxcTluwaUaHSye+Hz4GihFeCHXchMluWgNPq3w:5sT8VxmPPAJ6zv4XBxcTluwjay1+0GiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776862219, "uuid": "c03e1e21-f4a4-446a-bf68-f49434e27cd0", "value": 47368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776862219, "uuid": "42f2d12a-8531-4f99-8192-7b67b619457d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776862219, "uuid": "6beabb3b-5348-48e1-b688-25f79e77119e", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a073d8d-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876245, "uuid": "03985481-18f0-4a3c-a366-2cda6196b646", "comment": "Malware payload (Mirai)", "value": "9160bb7e6bc67bb99de6cf2b3e7ce201", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876245, "uuid": "a620e4d2-ecb0-492b-8af7-09ea3b646204", "comment": "Malware payload (Mirai)", "value": "cebbd68bbe77e5d9ffbf058fa6f37dc38e57a03a87fa10dde2b1915149c92132", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876245, "uuid": "5a6ee22c-aee6-4115-9d7b-f67d492988bc", "comment": "Malware payload (Mirai)", "value": "3d64fd8daf94dd24e77ede635a7eb5ab4b523481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876245, "uuid": "e3f0e89e-000e-4000-964a-840f6057b37f", "comment": "Malware payload (Mirai)", "value": "f8548b9dc6c7956c5bc59ef8a8861fe9cce79009b6e84aa72f00e52af36e24dd499637bc64020480977075c0f72acbc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876245, "uuid": "1263fc93-1dd6-4e9c-b162-d6d9205c9c54", "value": "T1BDF1A7D1F9D1DBEFC9D0563B9B4BD78C3371A388C2AE270695181B45AE1770D8E23A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876245, "uuid": "f0aaf53c-17d6-44cc-b81a-2e7a9d86eef4", "value": "192:rgcH7e4Rp3Hvhkz6lp7rzd+1n7MiTXPLBgVx:EcHK4Rp3vpzy7RLBgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876245, "uuid": "4d8d2501-d451-401c-8259-fa46df6c011a", "value": 8112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876245, "uuid": "d91ed08a-bd86-4b8f-8dc7-cf74c1cf2bb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876245, "uuid": "ba799c5f-a1ca-4352-9062-cb926cc266b8", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f90ff21-3e5c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776870081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870081, "uuid": "c9c0b71e-6885-4cbb-8b2e-6def72cd14ad", "comment": "Malware payload", "value": "b45130450037a154f4c82b99cf0be826", "object_relation": "md5", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870081, "uuid": "4cc849ff-a6d3-48fd-95d1-938c63858ad0", "comment": "Malware payload", "value": "cf0c4bd75514dd15d850eb633f67da9137fd5de14cefdca8173baa5d3e4cf93e", "object_relation": "sha256", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870081, "uuid": "6d34bbe1-65e3-4c68-bdce-6ef780d27683", "comment": "Malware payload", "value": "aaa983b407018e03c3c2c7af08c8d15562571aa3", "object_relation": "sha1", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776870081, "uuid": "0f34a1ca-e871-4755-b148-d3d7d03ae51a", "comment": "Malware payload", "value": "2c8fbe4efe28f169e500369aad32ac28cf5947633201d27fe8932e20e26daa979dbfa015ab85cacd55b02b849e877610", "object_relation": "sha3-384", "Tag": [ { "name": "83-142-209-204", "colour": "#D289DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870081, "uuid": "5fc45ae6-8fb6-48df-8b4e-eedea278e25b", "value": "T17E953374EDACACFA076C452871AF7E1F2EF68DCA884EF10354A924C3509F7594E4686C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870081, "uuid": "8eeae839-ab59-4e68-a39c-e212534b60b8", "value": "24576:GR8kv05SYpoiSNE21WLxDnpcEjjL4JePAtxdPgO7IqwIzt++Xsz9RvnPbVyLme07:WLOG4xN4HQBYcjDlHhRKw7OaUHby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776870081, "uuid": "c018211a-7cd5-4243-9d0d-4c9b19b273f7", "value": 2012612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776870081, "uuid": "3c15caae-65e7-423d-8be1-8bfa6460bcbf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776870081, "uuid": "1e0cc459-8f9d-4ddc-9e39-71e1840ed897", "value": "cf0c4bd75514dd15d850eb633f67da9137fd5de14cefdca8173baa5d3e4cf93e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed8eb14-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848202, "uuid": "bb661adb-b33c-47d9-9625-661fed862d8b", "comment": "Malware payload (Mirai)", "value": "cd4d379cdc93a1fcd3d9171a68a286ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848202, "uuid": "319439c6-52fd-4f90-92ef-259c48281a29", "comment": "Malware payload (Mirai)", "value": "cfae28c8312280a942ef00a22d443411454ad166a48369ca3fa2dc49e1fd68f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848202, "uuid": "59675219-5253-45b1-a3ed-e10a5b65b625", "comment": "Malware payload (Mirai)", "value": "7d668e3b7aa3b62b5e76c8e8be10b5e4fd1f6ade", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848202, "uuid": "7ceec03f-407c-4e4b-b2d6-13b99f627148", "comment": "Malware payload (Mirai)", "value": "726f2eab8a311e36f38d130be7cec28976b4e346a8337c9a983c3c539f81a04412b64f2b9679ecd8abdb2f17b5dcb780", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848202, "uuid": "36b1a1c7-fe06-43a9-8b85-da99158ee899", "value": "T187157D59FD0F3D4BC2D6E239DB8AC3F4722BB098D61351A325C1020DE6859DD8F6299E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848202, "uuid": "eab12380-bda2-4f40-8a4e-d108e44a3289", "value": "12288:0P/tw2y5uY5GV0j5G3wvzH0ohhyOcJRC0a5OAum4DX6Fo54dd447uo7w:Sm2L50j5GcgKYs7d0Km4d/7uo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848202, "uuid": "ddbde1e6-0bac-4ca3-810d-754d8a981cef", "value": 929256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848202, "uuid": "4b153ba6-9b5d-4e6f-9c2e-bb74dde6c6f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848202, "uuid": "37c53787-f712-48c5-a43b-13d0acb4b09e", "value": "luxzz.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0716e2e5-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897527, "uuid": "262a5c0e-2c3e-4fe7-8b5f-cc8a8e517903", "comment": "Malware payload", "value": "68ca25b6eb766eb289724e63641bcc45", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897527, "uuid": "8281fb62-9a64-4609-881e-f9fdb411f958", "comment": "Malware payload", "value": "d0c7a744def9762afe5299376357c816a824ed3f021ba26e30ced2f5e85e45f2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897527, "uuid": "f78e5754-4822-4839-bbbc-7ff31ac4b784", "comment": "Malware payload", "value": "7f500e52295b3829b56a1ec67f098c267184d3a9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897527, "uuid": "5928c834-1d12-4b9c-9514-f10469ba9e10", "comment": "Malware payload", "value": "cd86ab49d580e901d218dbbddbf952ce5a6e749f02acf4d2099db2f035d9b16e7ee031ef01d107ca23bd5edc5e5bdf09", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897527, "uuid": "80bd0659-add6-4f61-8e40-1ea1b44c1f58", "value": "T140B42367E2119174AD3EC7701CF8D236F66829E88D1F18CF918D5219CA977B2D9AF320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897527, "uuid": "971e4152-ee11-42c8-953a-51b9e20f241e", "value": "12288:CFglqHn307KEeSX/++wiwqBQKo0SqxSFfF1BdxC:CFgsHn3FELG18QcSqG9xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897527, "uuid": "043cb7c8-1d8e-43fe-868e-e3fd78ab9783", "value": 507050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897527, "uuid": "8155c247-ab78-4dd5-946f-1220898fd387", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897527, "uuid": "85488f90-19b0-45df-b904-4eccac434753", "value": "d0c7a744def9762afe5299376357c816a824ed3f021ba26e30ced2f5e85e45f2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc93aee-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882295, "uuid": "b04e4ff5-ce67-4f91-8a15-03e0ae877871", "comment": "Malware payload (Mirai)", "value": "0f991ad5788ef05392c7e3697f776012", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882295, "uuid": "2c869f5b-6b74-46fa-9bea-9224b2ae5486", "comment": "Malware payload (Mirai)", "value": "d12c43c359c82e4a6ca3da6690363bf9b3f3e1d699dcf00e804b833d5d956f46", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882295, "uuid": "8f21ce9a-8d0b-4ce1-a48d-33d8d6cd82a5", "comment": "Malware payload (Mirai)", "value": "8c10046a2afd1e067f66a4f5ef7e42197ce997ca", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882295, "uuid": "ff0b7d1b-13b6-4d67-8227-4910620fdd79", "comment": "Malware payload (Mirai)", "value": "ac4399aaabf48d0274c065a2ba781ccfa7372c7b19d6b22032a5b2ce23839f64ba5f0fb03b19495ea10dc847313c5afb", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882295, "uuid": "01d615f6-29cc-406a-9ed7-dab60e10aad6", "value": "T13D754D526B4D5F9BE0EF8F30C43AD16B065C29D362608A6EB7DC3F8D2E2D7560B81449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882295, "uuid": "21886762-e0d0-41ad-a54a-87bcccd2f203", "value": "12288:zoTCL2jMFjsQQefaH/gMTpXbp3vF5wX61gAlk2tS9U4gRg0Qb/hkAiPBeyGw5AbH:zmPMFH2/gyX16eIqe0o/hkAiZVmwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882295, "uuid": "53715ba6-34bf-49c8-8ddb-c44379ba643b", "value": 1559816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882295, "uuid": "36f04278-162a-4983-97c3-39b2d5a7ed36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882295, "uuid": "17cf74ad-5799-4de9-985e-9945d3be5143", "value": "bot_mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb179dc-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897649, "uuid": "30f3e0f5-27b5-453c-8743-302cc74e354f", "comment": "Malware payload", "value": "8038bd7027e0f7cecea763fdadb9109f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897649, "uuid": "b716094d-9099-454b-85ea-10e61d39e046", "comment": "Malware payload", "value": "d1375213ba00bc103876ac5524447112c42e9a3d9b0f0caf4c5818da471d0924", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897649, "uuid": "6246b8c0-1279-4323-8881-0150471294ce", "comment": "Malware payload", "value": "7556cb85189e4fe6c497485ca987f48008110b53", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897649, "uuid": "78165a8e-a737-4ac1-9184-84863a6eb255", "comment": "Malware payload", "value": "0914c6627f0dfe9901a8917aeb5b22a2d937f58438b5648996647014aaaaddad08648fdc69e2d51cfa04497c17c3c8fb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897649, "uuid": "49da82c4-d0de-49af-920a-ba2bc0128918", "value": "T1B82533CEFDD28C25C34058376B7B2ADFE6892124C20448909B5F5F7A3DB06FE199D299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897649, "uuid": "f3a068ab-381f-488b-979f-66c1a9abcb40", "value": "24576:3gh3Vauw4HpkSG0+e2YxdfQgCqgP4mnuIJXbjL8o9xl15ZkV:3gnpJY0SYxysknuYnLx7l3ZkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897649, "uuid": "4ea0c89e-fc25-45bc-bdf7-79aa7aeb5ee0", "value": 1049915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897649, "uuid": "2261b380-4c06-481d-bbc0-c6e9e3a4f4e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897649, "uuid": "d57f22f2-6ce1-4954-80c2-40e32d6029b0", "value": "Performanceoptimiser-Fabric-1.21.11-1.1.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65366e2-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877313, "uuid": "a8f9b1dc-38b7-4b2f-9927-1d5bb0d387d7", "comment": "Malware payload (Mirai)", "value": "9f0e56cd42728fdcd8d830414fbf9840", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877313, "uuid": "23fbbdd2-4078-45ee-ab6f-41abe52806f2", "comment": "Malware payload (Mirai)", "value": "d1e4621fb7a6769cace9e07d37dd02a44776f0623effbbfda0082af6815ebc0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877313, "uuid": "ab01a905-0bc0-4071-b88b-9fe4e4a7628d", "comment": "Malware payload (Mirai)", "value": "e96136b16d1e787e02a85804b5e1e103144505bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877313, "uuid": "d5bc5a07-2a4b-4152-910b-ca0e3f787b07", "comment": "Malware payload (Mirai)", "value": "90215ec4f8fb7fe39eefbd2fda410ef11fb3c975b03d76ee31f457562822df5308b0f9d4cb4ecea556be00090ec14ecd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877313, "uuid": "dfd1d88c-a206-416d-aa3d-9e6ae7fa830f", "value": "T113143A46EA414B13C0D627BAF69F4245333397A493EB730699286FB43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877313, "uuid": "16efa2e5-0233-4cb0-9f8d-50bec72ad136", "value": "6144:lici+gOabdFyTas+wex1eyqQlOMOGM/RE+w:licX0dFIas+wex1zJOf/mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877313, "uuid": "59054d80-ccd3-438e-9547-e20f9399070e", "value": 198145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877313, "uuid": "eeeb58b1-191d-4a84-af2d-0cac45487389", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877313, "uuid": "190bc41d-910d-48a8-aeb6-3abda9701074", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89095b85-3e09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776834609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776834609, "uuid": "ec8ff4b7-7f9c-4bb0-a59e-cb2c83ec6e03", "comment": "Malware payload", "value": "9c739dabcd178ee6ff360e989eb96c0e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776834609, "uuid": "dd321bb0-3aba-4727-bb94-94d860daeae3", "comment": "Malware payload", "value": "d23f7b23c07739b5a6ce41f15595ee8ff12ab876b53e859ec649f8f4380c809e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776834609, "uuid": "198446bc-6128-4a47-8d3a-f74d95e12413", "comment": "Malware payload", "value": "941dff4308c0767246189a3ebb292369d73ff10e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776834609, "uuid": "10a85386-edf8-45a1-ae1c-0b2b6f2440af", "comment": "Malware payload", "value": "2eca4954863bea7f02275c54a941f6c6b6bd8ea25288c661468f25cf00300ce599532c4c46f7f59e0f3b8c0cbe09cb39", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776834609, "uuid": "92156aba-2ba9-4ae8-9e4b-a2a5d49e7afb", "value": "T192F13B0BAE824061D39A0DF02BB240998B7E545317C770FFFBB3585A0FA578484932B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776834609, "uuid": "8c9246fc-7a29-44d3-b485-572de5ab7e74", "value": "410554daf1dc8e383fe9a0f9f8390a01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776834609, "uuid": "2a3e6aaf-18ff-450c-89c9-fb9955953bab", "value": "96:55/Qcr8vdodRjDOAl2YyTNW2Nr3SJxGEp2qp4iC7tCEI:rQvdml2xAKrCJxTptp4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776834609, "uuid": "6b6620c8-b246-4c2b-9a0a-e874598a9b8a", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776834609, "uuid": "d7efda1f-3491-4376-970c-372b4788d698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776834609, "uuid": "1e8ac919-cd29-4972-8046-1b61613a1ee9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1b55be-3e95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894909, "uuid": "22dca998-7f7a-4ea7-861d-8b64ba21ef8b", "comment": "Malware payload", "value": "748b055c6cb8df1ade90e9e679ce0bdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894909, "uuid": "160373f2-18ed-4482-8f9c-60d8ca27b6cc", "comment": "Malware payload", "value": "d2494d4330afe3469558b7263a319d667813a5ae8ef68c4fd377592aa19b20c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894909, "uuid": "d887b120-c8d0-4b0a-a759-a048f3c803c8", "comment": "Malware payload", "value": "25d9651b184d26f2293b5e792db1d80e2b8434af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894909, "uuid": "29ceb9c1-f38f-4e59-bd3a-2150bdb73f95", "comment": "Malware payload", "value": "e2f0270d31c0a7b765db7cfd903f65af51f11cf86ee4ebf1297b8566ae45c34ed76ae5090dfacbebb094e9b5f1e24118", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894909, "uuid": "c9c47347-c452-431d-b7da-bcdf51bb7df8", "value": "T19275E09AF793D8E2F25341F5024FC7E2057060266057FAF2EB44AA7678767922F1632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894909, "uuid": "64bad6c5-ec6b-4db6-9f7b-4fb2602f768d", "value": "24576:UaZSKQphYuhMEZ10ObJPFEnPV/wyQBWPBnMwcdkHd6A19kIQMIMX78DpE71D:FZSKQphYuhMEC9m05k2Hd6SkIHIMpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894909, "uuid": "cc219f95-8b4b-4808-9442-06c3c5f6f8d7", "value": 1595663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894909, "uuid": "1a369f13-6a93-4b08-aa40-4df258789c1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894909, "uuid": "958b3c8a-8064-40b2-8530-0c91b9031de3", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6519a093-3ea5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776901551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776901551, "uuid": "836edc54-27a5-419f-b396-b7c9a03c9f6a", "comment": "Malware payload", "value": "81e08311751ec257292f2b0bbd730287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776901551, "uuid": "6263ae70-2967-4d31-907a-1b206d95216e", "comment": "Malware payload", "value": "d2705499d24772fa25049f6a58d873a2ff6607d01c64622e85977e7d17d5df41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776901551, "uuid": "ea940410-2171-466b-a59d-b661a79f8df1", "comment": "Malware payload", "value": "8d70dda3a2051cf1cb99828833186a8903f5cbdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776901551, "uuid": "550640b7-e362-44ca-8f87-f28f6fb75cc2", "comment": "Malware payload", "value": "59aa56cc2a071e24e066a1de66d80f348b9705eb396a21bcbede64382fe2a94cf503cb39fa17ad53a08964c544c2eada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776901551, "uuid": "127861b3-99da-4a24-8270-728b9f9af203", "value": "T1B7834B45E29274ECD976C1B09A06A636F671BC440724AFFB5390DF352E92DC03D38BA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776901551, "uuid": "a2978bae-1500-493c-8264-0d7d9932f0ee", "value": "d57f10846e793b6f482804aabd9250b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776901551, "uuid": "a1857136-db96-4c9e-afe0-d5329c9bc480", "value": "1536:LacFVFfukytnFAzjUy8OYIH0kbgAlJgldEzSl:LFZytnF6xpH/bFDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776901551, "uuid": "4379497f-7e13-43c8-8063-e11e5954ae43", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776901551, "uuid": "76ad42b1-3d50-4f67-9c9d-e159a19d609f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776901551, "uuid": "275a4ca4-9ceb-4cf8-883a-02749b556942", "value": "endpointdlp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbebcf6-3e1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776842694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842694, "uuid": "99741cdc-2810-422b-80e9-ce09bff4c7fb", "comment": "Malware payload", "value": "ac6b52c07abca413c7b19fbd253f3841", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842694, "uuid": "2524f1bd-d5bb-46b8-8a9c-8d58bfa77b6d", "comment": "Malware payload", "value": "d2b5fe15681ddc93be95034b71109d33fcfcc2bb7eb71df5cacb8d7f78726738", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842694, "uuid": "f1009810-5d39-4472-b6f6-8e9a21c906f3", "comment": "Malware payload", "value": "5f0d9a0a190d8d43426f48233aaa22882d76a491", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842694, "uuid": "9f5cea96-2706-4946-ae87-bfa94e3bece4", "comment": "Malware payload", "value": "9b6ac5ab63977d46fe4f052e41ab1fe7e5f99a8214608e8c74e6c99ae76f5ed35db189834be815a0205ccee3817fa1be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842694, "uuid": "4826701f-92bd-4aa4-acef-446c3f427112", "value": "T134E45B7B91686589DC9B72B46BC73AB7FC11BD393320D5D65E03032C9DF06369A2821B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842694, "uuid": "a0aab340-c6c4-4603-8442-73827897bb7c", "value": "6144:rU7HX6JxtMMy/Oj174Kfiu7n0EZGSpomD6h/JPCBs5YNGj9TXao45uq:rULutW/Oj174KfiuL0Ipe/JaBs5WGdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776842694, "uuid": "a42121d2-c264-41ed-a545-bfb4daa67e92", "value": 690528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776842694, "uuid": "c724514f-07cf-456f-bf25-ad860b4270d1", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842694, "uuid": "81fea798-38aa-42eb-a72a-36ccb77738e6", "value": "GGLDataExport", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea4ac8a-3e19-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776841598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841598, "uuid": "acd9f4b5-d53f-42ab-abd1-ecee399c2e72", "comment": "Malware payload (AgentTesla)", "value": "8b15d1a7695a23d821254c79aef85f41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841598, "uuid": "0086bd47-576a-478f-8581-af9b912a493a", "comment": "Malware payload (AgentTesla)", "value": "d3ad3af0b8d43b575caacb2790a31c6c34407d3c08e58b5c8faf55e792d4fdb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841598, "uuid": "bd4029ef-4796-47d4-94d1-ee03d07c0b77", "comment": "Malware payload (AgentTesla)", "value": "0e1e510f3e12de26e600c8ae44c62fa86e7ec273", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841598, "uuid": "798b6e89-2228-4f46-98b9-10897e830404", "comment": "Malware payload (AgentTesla)", "value": "5cc71f7fb002bc0744c8939fbaef7a30de6028cda7cbe753991cd96dc01e16e13434f37a87dde7109682a839cea0a960", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841598, "uuid": "95d80bac-f6ff-4102-8a25-44d305de74c9", "value": "T18B15BF61BE126F10D63D9BBDC4E10054D3F99E079201F74FAEE832E959B7A8EC50B981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841598, "uuid": "1a982ac0-2c68-4721-ac9a-8bae2b384478", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841598, "uuid": "8a212d14-99b8-4628-9855-9756d2121331", "value": "12288:dk/y6WtsnECgpp4NMEAWjL7KcXdnE5ZNR3O/WoGYdyNCNyOxA7:dkK6TCrEnLGcXdE73O/WoGYd6syM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776841598, "uuid": "b5962a8f-884c-4ad2-945c-f58e6fa404fd", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776841598, "uuid": "2e7517b1-7bbc-47da-a630-059d6e9e8b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841598, "uuid": "48f3f90c-551b-4a77-ba56-9472c327fba1", "value": "Orden de compra 5564352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a72631-3e81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776886039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776886039, "uuid": "fa679d2a-8699-4ae8-b0f2-e52f1f878b7a", "comment": "Malware payload", "value": "ed8cd1125fce4a7fdca09ba1d067c0c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776886039, "uuid": "55c194f7-c2d1-4436-bc80-6e888aa9bf19", "comment": "Malware payload", "value": "d44834d4d5ecda018bbc16fb71df54cfe1d6dd367a780ff965fdf74313831d62", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776886039, "uuid": "28916e08-348b-42c7-aaf6-baacf77207ff", "comment": "Malware payload", "value": "f0fbd2730f4d3c60f5508d746f6cfbdfb0d055a2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776886039, "uuid": "357cb2fb-59c6-41aa-b2ab-aadf14813006", "comment": "Malware payload", "value": "356cc247652ed9193a753b811cccc851f021e2ca29c2ca4a9183c9abe018378657ff0b05718ac56a496333fea3592ad1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776886039, "uuid": "869ff5a8-6974-4d73-974a-d8eabba8ebd5", "value": "T1F766335DC3144B0BD66F62757E133D87487A508B01E2A362B509A44A7BD01AEBFCBCBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776886039, "uuid": "fb15738e-b9c5-4871-afb7-2caa6e00e899", "value": "98304:XmNeQ/r+ccyZqV/PrYNgjSJ3yvgirAJD9ZsTgxB45H2vBDs8OBo/4X1u6ZiLUs:2oHx0gjBIirAhXsTgx6kppOuAXzZi4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776886039, "uuid": "aab10e3b-e224-4585-84b4-9ffb157ce6c8", "value": 6523326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776886039, "uuid": "56a1f811-82ef-4754-8426-0137876e4839", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776886039, "uuid": "5d396881-c474-4871-8442-eed77eb50f51", "value": "azcopy_windows_amd64_10.32.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050698a6-3e38-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854574, "uuid": "d8745790-4a25-4f29-97ce-c502f8ca7797", "comment": "Malware payload", "value": "5ef9379fc25b5edd4978061a08c0d16d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854574, "uuid": "7e3cbf6a-fd91-4bfe-afdb-b0af3ccf185a", "comment": "Malware payload", "value": "d44b59b50b243fb7413098e9548e5edae2d1bf0439dff8d72e7bbef49d6b522b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854574, "uuid": "aad3b71c-784b-4fbc-97cc-48dc138bb5f0", "comment": "Malware payload", "value": "c1f1a19e04968c381d90891cae0dc68c19bfaac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854574, "uuid": "cc3eafba-2f67-4f1b-97e0-ff904fa5b72e", "comment": "Malware payload", "value": "28bb201e4e69caa9f4cfcdf46843a9ec35ea846d92a73b2639a22de2003e6335b0cd579c8d1c9279684a155ae714accb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854574, "uuid": "9a3870da-17a4-453f-b567-1dd8bc02ccae", "value": "T1DB756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854574, "uuid": "64276225-d12c-4497-831f-344a7b940a66", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854574, "uuid": "8c4fb502-16ea-462c-866f-0c46235b3f4d", "value": "24576:Vds9Esxlce6k91UOld2LMxmeDozCMZyFFYyEymOCUwPP+lP:VdaEglcAHNaYczYmyL2PP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854574, "uuid": "68104f1d-8593-41b6-831b-1a426001330f", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854574, "uuid": "fde21b83-a596-4c83-9d20-900d0fa90e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854574, "uuid": "6107fc08-f514-4381-bfc5-ea2d3f346ee6", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a58f6d-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894950, "uuid": "53260457-4166-4b08-9b1a-1d2b38d47ea0", "comment": "Malware payload", "value": "84c854071da9332ec9d3ac25eac14cdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894950, "uuid": "b10d2ac3-b3f7-41b7-a057-6a8521587665", "comment": "Malware payload", "value": "d49f432a649a48a415f234bfc0af384bde42470bc688d53191c807dafa96345a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894950, "uuid": "c6ad8c0f-4b64-4d42-983e-c60f4c82c8fc", "comment": "Malware payload", "value": "23639968760e7b769aa661c61ac0e7d762199a1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894950, "uuid": "5d7d3025-bba7-4080-8ec3-5e880ff38941", "comment": "Malware payload", "value": "844d9fc43d9217e435957e12ccc5704a6fc3b6cf711e4cccd8475bfa5f7c149db1731fd393525f2e804f01189f8fadd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894950, "uuid": "7c05b55a-cc98-45f8-aa55-8d5e3be3b5df", "value": "T169860905BCC92BF7C41C4A3544EEC99222B46D144AF1466626A4FBA9FC77239BF47C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894950, "uuid": "66530a3c-2570-46d2-942b-cb070a247203", "value": "49152:daBe5hhdfDfESx/gi6HDKAwNm88/OassG8I0RP5m8S+kHPbGNq5E3:le5HDhJPBwPbvE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894950, "uuid": "0e484d88-3dd7-47dc-843a-fcb4dfcb9ed5", "value": 8323287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894950, "uuid": "117500d1-9e7a-436d-a6e6-914dfbea5247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894950, "uuid": "948d46dc-86dc-454c-8ce1-a5b36b240657", "value": "h3flood.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac28d1a-3e51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776865697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865697, "uuid": "c3fbf49d-653a-4bf8-aabe-8b0c9ac7a2ff", "comment": "Malware payload", "value": "efd35594f89fab92b708aedf81a341e8", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865697, "uuid": "3619065d-a2be-4458-ac33-909e78675c45", "comment": "Malware payload", "value": "d5ede0d4c87b65cd914fcf4ea0a438b99c180c2f8535883df4bae8dbb9408061", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865697, "uuid": "e8efe48c-1f28-470f-9839-512f0a8476a9", "comment": "Malware payload", "value": "f5d7be6c90a50e86906ab8d62ea2235d4240a3af", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865697, "uuid": "14387be6-1db8-45b8-9938-0067cef02292", "comment": "Malware payload", "value": "cda9b6a666b20da0d124fd92247eaf6212bffb8f4c857d26bc7657cb413db753fa9cb2d136c728804074a279fa00e58a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "invalid-signature", "colour": "#A79DA9", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865697, "uuid": "81ef8f0e-e71a-4b3f-974e-b09f9c11b71e", "value": "T19CF57C5AA7AC1194E5BAC17CC9574737E3B1B81A87B05BCF08A6C1780F27BD6263DB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865697, "uuid": "6ca840ec-e2dc-4c4a-b5a5-035e8de97522", "value": "6faee67a691b5510cdbffa2f65fadb6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865697, "uuid": "8d23f7fd-7d0b-4a0d-99b1-c427cede95fb", "value": "49152:YVwASOCVIU6i/8GtlqOWOh5P2T4FI90g1ZPGgPnokygk6Z7y/tXrkV0dgNPiv/8F:9y+udPPzb3hqY0m8v/8t1CPwDv3uFfJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776865697, "uuid": "ce555502-2e13-41c4-ac11-396fdde9bfca", "value": 3430672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776865697, "uuid": "977b4d11-befd-4a9f-b0ad-82c0b7f1ed42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865697, "uuid": "bbf1f9f6-e528-4b5f-b49e-910aa0b06230", "value": "libcrypto-1_1-x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fcef0d-3dfa-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776828029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776828029, "uuid": "240e2cbd-9b5d-4252-927a-6852b1326ee4", "comment": "Malware payload (RemcosRAT)", "value": "0c9345c63076fc6ae1df31569865dbec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776828029, "uuid": "069f35a3-4802-41df-ab5f-f35d2fe72b78", "comment": "Malware payload (RemcosRAT)", "value": "d60ba18b366e3e12e584dd2b47ff2db3f242715d9748fa739e1616715a7492a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776828029, "uuid": "50834283-9160-4096-b774-b4ef26100e6f", "comment": "Malware payload (RemcosRAT)", "value": "71b9b3bd5df5a672c03dd311d87c48ff7401b121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776828029, "uuid": "fc4d76e3-ee36-4894-8962-bde0a51dc325", "comment": "Malware payload (RemcosRAT)", "value": "0853a8caa56d09b2bd5611fba6f0b3198c6d87a54b539b18cda67c14745ea3eafea7181fcf66ee3f2b7e9f7c522c6116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776828029, "uuid": "ff465f9e-a444-4e32-8977-e91ce1aabae8", "value": "T108B4232023DECC23C15237725339AEA766F97C5098A15B4733E47E5B7670BC1E60EA22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776828029, "uuid": "5d618962-2d12-48d9-b42b-b1926b94b4a0", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776828029, "uuid": "40718b49-abf9-490f-be6b-130b690ceacf", "value": "12288:5TA+Q4u72mtWu5lvt+ODxkAyWJR8QRz0+6Vt0SGZNu49ezMgIY:5TAP4u72ElLDxkWPz0+kuu8eAgIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776828029, "uuid": "da6300dc-d75a-4bbe-b74c-3b4b29b2524b", "value": 515806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776828029, "uuid": "b6cd6222-98e1-481a-b655-faaf5a611089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776828029, "uuid": "1b248bf2-5191-46f0-b48a-265f5943b1f5", "value": "Doubtous46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70df7189-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874083, "uuid": "3342ecca-b1fd-41c3-adee-4128fd74c0f4", "comment": "Malware payload (Mirai)", "value": "f726cc708a2945762cd1abb647e8acae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874083, "uuid": "98f35e46-7397-44f1-89a9-f2466317dc52", "comment": "Malware payload (Mirai)", "value": "d686d4eac5359abdfc36920c05ed1e93ac7cde63840499f3de2d46934a226935", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874083, "uuid": "84fcefe4-9205-4190-a708-649fc16792b5", "comment": "Malware payload (Mirai)", "value": "4b197b6dfd85ab3fb2a98d608b9f9e29cc677a16", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874083, "uuid": "3bdfce71-6496-4866-8f16-ab6e89a6af7f", "comment": "Malware payload (Mirai)", "value": "985932f754459ebd1107c3951ef116295b6ddef21a42d85d713a1db720c1bffdd392b42f96004c1d1c736aa162152ecc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874083, "uuid": "0517d7f3-cb62-4104-b196-6b6ce7fe1ec2", "value": "T179C51844EAC740F5FE470E718167F33F8B346B05C420CEAADF94AE16EA3BB165119269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874083, "uuid": "f64c4667-9b50-4392-886d-35a87c246b67", "value": "49152:O/rmiMOKPzSHUSXUWoXRhv5h7yE+xaV38lJTYBhb0kupRkVng:O/rmiMOyzS0xVhgxlYBhb0HpRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874083, "uuid": "fff48f81-2a47-498a-9f2f-739d9c5774dc", "value": 2554232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874083, "uuid": "ab41597e-76c0-4f90-93d0-ee410d09f25f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874083, "uuid": "61dbe10f-5155-40af-8ff1-7206299a9353", "value": "ciubuc_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13ee021-3e52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776866030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866030, "uuid": "2d392e0d-ee06-4c99-b5b8-a9f261f496a5", "comment": "Malware payload", "value": "f6f78b719ba722e06f38869dbfdeec21", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866030, "uuid": "05609573-c023-4b2c-9fc5-1501548cca6c", "comment": "Malware payload", "value": "d6ae6e103f0371ecac8cbd9585ebcd3322e9d173cee805bfb8d16a4e5a157bd2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866030, "uuid": "c5d87c8b-418f-4b85-ae7f-b322dffcdec6", "comment": "Malware payload", "value": "a5a7bccae5dcfeaf89038d3efddbb6cbae3cad33", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776866030, "uuid": "68b4888a-afce-441a-87dd-5b1860a1a0b8", "comment": "Malware payload", "value": "fac1bb4cf67eaabbc3b3d30ee5b0e08053dd9f621338c8d042adbd062fbaa600e91906eb2cb75a735a6fb9c1afadb9f5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866030, "uuid": "a5af828b-bf0f-498f-88fb-f3f04e698857", "value": "T16911D0AF35001D34F91D36D9D785258B65CAC2D339C4BACCF0E50691AB4735C0186FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866030, "uuid": "ebca0307-24bc-4499-a4ed-a32e6bb8b484", "value": "24:w7DbvAellueP8DlcnteBYy9JBA7flGYtnlfYtyj8S:WbAellueP8DlcnteBV9JBADEYtnhYtyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776866030, "uuid": "447d8cb0-030f-42e1-8ed2-17ea48ccd827", "value": 1086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776866030, "uuid": "55d50809-188d-43e5-894f-7d8dad35fe9d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776866030, "uuid": "dc38a3bc-4749-45e8-9c54-28b791a4d719", "value": "lkgkdsjd.com.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3e3a61-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874989, "uuid": "d45b3097-0df6-4ab3-abdc-83637d0ad4a7", "comment": "Malware payload (Mirai)", "value": "7e3d38ab18289cac610f163d5d940d3b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874989, "uuid": "919d241d-bd8f-48e9-ae1f-ab0d4efd9a78", "comment": "Malware payload (Mirai)", "value": "d728ee9aac7be7a04b6670f3d24f10690b2122b0c900c86590ede3b55e8e115f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874989, "uuid": "79623a19-7d39-45f9-9a74-ba650cde9246", "comment": "Malware payload (Mirai)", "value": "2f6b411c18b6429731ce3951e65fadaaa82f3752", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874989, "uuid": "c6b32684-6d26-4643-a892-840c6ac5bb46", "comment": "Malware payload (Mirai)", "value": "9e455f2a1532dce84fbdef3bf497076a91ff231db6f08e673d66ff68cae8c56b682e4f6ab6edc8dc4daba3b050273339", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874989, "uuid": "f24bd539-f01e-47b7-8ec2-186ff4e69677", "value": "T125E3B71A9F910EFBDC6FDD3302A9060635CC954722A43B763674D528F64AA4F4AE3C6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874989, "uuid": "1263f0ed-22cc-45fa-bce6-5089fbbbccf6", "value": "3072:axjJw1Cc/0s6YAPwenUr48pzfR+Jon3y:axlw1xAop0YfR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874989, "uuid": "b474b851-3780-437d-a692-f39e101f1b72", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874989, "uuid": "3d9de571-8543-4273-87e1-40d75793770b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874989, "uuid": "a6d9ed28-d641-4bb5-81b0-a106bb944ec2", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e0704b-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895061, "uuid": "c39a67e3-36a6-4b40-85a9-b6eeb953bd38", "comment": "Malware payload", "value": "dc7e2f28a6e0008eceda4cd2e1057d21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895061, "uuid": "6c9c3d0f-fc97-4dd8-bcb6-2fdb3dfe308c", "comment": "Malware payload", "value": "d73b5b88106135951e70cdf60c5fb190d9d834fd528b072e55a3d350b7809b4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895061, "uuid": "90e16ad3-81e9-4c78-ba0d-a7c295e67e36", "comment": "Malware payload", "value": "1814295dc378d7d515974583c4196d0fc12d45b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895061, "uuid": "5db8884e-cfde-426f-9d39-ecbad35031e6", "comment": "Malware payload", "value": "1504a5ebbfba1cc61d473c31ba24662aceadcb972c872e9768596b7150382dc500f38493f68716e435a288399664dc85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895061, "uuid": "5ab0ea92-dcee-4add-af54-63703a10dd2e", "value": "T1B2566C09FD249F71C7A403B649F802981370AD02AFC74712A635F73CFDB66D4AE4669A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895061, "uuid": "cbf79e83-812a-474b-a5fb-c6e5aff82f89", "value": "49152:TygK9+HXztoS4l3OEL66+nW8nac0KdIf2dJuV0l9cfhEIikq5EW:mP9cXzt63OEL66+nWJXhEhkgEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895061, "uuid": "6d2f1f2d-d4fc-4836-a2f9-7c16d46a27fb", "value": 5898424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895061, "uuid": "754401d8-d528-4e93-b599-57617663ff6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895061, "uuid": "225d2b7e-96c9-42cd-b7be-51553ab15c1f", "value": "h2stream.riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299f6836-3e14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776839174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839174, "uuid": "3bcb143b-a83a-4eb3-b2d5-20df94bb8ff2", "comment": "Malware payload", "value": "6728ff97eece4759e8d469b535b05f28", "object_relation": "md5", "Tag": [ { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839174, "uuid": "923f6e4b-7920-480d-80dd-3abb2bed44f3", "comment": "Malware payload", "value": "d76c74108901b455a3b8638bf1b433f0861d0b3f995a262a9d6407c887a711d5", "object_relation": "sha256", "Tag": [ { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839174, "uuid": "c01334c6-9380-4c64-982e-31c89d48f88e", "comment": "Malware payload", "value": "ca32f24adbaaf3e474e756f432d81b2140ec8cdd", "object_relation": "sha1", "Tag": [ { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839174, "uuid": "3539836c-0e21-4e14-b8aa-705369d19f10", "comment": "Malware payload", "value": "f95a1f8a6cd88a69135740229a4a985918bd181234c527bebad491b41888089e52a43e19bd4c031dbec4d1ae526f1706", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839174, "uuid": "f967ad1b-51bd-447f-bc87-e0c9d292df88", "value": "T1024512143E92C86FC6A51B705EA5EBB4BAA5FC112561574B336CBF0FBF383818805391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839174, "uuid": "747dd306-59ce-4cce-8fef-3890def99d4a", "value": "6144:4p+ggFTytt0LDAjGetyZTM4fIt8R1zebFJCPZRtZj0htSCCWwdIdCnkmNL3Y6IWu:o36HUGY4At8R1qb/MZRtZIp67bYlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839174, "uuid": "4226122d-d062-4786-a7a9-e6af62422b76", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839174, "uuid": "7e798190-6abc-4494-8c67-b7fad645e36d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839174, "uuid": "f7c69ffd-e359-45bc-92e7-7473aa8f191f", "value": "d76c74108901b455a3b8638bf1b433f0861d0b3f995a262a9d6407c887a711d5.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01925faa-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897518, "uuid": "2876a8dc-c97a-4cf6-aed1-841602c98ddf", "comment": "Malware payload", "value": "a13221b231f431600551d5096a12a6da", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897518, "uuid": "98fde150-b6fa-4486-a249-c6f19d2762a8", "comment": "Malware payload", "value": "d7bf1125e0907ca44ad12c8ab4bd30dc1041ce04bbb78e9d19a7f9d454f20f68", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897518, "uuid": "e077ffd8-190f-4ccd-b5d7-92df0c9454a2", "comment": "Malware payload", "value": "95642ea2a2d6d9ceb88f937095adbca99f8977e3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897518, "uuid": "c9444c84-7a8a-45da-9d1e-33749aeb8596", "comment": "Malware payload", "value": "e7b26098bfa368ce49423e8f4691821381e3a5f7f949e58687bc6214d65af060ad19d07e53b76eebf3702e788e2b30f3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897518, "uuid": "28c47018-659b-462b-8d51-c2b064f1b9c1", "value": "T1CD23E06390188B2BFC0F877990C35C64BA6E17B29243711F24E94D975E5ACEFC320764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897518, "uuid": "862650f8-5001-4b48-9a5f-c6845df49bbe", "value": "768:Q9nYUCVbP/YPk/b1T4K//P/IxcJPkyzDzi4h6ITEjL4Mu5JBJCl5NbLiJa7yxgIb:KClPr/RT7/IxcJPkyzvb6lv60Jik2xRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897518, "uuid": "d42bc8a8-0700-423f-b32a-fd2496f91751", "value": 47840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897518, "uuid": "777cfb2a-5c81-4927-896e-5030fdc709a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897518, "uuid": "e0ef5cfc-385a-4de6-9751-3fc34bf36512", "value": "Cracked-KryptonClient.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216ca466-3e14-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776839160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839160, "uuid": "0f5c1ee6-439a-44a1-83cc-7122e421f2c2", "comment": "Malware payload (Mirai)", "value": "c66cf0d7b36e38647693858a2c83c2a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839160, "uuid": "1be3e3c3-10b6-41d6-8885-2fe162fcc866", "comment": "Malware payload (Mirai)", "value": "d7e4cadc5fea4e7936abd87e69ff2a246c47904210000ec15b68092bd8569404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839160, "uuid": "898c3a15-8a09-470b-8091-1f587c79e14b", "comment": "Malware payload (Mirai)", "value": "8b38b4534ceba70710cdab1c5acb6cea64f6da64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839160, "uuid": "cdc20422-6082-4cd9-a597-b761d3215248", "comment": "Malware payload (Mirai)", "value": "e75ef394f6461bd91d80933b21c9f0d2767524b422c3a8b588b0650444ba84e98ad99435a73d190316e280b89325e5f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839160, "uuid": "7107bc01-f456-48ec-b9cf-42bf0e5ab8ff", "value": "T1E2258E46F2B334FDC057C03183ABD762A536F46941312D7B26C4DA392EA6E701B1AF66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839160, "uuid": "025b0df6-6b42-4f7c-9b01-26d1610ab50f", "value": "24576:iVX1k2Lso1cRk2RPbW6Nrh9AM84p8UCb5HKRoFix:pjW6NrnAM7p8UCNko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839160, "uuid": "1933644a-679b-4f65-992f-d1ef76c179e9", "value": 1049408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839160, "uuid": "c8485df6-b45c-4cd6-9690-0f0df4f3b560", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839160, "uuid": "b5ec8ce8-0bb7-47dc-9854-182c6ca8c1c7", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508efe66-3e28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776847829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847829, "uuid": "5084be15-32b2-421b-acff-ef62c77d7c1e", "comment": "Malware payload", "value": "e10c3a204370d631ce860a23425e760c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847829, "uuid": "b2037ec1-4036-4890-865d-c401d27cc2da", "comment": "Malware payload", "value": "d80c838538dab9d70b886083f8e165c91b3994650a0ab9dcd37098e98ec7440a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847829, "uuid": "4e83aeba-579b-4e49-99d9-37e1bac40f96", "comment": "Malware payload", "value": "73368d03e95c6c82431442f84edd42d256e223df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776847829, "uuid": "689c10fb-6b04-451c-bd5a-c4446585cf53", "comment": "Malware payload", "value": "c8eb80032c0bae35c2cd0d57e64630e9c95ee2050692e21214cc7b4724e80c1b629e5c40cd98d90952ff91ccddf0f906", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847829, "uuid": "688b9b6a-53d0-480e-8664-0c5a3cb1a2da", "value": "T1F1518453B8A48939E811077209630DD699B29631E2BF5B0FF34C293CAF71583E1423AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847829, "uuid": "59b5887a-8f1e-4fa5-a339-cf47a028b1e9", "value": "97c6f7bdf42991e9082f7210821d1a51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847829, "uuid": "f06a87b8-5bf8-46a3-a0da-b76d9beef416", "value": "48:0HPpxNrqHK1FsP4FCJdJ8GnjhEUu4Clj+2364Q:ux5/sP4FCjhnlCli2364", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776847829, "uuid": "abc54260-a7df-470b-885c-e185a0ab3596", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776847829, "uuid": "5b5ead0b-d11a-4918-954a-bcd565d1dad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776847829, "uuid": "80ac9e34-9492-4e88-a438-39ed04b403a4", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8b4762-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895017, "uuid": "27ed2619-60dc-4f11-af21-0bbd4c338fd6", "comment": "Malware payload", "value": "641e697db03c0bc826304b7973410610", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895017, "uuid": "b86f2ef2-1b02-498e-8e31-024febc4fe74", "comment": "Malware payload", "value": "d8592c39ae84577d4b4ca28ee21e813e2bcebb80b0fa93623db0e4ef9dd685ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895017, "uuid": "02a8a0db-01cf-4f7e-ad9a-d621bb52cd2b", "comment": "Malware payload", "value": "c250803195236e628f05677d3d47818cebe63569", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895017, "uuid": "38e1e05a-742a-49fc-81a7-3851ef514126", "comment": "Malware payload", "value": "9e9a14fb2a8dfcf2f3dc5f7390deb966f90b80263777dbbb18a980317e25972a8bb8c73defd1d2a44a894fef8eb9b765", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895017, "uuid": "ef006e61-419b-46b1-bdf9-ccab80c5de04", "value": "T1B78618C1E891D28AC63D6D72EFE5EFD8E2673E315C885A4AC9C4F33E5CB214484B5960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895017, "uuid": "d40a0d70-c3fe-41ee-9af8-75f2f96d05e7", "value": "49152:9AUMdZ8f9xIBXHdDNGdQXKBEtyaVpWFa9KssG8I0mPw+wXeCYTIvMSrP361vp5uF:9AUMdZ8fvAtD7e19MnRwjEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895017, "uuid": "0d3675bd-74d7-4d55-aeba-8b523d9b2bf1", "value": 7864504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895017, "uuid": "7561abfa-b737-4a3d-a938-eb53832531e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895017, "uuid": "fd903fc7-c49a-459e-9996-1aef1ea37ad0", "value": "h3flood.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2b24ff-3e14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776839425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839425, "uuid": "26832e32-6075-4abd-9d57-9237a4f860d8", "comment": "Malware payload", "value": "1437a90dc2c97bbb3b4a9e37df4134d9", "object_relation": "md5", "Tag": [ { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839425, "uuid": "ad825726-187a-4990-8e2f-ef8b64d51995", "comment": "Malware payload", "value": "d892b018684fb2472587c9c7ab3ae37ffd814ba3a63ab60e3b1a9f2098884c92", "object_relation": "sha256", "Tag": [ { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839425, "uuid": "c77ba01c-6048-426a-a901-2df14516df41", "comment": "Malware payload", "value": "72ac5f4de34c7b838392704088f5bfe881d852d9", "object_relation": "sha1", "Tag": [ { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839425, "uuid": "d6e29191-0118-456a-9835-64b80e175748", "comment": "Malware payload", "value": "b6a6412a3cfa34f07a4d7d799815f540a6b4190913e5df4e1791529f0b4312fc72f8dc6b6e4249f1b59509d2e757d0bc", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-corella-ro", "colour": "#3B7B76", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839425, "uuid": "10e83a9c-d214-4db8-9c5c-4544c73a30be", "value": "T11534236E8DB4EA2E02A675E5FF4429CCD25118847C3C4B7A0DFEF64A34B4629B0B1D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839425, "uuid": "4f619a29-b8d7-40f8-9c93-1b58f60ff522", "value": "3072:1gadQpKMSDzzYaou+jArwbqtBGFFETeuMFUOdkU+lm4X5Fo+gE6PqltNBLwb1I0B:1dQpq3zlZ+xbqPqOeumEVmy5FoJmp4G6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839425, "uuid": "5ddcf03f-edbc-4edf-b9f8-8d203423bcd4", "value": 231135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839425, "uuid": "8f4a663f-fc04-46b2-b084-1c965544de43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839425, "uuid": "bb9187c5-7b14-4810-871a-10395569ce49", "value": "39008a38d858856a4c9009e77760adb3ce2edabd840eddd8e77481805b95feac.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a03512c-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897586, "uuid": "63d92552-9773-4fe5-9cfa-36583a520236", "comment": "Malware payload", "value": "32dea02602eee4bf58fcea170d9c1348", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897586, "uuid": "dcc807f0-5353-426e-a6d4-3fc1f3443c2c", "comment": "Malware payload", "value": "d9c2b0dc21512e496d4d767f43a1df8927d26032712f946fd769f69b3e71379b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897586, "uuid": "05e60d65-97cc-4a0e-b0ee-6b62e9cd7ff9", "comment": "Malware payload", "value": "b0599de2d81d08d4e7fbc74635b21e65f4212ad0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897586, "uuid": "f1c26275-44ac-48ee-be8a-7f921a403348", "comment": "Malware payload", "value": "23902725289fd146b26c115607474efc1ba5c3f448ddb030d424e77c992cc36cffa6fe24394a7ed193a59cf7bf0478a5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897586, "uuid": "5c41cb84-5939-4aad-a2ff-b283c96a9fcc", "value": "T1E5B2D0A1685FDC35FE039B30E28D85F6310E4EC1554BF51B6A09BA1D4DA49E5C34E4F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897586, "uuid": "4a63ce9d-7cb0-4de8-bb21-eab46d4fc970", "value": "384:o3w9gntoIDUVdUNg3qCUc0eWK6PvPvf0wHvmm6TE5Z/T50KnhxQbTEQGsXqKMvMz:C9nhojbvjWKOem66V0Wx4EaXqKMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897586, "uuid": "cd49c44f-c625-4829-b6e4-779c00f7da8c", "value": 25655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897586, "uuid": "821b72f6-69da-4ec1-9900-936a6d885af6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897586, "uuid": "158aaff7-616a-44ad-9af2-cda454dab4b6", "value": "KryptonAddon-1.21.11-jar-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e02209-3e1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776842625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842625, "uuid": "713639af-8aaa-4189-be82-aeb1d72aaaf7", "comment": "Malware payload", "value": "cc126bb60973b174ca35c225064d711f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842625, "uuid": "24eac7f9-fde3-4d5d-bf39-4b4a8dfccff4", "comment": "Malware payload", "value": "dad7c1bf9f1c81526c82638a23f09ce8ef9c3c7515150875e318d5851e7d7866", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842625, "uuid": "e96ef705-66d2-450f-be8a-d4fb2877ad6b", "comment": "Malware payload", "value": "6748c9938b03def1e11ea94eae2369d56c7d0dd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776842625, "uuid": "d242310a-64b0-4d85-bb67-af64d6929a50", "comment": "Malware payload", "value": "bbdcb52266c3f05cd1db090cc88ea8a22ed4b0ab4ecf71b52faf84e1de33e1241ec5611e81b0d973b9f2136ef8787773", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842625, "uuid": "0cdc04bb-f449-4184-a1a5-719120257ade", "value": "T1AAE45B7B91686589DC9B72B46BC73AB7FC11BD393320D5D65E03032C9DF06369A2821B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842625, "uuid": "dc9acd78-a5b0-491c-a950-3b3b2c33685b", "value": "6144:rU7HX6JxtMMy/Oj174Kfiu7n0EZGSpoPD6J/JPCBs5YNGj9TXaoa5u1:rULutW/Oj174KfiuL0IpN/JaBs5WGdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776842625, "uuid": "05c65831-410a-4af6-bfcd-d5ed714dd8f0", "value": 690528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776842625, "uuid": "ebe7f640-79e0-4b19-9c18-0880ae59534b", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776842625, "uuid": "ad8455b9-93d3-4bc9-a7f0-60ac3199509d", "value": "APLexport", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfe8622-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848389, "uuid": "d648a9f0-bdfd-4982-b480-8e0262e13c02", "comment": "Malware payload (Mirai)", "value": "9d518e4bfe915e247f679b593c8b7cb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848389, "uuid": "f62ae258-7c92-44af-96f1-325f22330514", "comment": "Malware payload (Mirai)", "value": "dafaa5a8d120f5ebde24c521aeef290d6295e1646062a3c42b8322ac99c9c360", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848389, "uuid": "e38729a7-b5a6-4e95-ac24-961b05bb5899", "comment": "Malware payload (Mirai)", "value": "d3e9a7bc74228112fa99aa4adca1079b8aaa4326", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848389, "uuid": "4d96566c-34e8-40a4-adb7-7f82419bdd81", "comment": "Malware payload (Mirai)", "value": "8db132502087a7fc92a4511d4aa83e36d78186d2aab85c2c6ba8ef963bb28a067eb98170aeec6cd2b05dd1fcf95ce295", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848389, "uuid": "b252e330-7403-4959-b549-784ed313b7f3", "value": "T1DDB3E84E6F318F7DFBA8C23447B3AA21975923D227E2C685D19CD6011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848389, "uuid": "8cacc85d-7537-42f7-b00c-bdbc89cb0a26", "value": "1536:uEkWiTLiZECcpHOWWJDman5Pd1Oe4a/7QhfUxI+E7OTeVutW/HeAB0901S6C:8ni50poRb/EhfUQ7OTeEtW/c01S6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848389, "uuid": "5e4cdc8c-7686-4370-b971-724ef585e542", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848389, "uuid": "610da1f2-a723-4fe7-9873-03460c818d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848389, "uuid": "676e04e1-b99c-4283-a228-e1873b9a1c31", "value": "luxzz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dfd47e-3e15-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776839589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839589, "uuid": "f6f1af78-0040-45eb-8c12-10fca4451579", "comment": "Malware payload (AgentTesla)", "value": "c975f2ab9740490405bc91449ccafa17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839589, "uuid": "ff8ed700-1a75-45cf-a38e-1b48d84852bc", "comment": "Malware payload (AgentTesla)", "value": "db0f48c5b54f38b4c5027449c372b512d10d080dc2e83c4667f9a9f1746b6bf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839589, "uuid": "ecfa0d2c-71a8-42d8-bde7-4fc15e6ab6f4", "comment": "Malware payload (AgentTesla)", "value": "142addd17be7978146a8302c7db262bafed8b37d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776839589, "uuid": "4fe620d1-162e-4002-a26c-cb108173f0ea", "comment": "Malware payload (AgentTesla)", "value": "cc70074b08b91348d7ab0a70542eae68878d1611d06c154c529416641ceec6c7ce5b905e9a9e510fb0431c6e9d64f5fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "omamontaggi-it", "colour": "#6EC39B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839589, "uuid": "5b598a3a-dfb2-4ea7-a563-55f4c2c82251", "value": "T1B985CFA583607F95C73C23B6C053B97493F1CEC6D512C74AACC06ECAFB16246BB8519A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839589, "uuid": "f4b38b0a-e335-45c4-ae9b-abbf9b322a02", "value": "24576:wUOxEciMCINDoLHlcweoLwB0QRNNMx2F3v76QlQa/S:mxEfsDgcwZLwBNRNieT6shq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776839589, "uuid": "d321211d-0246-47df-8d2b-0e1100833b00", "value": 1769472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776839589, "uuid": "76f874bc-1508-4621-b95e-5492213c111b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776839589, "uuid": "46babf92-2993-4ac9-9222-41c44213b81d", "value": "db0f48c5b54f38b4c5027449c372b512d10d080dc2e83c4667f9a9f1746b6bf0.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bef849f-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874074, "uuid": "9541fcd0-4550-44dd-968c-0fc39d7955f9", "comment": "Malware payload (Mirai)", "value": "67c3e4a52f62fadc345ec09309852cb8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874074, "uuid": "54d57010-7376-4647-bd1a-9bbd0165076e", "comment": "Malware payload (Mirai)", "value": "db719a2572a96ce8486337f04ca258ef0f26c26e8cce4a7612db85b3b5ee70b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874074, "uuid": "dc4e733e-7e15-4046-a9a0-3d1f5e5b76f6", "comment": "Malware payload (Mirai)", "value": "7c436024d8322fc7249024f70140269a132a9112", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874074, "uuid": "7bf4431a-968f-4c73-8a52-c71cba582050", "comment": "Malware payload (Mirai)", "value": "3782ff9f3f24697cd67dc284f529027825ce278cf22ed26b85aa17a65c191ddeeec16edf38fb57477e41318a0952b183", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874074, "uuid": "462c930e-a457-43d2-b13b-87ae08e069e2", "value": "T18CE55E62ABC7DCAFF7A903B506F389B4B3E8A15231758DA1C36F76061F251A4450DACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874074, "uuid": "74f6ab1f-719d-4508-9998-54e6c7f6f565", "value": "49152:5Q48j+bRARRNAAmgsDY1YQK62+HoyErCVouPPKqTF:iRNAAmgN1YQK62+HoyErmouqqTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874074, "uuid": "157712e6-7a4d-4bf0-8f48-028ed1454cf9", "value": 3081864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874074, "uuid": "f85e2063-cdd2-4765-abe5-73276799a82e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874074, "uuid": "0dfd5f5a-5bcc-4c37-a392-992a89b54a75", "value": "ciubuc_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24959289-3e69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875673, "uuid": "d4f9ec56-8dfc-453e-9f9c-1e44ad787fb5", "comment": "Malware payload", "value": "649852a6d791c5601d14d39f9db32717", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875673, "uuid": "69f2385c-0642-4ade-8c9a-fb49e1b8d77b", "comment": "Malware payload", "value": "dc2e63a993d62f77c72102b2a6b5907ae5668b5ebdbd029b1d08c12c14168e2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875673, "uuid": "aafc3832-6cce-4796-8cc3-f8030e2632c9", "comment": "Malware payload", "value": "2879788ad00e9f31e3b86222a27cc1020540431a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875673, "uuid": "09628b30-0a10-45df-b78e-69df8b9885fd", "comment": "Malware payload", "value": "11870a9eac1c1af48db24c0c6f5c479b732110b08179d232ca23a7c47ecabdea561704d3d4d615a106c622afbf3c9d89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875673, "uuid": "9d1af242-e273-4c3e-a0bd-5bc2b3048855", "value": "T17CB64D15AC842BFAC46C4A7444EEC95622B05D140BF24B6A75A4FFE9BC762387F078DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875673, "uuid": "e75fc49e-b1fa-4958-89d5-c5e0cf51dc5d", "value": "98304:L4hCDyAzPikXtD4/Ehus2uQAsIWuXW2R15oPKA1q/eWLFklFcKa:8heukXtxhF2utb15oiYdHPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875673, "uuid": "1cdd3fd6-3042-40bc-b5e9-8106a6f7c8d3", "value": 11007551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875673, "uuid": "b6ee7e43-52c5-42ac-99f0-2413a6c2491c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875673, "uuid": "433b82ab-5a82-41df-8eb0-8b2de9bbcc10", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0d3389-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876923, "uuid": "92287b9b-488d-4f8d-83d0-fd1976f0cc1f", "comment": "Malware payload (Mirai)", "value": "75524d92b58134a263a4f974ff803d51", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876923, "uuid": "315d024d-938d-47ff-bd4b-453aba108ba8", "comment": "Malware payload (Mirai)", "value": "dc816a34db08d916d083fadbd1c5d5fbba08c4e0ec72a3f355c071f53fa326fe", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876923, "uuid": "a4de138b-628b-47ad-b566-228c6cc0ef92", "comment": "Malware payload (Mirai)", "value": "b0809ada9d41464ebca61d817ed7042972c1dad9", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876923, "uuid": "ce95e7c8-f4f2-4c62-91f5-589a21ec8991", "comment": "Malware payload (Mirai)", "value": "5052347a6394a6385dc92568237e50ed04a8677eac89edbd3f35f487ff0e705f524ffc6bb90d6b25d943e70f58518574", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876923, "uuid": "80814fd2-2b29-4d27-a4be-1cf3d9d482f9", "value": "T191F2E1310A4F25B0C6F0ED79A37C04C969970A00C1B3BBBA3914A5E5F794CB736B958A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876923, "uuid": "89eda3a2-e127-42aa-9d95-27f77d1e52d6", "value": "768:/ZAb2jdTWDPtuRl/x1lADatHKeo6SekEaeHPQqhMrCDZ0s3UozD:/ZAKjBWDPtuT1+2Fo6r3lVTXzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876923, "uuid": "b9a51526-1923-42f9-a975-12d6db30f1e9", "value": 35556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876923, "uuid": "de7f37b4-0f1c-45d7-a5e0-1d5150c93813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876923, "uuid": "c6570834-3e65-482a-a14e-0342447af605", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ff2a88-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884448, "uuid": "a7b24638-4dba-4820-97e2-18ded322451b", "comment": "Malware payload", "value": "487c01f77d2e1177b1ef8fb223eee375", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884448, "uuid": "7cc3166f-85ac-4faa-b88b-84cb1a57ede8", "comment": "Malware payload", "value": "dceea604d2c4f434676fa12d255f2bb1269bf60c10bb93c186c1c06555f8999f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884448, "uuid": "73ec0c69-ecf4-402d-8927-c6c223681c0c", "comment": "Malware payload", "value": "b5e17bfe01e3b25d8ec525cfa10161773ac23ea0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884448, "uuid": "d80d0ecc-19cf-4caa-9180-7a15326a0b19", "comment": "Malware payload", "value": "126e0528d18a675710054a14b6ad3ba7a6dcbfee8199555d47de76f0a779730400511ee36d5687dd1cb6fafcc221a8d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884448, "uuid": "b68069bf-ac5e-4bde-a37e-decbb04cdb56", "value": "T1C375D0A173865563DEA88B3106E38370A7F5392152F3425EE316272C0F725ADAD1EDEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884448, "uuid": "b55d29b5-536c-4c71-9dbe-d2a680dbc7fc", "value": "24576:TD1HGqhZd4FILjPYubEn206uIOQjW8mRygboInyFfTKJ1O88rNNLVGAHsoYfYms:PZYILjP/Eh6Hq8QFyFfg1O8EVGAHmwms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884448, "uuid": "4850c58c-59c8-4559-bc0b-0f63f61f2242", "value": 1563542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884448, "uuid": "0c6dc87e-f047-427c-970b-ec592e6bb964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884448, "uuid": "eb4d94e4-ac50-46ba-8617-4628274eb86a", "value": "bot.mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9506a494-3e78-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776882304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882304, "uuid": "00cd2b7f-c606-4555-bb8f-0a41de75217c", "comment": "Malware payload (Mirai)", "value": "6bb58ba5e8063f7b6b184c5006e6a4a2", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882304, "uuid": "90ec6df1-21ea-4aae-ba37-f26eaa521af1", "comment": "Malware payload (Mirai)", "value": "ddfb98e8d13984a2763adcf061b593941e3bb99cf11cad76f66a95a3a95fc59b", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882304, "uuid": "3f1147bd-f947-4568-ac2f-3fc2287c7e66", "comment": "Malware payload (Mirai)", "value": "ff1a96124ee36c23e319fb629b264addf516af0c", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776882304, "uuid": "cb5e4bc1-56b0-4764-bf0d-177c3e455008", "comment": "Malware payload (Mirai)", "value": "d5d6f4c7fc025bc1b08d56305c0a5dfa40d6189b9cc80f5a4570d9058d8e26c501e3e516f9a67120efbf68a5ea6091f0", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882304, "uuid": "665278aa-5cd5-4aa9-8f0b-493ecf6f703d", "value": "T1C7655BC7AA39C9C6D0717D37D266FBF192AB367548D85E4C8C9CE32644B1301CB16EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882304, "uuid": "9f04dc2d-f324-428b-a922-39a412973955", "value": "24576:53n3dEdW7yq/4NAuLe/ChGnv2yDOG/2D:BdEdW7zCiVO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776882304, "uuid": "6ef72302-94ec-475d-aa41-a1134140821d", "value": 1432520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776882304, "uuid": "b6d4ab76-5ff7-471a-89fc-a4f8e2458ae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776882304, "uuid": "1ff251de-2a4d-40b1-92e5-eba198240b19", "value": "bot_s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91da4f9-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776850984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850984, "uuid": "cb562398-19bc-4de6-a7f6-0701a5e1f986", "comment": "Malware payload (Gafgyt)", "value": "f828d374bbfbf09045269aacfcb99231", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850984, "uuid": "ea87fd50-3030-4431-8ac6-eb805f604c9c", "comment": "Malware payload (Gafgyt)", "value": "df0f35be133fe0c0eaf730004749681beaca144ddfa7da624495fd4abd0d07c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850984, "uuid": "344e1fa5-765f-41a2-aa74-9cba7d3be093", "comment": "Malware payload (Gafgyt)", "value": "ced647806af265d4a1a718061f1e282812b4262b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850984, "uuid": "5dcd1721-ea0f-46f1-8521-fe77fe83c82d", "comment": "Malware payload (Gafgyt)", "value": "0cce2d551e4080bbd6d886e38c6d79acbfa34728a734ad904726b51f7e68bcbab07dd87f40fd88893965317c478dd6d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850984, "uuid": "696295cd-cfa6-4110-b0c6-08edec5f162a", "value": "T1E073088799229FBBC016F4F065F54E740B15BD664E1B0AD96435FAE0427F4CEB00AB78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850984, "uuid": "10e8442a-6cbd-4030-9d2a-64c76809923f", "value": "1536:wS5xbqmzZL+quXPKvA6K670LH/JCaIHalYGoR:wS5x27PXS4E+H/Jahz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776850984, "uuid": "886816fe-5c4f-45ec-b04d-c372ed9892c2", "value": 80700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776850984, "uuid": "3fcd7bb3-75c2-4e48-ae5c-3185c2334c4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850984, "uuid": "3e4b0713-6646-490b-8fbc-838f4eaeb384", "value": "SH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56560da7-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876186, "uuid": "d64f3d92-00e4-42b7-b99c-2e544e22e7df", "comment": "Malware payload (Mirai)", "value": "4a3610398bf12fbef389db488bbf545a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876186, "uuid": "07499380-4420-4b3f-940b-3b05834c5d0e", "comment": "Malware payload (Mirai)", "value": "df3599e2a986e613a317a404d39e88bde21557d784359c1d4a560d5cc7aa6cb6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876186, "uuid": "f49516d9-43fe-4074-8d02-7f55dca9b6a2", "comment": "Malware payload (Mirai)", "value": "8e9aff28d4790d1c5ced178a45653166819cb1ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876186, "uuid": "3899266c-708f-413d-aac3-91841aa097b8", "comment": "Malware payload (Mirai)", "value": "dbfd245031457dc1702663d81351c271685a12aae67539d15f33bdd7c752e83085fa842f2c5bf7797f2189a8e19d12e1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876186, "uuid": "11add745-8f2b-4a3c-a587-a5430be9dd97", "value": "T134A2BF7CC07D2B95F5ABEEB01C1B63D05BE94B5D31E68DE391115F00A6461336A29CCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876186, "uuid": "c58b0b53-8acd-4978-bc73-13c5aec945fd", "value": "384:A96kxojV9aaEoJ3hZNpdznTG4vCq7YAfRJm2eLSM4uVcqgw0Og724kmWT:UyjV9ax4FpdzNeAfHm2iJ4uVcqgw0X7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876186, "uuid": "31752d14-3eb8-4a0d-8026-3dd06b431b52", "value": 22796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876186, "uuid": "f86a1d89-d749-4f0f-a057-f082d2ad0bed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876186, "uuid": "22d3b384-4198-4539-a839-3ff13defab2e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747a4454-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884397, "uuid": "cc56f788-64a5-47c3-96aa-fd8b66c1b3b2", "comment": "Malware payload", "value": "a7e4b75324c5cb599fd5074631705559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884397, "uuid": "54da1ab8-c464-4d05-b3f8-0ab5aacad49e", "comment": "Malware payload", "value": "e01190a6aaac157ffe505f8e24c025f0b915c288f53a04a0cafc48e0613fe156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884397, "uuid": "3e9f5e32-0690-4a5a-ab39-dfd1328f3c1e", "comment": "Malware payload", "value": "a0f743f85648188820212a40a11d35226429b570", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884397, "uuid": "463391b8-4df3-4a69-9ebe-cdb39816675f", "comment": "Malware payload", "value": "0c8bb9c072a821733f8b2c215c82eca1b3611e0fe30deab4c69621717a92f60507953bb830b55cd456aae07d0b260dfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884397, "uuid": "2c2c63e8-5bab-4c0d-b20a-e7f0ca8cf531", "value": "T1AA75D153EB090F9BC0EE8B34C41A829B03686D935552C76EB69C3F9D6F3E3994F81548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884397, "uuid": "3558f70c-cd1a-4607-b940-c77eff0c2a31", "value": "24576:xxc/VPsVv2PnS3333333333333ZI3a33333D51uIOwnW6n6OpVIZYQJ97E1giBiG:SPS3333333333333ZI3a33333zFWgrpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884397, "uuid": "43dff59d-b868-474d-af78-70ca75f9ed5a", "value": 1563591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884397, "uuid": "c3502bee-d501-4766-9efe-5a3475821848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884397, "uuid": "eecfa111-2265-4599-bb23-95ca1195aa92", "value": "bot.mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f76d4c9-3e99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776896253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776896253, "uuid": "e2859eca-026c-4fa4-a078-91b88eff2e4d", "comment": "Malware payload", "value": "3e4f06be4e94542f85bde79ff9560b41", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776896253, "uuid": "0dec4703-f1f2-4ff9-b580-3ae2e32f5caa", "comment": "Malware payload", "value": "e0210e510cdeec97354308971ac2b3f047b4df8d464896c1a2a982a35a99c070", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776896253, "uuid": "35ff277b-28ed-4402-b178-b474162dc5bb", "comment": "Malware payload", "value": "b51695912b78f3da16d2cc595872dce0ec5a3013", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776896253, "uuid": "7ebc44ee-b6d9-4a35-9a55-58cbbc717ccf", "comment": "Malware payload", "value": "bb1eec64dfc71fe8d8687f16244cf1cee6ece61e5b0f3e034560f66bcd2f8da223505dd61aee262a251acde936d3522a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776896253, "uuid": "937c0cb1-c9e4-49b3-b637-8f030861e681", "value": "T17775220D6BE45183F1361B74ACF5C365A339B9706B394A9F0548A179CE133DA6E22BCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776896253, "uuid": "87b0dfc7-997c-4d57-9e00-eef694342ea9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776896253, "uuid": "3dfaa39c-38c1-43b3-afab-edc9a759f66e", "value": "49152:ijuzVhRcKOZWtx/qGjoKJGbB2bs7J7ytz3E:r2KqWtxjWH78z3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776896253, "uuid": "48e8ef71-6235-41ee-96e0-4930f20afa2c", "value": 1701416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776896253, "uuid": "35fad383-de42-449c-b816-d1671a3a0667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776896253, "uuid": "be042202-325e-417f-a308-49c4e4267f58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb92c9d-3e7f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776885436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885436, "uuid": "4e6337e0-8f0e-4a84-809c-80a0f441f5ac", "comment": "Malware payload", "value": "1849af58420281a39d7dbb29de2e8e24", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885436, "uuid": "15dbed8d-9677-4aa9-afb3-294e429ef01d", "comment": "Malware payload", "value": "e0635fa076f3c70f282c47038222328a0fc8b26e5e8b689b7ba909a2769eb973", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885436, "uuid": "ab4b00a3-0558-4c81-b231-19af6d036993", "comment": "Malware payload", "value": "9cb8aa058fc4dd468b5109176642522aa25ca96c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885436, "uuid": "05f02218-2da1-4bdd-bcaf-40b7306fdc80", "comment": "Malware payload", "value": "759d31303e703d998af4d8b6fa01e93acea9b1ad21ca4e27f4af5aa123f00826272392707c60a82b34dc65ae9ad63262", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885436, "uuid": "6edecb86-3bf9-4635-aa40-891e548a9172", "value": "T1CFB57C42789105BDC4AAB73148F27682BA35B8180B3777D32F91AA783F37BD01976746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885436, "uuid": "b4e52e8e-e764-4219-b6d6-ceaa497a8346", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885436, "uuid": "b9f2401e-e327-4759-afbe-f79a01d34e32", "value": "49152:UFDjRT1qYcGWsTzBiZ6YNttShdQxH3ubXubFtTS+hYDGO1yH:UL5zd4H3ubXuZtTS8qZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776885436, "uuid": "30b2521a-416d-4400-bda4-84a71580b21f", "value": 2368200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776885436, "uuid": "66cdcf3d-8edb-4d2d-b120-57df55bffebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885436, "uuid": "55669408-26fc-4255-a85c-7962f81c5a66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee6fe4b-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884441, "uuid": "ab554a65-054e-4376-88bc-7037a7116fdd", "comment": "Malware payload", "value": "25917aece3b29bb873ef996ce09977fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884441, "uuid": "4ab84134-e2bd-48e2-b41e-25c8c93b9861", "comment": "Malware payload", "value": "e0d5db8172057472d31d58a73096a73acd5434619855ce0ca141ccb8323e2943", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884441, "uuid": "d273d77b-ee80-4fbc-aabc-5df823c92fc8", "comment": "Malware payload", "value": "5639f8b852ba9b385f5b9ab5174bbcf4546b6543", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884441, "uuid": "590704dc-cb1c-418f-b145-39fcc1e37d64", "comment": "Malware payload", "value": "b2a56c30615870b3f85451e348411e4cc40476cdfc7b270e860aadadb0a37b2e42b947a7c1d4e9edd20afa3a366b9912", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884441, "uuid": "0a69a767-b6a7-4ff2-b321-4d3c1a6963fe", "value": "T14E75D047FB184522C9530EF0197F43D9F7217A5341F5A22A370EA7672622E39DAC738A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884441, "uuid": "bc8182ba-2ac5-42c6-a311-d8fb0265ab64", "value": "24576:xHUcf3MuHMwp1W6mYSWgZXpAvMsqJbHJPPNqvCXi4qS1F9EY/aHo/HGrJE0:xHUcf3MuHMwpsdZXpDJDJnNDS8EYSIof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884441, "uuid": "8b2ab0e8-7ffe-4d6f-b480-cef7b07c97ed", "value": 1575163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884441, "uuid": "923df166-390e-4c28-a1d1-543ec7872f84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884441, "uuid": "35e064ee-857b-4b39-aec0-cf03782fda79", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169e034e-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894977, "uuid": "9b5d0c44-87fe-4f92-b6c4-b51213f7fdb4", "comment": "Malware payload", "value": "12c83e8733d8dd008f9996c536725e1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894977, "uuid": "0be7dec0-7e95-45d4-8921-0c419471814a", "comment": "Malware payload", "value": "e1479a140ad734cf373d5f6ede4bf4815123b74567ab89d88fa7d95e4d57edc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894977, "uuid": "4186c210-2794-4573-8a5a-74ed9b0ac1d7", "comment": "Malware payload", "value": "c61ca35762c2208f073758a8cb950a5fef0ac68f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894977, "uuid": "43f73432-4aa8-47ed-aaf2-e68a03921945", "comment": "Malware payload", "value": "0e1b390b182312bc9b1420890af9ba4d7d28a2a40d59cb9ac9be9a933cd641b7265deeaabc223ef92f07c34a846f4f24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894977, "uuid": "ccba2ec8-5083-44d1-93fd-45783269691e", "value": "T1FD764A03FC6555E8C1A9D1758A629263BBB17C896B2027D33B50F3382F73BD06AB9750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894977, "uuid": "5d02834c-8de8-4a11-ba08-752663b86f37", "value": "98304:uh9U+1aJew6t49MJboi3xjVPCzHn67NEN:u5Qent4aNxRkaqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894977, "uuid": "1054b06d-6aa8-4ab7-a85b-551c5dbbae7e", "value": 7590180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894977, "uuid": "811158c6-5654-4ff6-9c15-512d2356a4a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894977, "uuid": "943cef86-53fb-4c78-8141-3c9d34ace23a", "value": "h3flood.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef57ef50-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776885032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885032, "uuid": "01cbac22-ae88-4618-bb1e-4aad13a14c34", "comment": "Malware payload (Gafgyt)", "value": "af046c05d3615b7b88311591ae700573", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885032, "uuid": "7022cf2a-2aad-4e18-8be2-715d5c9dbcef", "comment": "Malware payload (Gafgyt)", "value": "e182636ff70910d6ea6e1492eb7ed99244763ff142a7148879bf4f889aff6341", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885032, "uuid": "9692cbe2-2471-4e74-a54e-eb8f01e8cda3", "comment": "Malware payload (Gafgyt)", "value": "2a90050b4c4147d094a8e0004f3209d5d5a73a7e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885032, "uuid": "a5be5242-7781-464d-883d-c651ce4f7f7a", "comment": "Malware payload (Gafgyt)", "value": "3680b7f43f05c78e7b094ead9891155ba323c826dff67e93d68f41e2fcc754b75acc60e5079512dfeb01d8e8b096ffe8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885032, "uuid": "70c99a9f-08b3-435a-8d17-f0e0e27d26af", "value": "T15D04B63E7922AB7EE268827107F76F71CB5511D333929392E13CDA145EB224E188FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885032, "uuid": "e7dea580-b58e-49ee-8e0c-776c787cb5dc", "value": "3072:UhZRj5n9EmzUyMhW5hWTt5s1qAuhmv8uqx1BVnKoe:mjrYZW5hWJ5Lhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776885032, "uuid": "ead7f8f4-df29-43c4-ab10-ed7106d9bb59", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776885032, "uuid": "7d5564b6-660e-4555-9bcd-8d74df64ce60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885032, "uuid": "330977a0-cec5-4bf1-9c1a-2df182116300", "value": "e182636ff70910d6ea6e1492eb7ed99244763ff142a7148879bf4f889aff6341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aab3436-3df9-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776827579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827579, "uuid": "dea8ab13-1fe2-4c2f-b1e1-544960ea051d", "comment": "Malware payload (Phorpiex)", "value": "96d30b26dc652fa01dad228fffb2ca60", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827579, "uuid": "0a57ed05-6a01-4106-9085-58798a7874e8", "comment": "Malware payload (Phorpiex)", "value": "e20627e035d0d1c7e9d4547a2a687866b7d62102a2b96aef935d3f0dec8e4adb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827579, "uuid": "156a7d86-f894-43cb-921e-6e51dcbd89e3", "comment": "Malware payload (Phorpiex)", "value": "bd72d574d7dd0eaffda315605c534267ffc16d27", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827579, "uuid": "ed54f244-48d1-44ae-a8f5-7530a079b2a6", "comment": "Malware payload (Phorpiex)", "value": "9a44ba93ff6aeaa8942262fc4c3ea1de828ed5ec1965a4ef572a9e617369bddda5a15ddb6eb0826bcda18d7fc5ebb303", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827579, "uuid": "f6969409-de99-4f51-8202-2ae7851507ad", "value": "T1D2823A0FB9424216D0D200B49A76867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827579, "uuid": "de3a3add-b3af-461d-bf85-800b0304ce75", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827579, "uuid": "38c5cc59-28ef-4c0e-9487-151fc098d1b3", "value": "384:TI78VGQic1Kwzw077u9NHu/gBhav8U9c2:AAo0769Zha0U1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776827579, "uuid": "555c039d-d239-481f-8a36-21377e4cb647", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776827579, "uuid": "e3c96bff-5068-4f9a-81cd-9c68b696cc4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827579, "uuid": "ec7497ed-3456-42a6-8520-53709e144a3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e41ac3-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875007, "uuid": "5ada8e97-b6a9-4c02-bf47-bae0a5bed389", "comment": "Malware payload (Mirai)", "value": "d185110b26d44625257bc1c6bd94aaf0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875007, "uuid": "ec91229b-09e6-43e6-a55e-d7916a079498", "comment": "Malware payload (Mirai)", "value": "e25b244b0eec20b63a6361538832c9f86e79f4b91cb92bf12738c15b09085cf5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875007, "uuid": "2e2132be-c838-4558-a6e9-2e3c77716190", "comment": "Malware payload (Mirai)", "value": "9c56ce0729e58d40ae2547d6735a0c1b3f582864", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875007, "uuid": "8f89d773-9761-4b8c-8328-a9ede768e954", "comment": "Malware payload (Mirai)", "value": "fbffb18de25ff8a84090515b21daa228a4346644dcdd7fa94922d753639f6e7ecd851b1fe0269eb7cc5b8997dfd7fd02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875007, "uuid": "a01b984f-c40b-4358-af88-2442dc5fd700", "value": "T1B5D308C7F900D9FAFC0AE7374853080AB230B7A545925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875007, "uuid": "240eb4bc-14fd-4531-9558-6479a6b35e9b", "value": "3072:kSbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFIIx:0rybytG/Oyi42VOgLNzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875007, "uuid": "1f2722a9-3e91-43f9-abdf-ac4ccc8e8468", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875007, "uuid": "0b5dd9a4-3c1e-4b3a-88b3-e539cd652f66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875007, "uuid": "1ea2b0fb-2a0e-4cfd-9156-5d05c7112bdc", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd767e41-3e1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776844254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844254, "uuid": "499fa64b-d419-4671-8db4-915dda926597", "comment": "Malware payload", "value": "3239f9859f92d1af9aaba7c84d577279", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844254, "uuid": "010e9ded-6901-40c7-aa5e-994a913ee503", "comment": "Malware payload", "value": "e3070f4d424f6f12029e0d4eff218395037b1d082bfdc8e7301386d4bfad051b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844254, "uuid": "28936066-d93f-432c-8492-750daf7a191e", "comment": "Malware payload", "value": "fc6c6e2ea9768b808e1e8d9ac9fd548878967f67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844254, "uuid": "d1ed766d-e2d4-4cf3-82ef-9249a7f4ff77", "comment": "Malware payload", "value": "f203e822bda7d7ee2dc028a49696a4e0fd22dc16470d9aab65703f1d857f755994cb015ac76690cf1a5d69f873ce16da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844254, "uuid": "4aabda74-ff10-4229-b1cd-da4ad87a24c7", "value": "T107E33BDF1A799D2CCE50666B7A106DC0AF1738A38C17C568B34C502732A9E9F3617DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844254, "uuid": "57c4b42d-5b97-43a2-8593-229fc38ead19", "value": "192:ggXcCm+NvLCQRVNQNfg2MnSUGWcEac8QMTFpO6wGAEaC4ZO7L:Zs9+pLCQRVNQXbQMZpO6wLrC4QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776844254, "uuid": "ed42b0f2-d832-4add-8264-3c0805a22728", "value": 144596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776844254, "uuid": "2dca00b8-7394-4fe4-b2d4-c13d4ae83788", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844254, "uuid": "60ed2047-23ae-4ce0-82db-fed06a1a8f3c", "value": "win32.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6abaf7-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821864, "uuid": "ab93a410-faf2-4607-a162-12800e667410", "comment": "Malware payload (Mirai)", "value": "e8ca477587c1ae574729e2c3d25d2013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821864, "uuid": "2e0499be-4146-4c67-9b98-55ebb068d079", "comment": "Malware payload (Mirai)", "value": "e314c8257f9acae2a4c2d85080df498cbc04c9493c393f311ea0f720ba868752", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821864, "uuid": "1aececf7-20cb-495f-b1b5-84ba63aa33fe", "comment": "Malware payload (Mirai)", "value": "9dd683a34316097b8c6fce29d9db46f989ba678e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821864, "uuid": "aa541017-8cca-450d-800a-166ab1d3e096", "comment": "Malware payload (Mirai)", "value": "dd83ade8522510fa5e6c53dc9b5112614c106ce5a0a28b3af5aeac895deafb3f621fad626f2001829426d8d711fb4712", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821864, "uuid": "5277132d-c18b-41d8-9934-1b4e7c3c7245", "value": "T1F7535A2579B63E07C0D5A07A25F38324B6A57A9E31B8C21D7D732E4EFF18650A4076B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821864, "uuid": "0ffbb79b-23f7-482e-9c2e-aaebd205c2be", "value": "1536:5gGDBBMo2g4RA2OCibSXYZoBsC+WSzeWHhvpdYm+R:e5H81eXGoz+WMhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821864, "uuid": "22c9b995-9651-42de-8257-34016f873071", "value": 64592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821864, "uuid": "7da7e958-1319-4459-93de-08fc357670a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821864, "uuid": "bbe1f51d-361b-487e-b8f8-fc383c6f55e4", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83bcfbc-3e7e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776885047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885047, "uuid": "897d4154-089f-47a8-a550-09f6b4d4dad1", "comment": "Malware payload", "value": "23e0aa7caf417226fbcbba945520ec7c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885047, "uuid": "1546deac-0341-4ee8-81aa-a7c09244d8a0", "comment": "Malware payload", "value": "e37a33ae70abce0c68b68c8ee3344ff2b8ca2d85bde53a49b1393c335fa8f904", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885047, "uuid": "b66369ef-1ff2-422b-83e0-33588a0d9f0f", "comment": "Malware payload", "value": "31cc338efd88355198b74a840e3632256bab5cef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885047, "uuid": "5a145ea1-dec3-4e27-9cfe-9416234cd670", "comment": "Malware payload", "value": "6f6352895430d3b84e6385b272fbc834eaf4d9e627b7ed2c664455b46778bacfc1d1e726f39ddc378f3f4af6fdd95ba9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885047, "uuid": "3ee4cd8a-53d2-453f-b881-3a8c951abcd9", "value": "T160E69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885047, "uuid": "a4a6abc3-3015-4c76-b596-7578ce0aef30", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQO:cqYUQuVDt0TZEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776885047, "uuid": "ba5234a7-1bc0-413e-9832-9d73f58b7cba", "value": 14876672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776885047, "uuid": "e94fc5d8-2eb8-4270-b913-06ea351d3240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885047, "uuid": "5c07ed66-4cda-4252-9d19-b152e2e8574e", "value": "e37a33ae70abce0c68b68c8ee3344ff2b8ca2d85bde53a49b1393c335fa8f904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64b896f-3ddf-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776816647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816647, "uuid": "25f0826b-90bc-4d9e-9a20-31f9b4a5dede", "comment": "Malware payload (Gafgyt)", "value": "60d85ea83dfa5a5d885c125f66b05fe3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816647, "uuid": "2bfe3d91-2103-4282-848e-a0abc6fe6f0e", "comment": "Malware payload (Gafgyt)", "value": "e3ec22f3ec568e83c4396a5458b26708756c8d28593896b7052572081fab7d32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816647, "uuid": "9283c9bb-7d67-4300-9e60-4b6ff1493156", "comment": "Malware payload (Gafgyt)", "value": "0cbd745755474668520e2ef070dec9bf76441789", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776816647, "uuid": "6a7e9e90-4279-4ce1-8111-f25019fe68ef", "comment": "Malware payload (Gafgyt)", "value": "c3e8612871fe65a482d4def788996002df9c4679f673a1b52e77ce0321c5436a94b0262dc1d944788dc812bfe0f6694d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816647, "uuid": "3acba8bd-e9dd-4fd1-a76a-07b703aa2f13", "value": "T12D5302DE074959CADC7B47339250079064202CD5745B7E0BC5E6D7738EE6B2CB478719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816647, "uuid": "6205b397-080b-4869-8b19-132f4176010a", "value": "1536:TPE02sTCoB6XrUAUQVgeEULjR7OQd3o7oFYs25NMIi2VrYp:TF2sThsFUSysjce3o7o85eItVrYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776816647, "uuid": "772262de-277c-44fa-a18e-533723c33d2b", "value": 61804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776816647, "uuid": "ed4f6fe5-c562-4a21-ac2c-e487d502caac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776816647, "uuid": "04a297a9-5f13-43a3-81ec-26f65c6d8545", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626248a8-3e29-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776848289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848289, "uuid": "7eace57c-3084-4e7b-a1b6-55c97bc788c5", "comment": "Malware payload (Mirai)", "value": "13367708de4de8c08b1d89b9c90de59b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848289, "uuid": "34e5b2e6-74ea-4cde-9961-35a75d6a4e44", "comment": "Malware payload (Mirai)", "value": "e414fb4d8421e5e5a696bcc5c87ba6dd7b37391239fa1903091c46dbb21f31ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848289, "uuid": "c138e562-ab9c-4540-86e4-8024832a8a1a", "comment": "Malware payload (Mirai)", "value": "379112212cf24d9292b4de2287275c21a737f5f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776848289, "uuid": "b7f0854e-93fa-47cf-a595-58e802c4f0dd", "comment": "Malware payload (Mirai)", "value": "e89307af8d5b75943c6a6b2ae32f353401dd431aec066467f4ecf66cdc23e830fd5c2fc2343cc2d8083d7b33749379b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848289, "uuid": "40764f4c-b8dc-4731-bb22-899ef37517d5", "value": "T12AC2F15DC70101AEF34C19B9B564CC9ABDD6FE2F2ABDD0ADCB7061241235AD6821CFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848289, "uuid": "e2fa03df-8332-419c-8d35-ae8a3af64019", "value": "384:fx/dcBiKMqv4rjkkcAXSLtPJVnTPJcLGKq0nO62TDMGDdXzPItMcp9LqvehTp/fa:lqCqveFCDvtvDjUtBuvedRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776848289, "uuid": "fac43dc8-2b04-4f95-8fd8-84e333812bcd", "value": 27076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776848289, "uuid": "de9147b7-2b4e-47b9-bc11-868c9ddbe8b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776848289, "uuid": "df868e08-4a41-494f-837d-d8706b56893d", "value": "luxzz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98657c53-3e21-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776844943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844943, "uuid": "df3aec3d-c6d0-4a77-bc03-c20106893bbd", "comment": "Malware payload (Mirai)", "value": "352795b70fd3a9a00ea2394f961afb4b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844943, "uuid": "f00ce29b-4c9c-4de6-b81e-881d0d8b17dd", "comment": "Malware payload (Mirai)", "value": "e44fe4c5cd112d2fed6d1c20bf9dc4a8d3e36b534d6dc6cd42ffd7a9bb550e20", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844943, "uuid": "2a75d98d-6ac9-48e9-b4ab-cc65f39eb74a", "comment": "Malware payload (Mirai)", "value": "7f8f4d10ecfded6a8107945e9567e9182b72fa6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776844943, "uuid": "d7785f4d-4183-4457-82cf-0d0209ee7734", "comment": "Malware payload (Mirai)", "value": "48e36bd4b06db0e818939db886f9204bc8a6c4f0c82bdd28b781f586482adffbfc49c42dd3c9211a743bbc6593dce617", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844943, "uuid": "0bd5c6f0-b2d8-4fd5-8113-d131b6eb3a4d", "value": "T190F054E6E1311B838405BF0DF466C6E4A162D6CD11875B9C6EE8706F867C8207911A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844943, "uuid": "d3a5c77f-abca-4f2b-9cd7-e02da6209561", "value": "12:EsrMVksQspbXsrNIh5sGjs7cKLKmvXsWeU:EsrDsQspTsrNIfrs7XKuXsW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776844943, "uuid": "691af561-c1d0-4b59-a6b3-0331889f9d61", "value": 501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776844943, "uuid": "d40c7280-5ad6-486b-892f-152f30082907", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776844943, "uuid": "da00c3a9-d8a3-44e1-a433-57d28008ca07", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac2193b-3e30-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776851202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851202, "uuid": "ea65fd51-afe8-4830-b9de-1144bf9f15f9", "comment": "Malware payload (Mirai)", "value": "cfe9302a2203ce3ab86f7b87a5bf7b87", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851202, "uuid": "24af6fca-baf8-47ac-ae34-100c5e23530e", "comment": "Malware payload (Mirai)", "value": "e485017a56aeec0934697f809bd15de3264bed828ccda6ae5b917491bb949a9a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851202, "uuid": "7225315e-c642-455b-be08-dbc3c07da452", "comment": "Malware payload (Mirai)", "value": "8aa469abd2c6d5aa5719f484c899c52858a211f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851202, "uuid": "6a3fd820-41d2-46ea-86dd-b9d302b9b5a0", "comment": "Malware payload (Mirai)", "value": "0f766967598da5f03b5743d3f178960adb32e2fca5399a1cfc5332e4a7f6a579d35b3635855f93a5306cc4a61b4c8479", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851202, "uuid": "cbffbe82-4fb4-480f-b529-b9e76d213e3e", "value": "T17DF05BD6B1311B834845BE18F469CDE4D262D6CC26876B986FE8706F863C9147A11608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851202, "uuid": "9f8cbc09-5c16-4056-aac9-05c55ccd4868", "value": "12:Esrlws4spYXsrNIh5OGjs7cKLKFfXsWeU:Esr6s4spUsrNIfRs7XK1XsWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776851202, "uuid": "72d3a809-b583-40c0-9949-f5ab4d457aba", "value": 512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776851202, "uuid": "dba5ac76-61a6-432d-b357-58f394e3ee8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851202, "uuid": "7faf576d-1153-42b4-b26c-b98f4033efac", "value": "p.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb52754f-3e19-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776841566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841566, "uuid": "ebeff82e-367f-450c-918a-b8b9fef5dbd8", "comment": "Malware payload (Formbook)", "value": "2be458246935a1f5c4295d1ed59c4ab1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841566, "uuid": "42667cec-8b61-4fbc-8f14-4e2577b3921d", "comment": "Malware payload (Formbook)", "value": "e4856f65f0024e68034394f3419a235602e56348b88bf73dcb5a53a20684d35b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841566, "uuid": "42e06944-8c25-43d4-b15a-1a116cc5ecdc", "comment": "Malware payload (Formbook)", "value": "7f13dcd53d5bb83cc4b68f0a87dfa87a043ca840", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776841566, "uuid": "70e3c3c0-0df3-4774-8397-bd86cc3fcad1", "comment": "Malware payload (Formbook)", "value": "21b228079bfcbe357323b9535a04a3583c286bd8dee986c357edf82e15fd4e2127ff60af883517852af5166e12118a92", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841566, "uuid": "7324ee13-d8c6-472d-a7fe-1ff54be19523", "value": "T10724492599B78758A4B3FB043EED447DEE873968998C541E00478BCF8667200CEA7F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841566, "uuid": "dd7dbc18-a1b8-42b6-a5fd-03d8e49629fe", "value": "3072:wKr5JRjunVHzcjaUU4IVb+Shou+ITM9TDFeMEqz2LxfIPwmvZ7iLMNo+bB0EMmND:b/RCVH4zItuJBxzyZwv1y+pgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776841566, "uuid": "f2d731ed-4c8f-4b88-a0ae-88fb745f2a07", "value": 211580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776841566, "uuid": "7be21356-0546-4f03-8c98-b451c3effe20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776841566, "uuid": "35b510e4-5271-439f-8164-cba152fc49bb", "value": "BOQ.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87f5402-3deb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776821858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821858, "uuid": "fb98ec81-fffe-4152-9442-fd64d3fc4270", "comment": "Malware payload (Mirai)", "value": "827f63e6e568f3b56d17ec69fd5bc99e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821858, "uuid": "c79a4856-1ed3-4fb0-81d2-c96b69398d92", "comment": "Malware payload (Mirai)", "value": "e489502498829c8164587166d010472284b2d3b414752058a2ac8de82f0be599", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821858, "uuid": "652084d0-40fa-4b8a-a728-3c8014e11dd3", "comment": "Malware payload (Mirai)", "value": "ff3cad476381df03b31ba293514f7ccb44ef44d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776821858, "uuid": "e3a52912-10bf-4873-bc12-c1786b694a12", "comment": "Malware payload (Mirai)", "value": "1815f8c830e3754d8914a6e141205ef40c09c1ffffef326883db41c32d1c9a4e5361ee9c0c6a6d229c50d7eb526c59a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821858, "uuid": "6ee508a4-67d6-4646-a9e5-9e16595c7afd", "value": "T118D34B46FA408A13C4D517BAFAAF01493332D7A4D3DB730699185FB43F867AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821858, "uuid": "a49f9995-5a9b-45b7-8057-b7ea474e25e7", "value": "3072:wSWIdMFUC+y8i4PzoxNOqMP0wctzHnRl+dw8M/9DYj:ZWIdeUC+y8i40xNOqMPVoj+dvM/9DYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776821858, "uuid": "77b0daf9-031f-468e-89b0-c9c2c7276e29", "value": 136786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776821858, "uuid": "42b218cd-e599-406a-a6cb-ac165e05ad86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776821858, "uuid": "8f47888a-3536-4a49-860b-66942725c4c1", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41a8f91-3e63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776873417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873417, "uuid": "ae64c091-f987-4db6-b03c-addd26464a12", "comment": "Malware payload (Mirai)", "value": "1f03defaab2475d949d52af9388317a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873417, "uuid": "ea529ebc-5564-44cf-8b7b-74bae8348da0", "comment": "Malware payload (Mirai)", "value": "e511a3dbfe2ff2d50c7b62916b1becb684fbb35bd3ff7e9e505ee4fd3690da02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873417, "uuid": "ebb96830-60e5-4e0a-bf22-de0f81455858", "comment": "Malware payload (Mirai)", "value": "ebf5e70366ea5c02457e94f49235daf0fc697340", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776873417, "uuid": "7671a538-f3d2-4577-8df9-6fa4e93f7f6c", "comment": "Malware payload (Mirai)", "value": "50a3cf9e8566fec10c622bf045182b6a25ee4a153bbc9b817ab9d1314d53d0b5d802fcea5062eced3635cca9395c0371", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873417, "uuid": "7846b51c-0271-469b-98f4-0df711d9496d", "value": "T124333A13258089FCC40982B147BFA62BF562F4BE4234F58D6BE87E26FD5AD310A5D4C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873417, "uuid": "d786c69e-2ace-46de-a6bd-6cdfdb728846", "value": "768:y4RJrbgdrXpCJ9t3C0q0GNls1qtgNod6k7a0iGxDopKXobK27ncKleTBn:Xrwa/t0XNlEqSCf7a05xMdO2TcEeTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776873417, "uuid": "779f72fc-cd52-49ea-8abd-132e8086de05", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776873417, "uuid": "69fcec5f-ff7f-4a80-bee0-14e33d2b5dd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776873417, "uuid": "bebf552a-2934-43ab-bf7c-7ab2adc3069c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8110841b-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888713, "uuid": "269d22a2-e676-432c-89b7-f7d1c8893360", "comment": "Malware payload (Gafgyt)", "value": "00906ef1d1743fd046325525f388eff4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888713, "uuid": "00ea77dc-c739-49b5-bac0-e76b28ea35af", "comment": "Malware payload (Gafgyt)", "value": "e5edf3bcb6f332ec96b3ab188d34b942fa36a51776918be26fc1d21af1d98549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888713, "uuid": "9583c682-66df-4288-a51d-0afc60c1bc51", "comment": "Malware payload (Gafgyt)", "value": "0662d9807dd2d06affbd21f97f931a30f2520e0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888713, "uuid": "daa35543-b036-4536-82d3-e3f2f2a7274b", "comment": "Malware payload (Gafgyt)", "value": "d1df639cf60511484a76c29523437ec69aebae9b624b0647db892abd8aefb0465efe9152d29f0f3c1ad5243a2c0c5ee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888713, "uuid": "e06a58c5-0a69-494c-bb7f-2f6f0ae82fa1", "value": "T1DBC3842E7E12BBBEE668863107F35F70879521D237A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888713, "uuid": "3fd1db53-020b-42ef-9dac-c8f926c28068", "value": "1536:g7je1TYGq+f+A02rKXzeve1eTe8p2rKXIeum9Y0GAzQj1l72HBesERLWfRZrmW+i:/a1UW0MZQHCB6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888713, "uuid": "62055567-da90-42e1-926e-59969af67b15", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888713, "uuid": "99a8cde9-f8c2-4942-affe-d739e530c28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888713, "uuid": "188149ce-c1c7-41e1-b11f-25558db32e19", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c925be4-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876652, "uuid": "3e2ddc66-7a4a-4dc7-81c1-2e451cda8075", "comment": "Malware payload (Mirai)", "value": "0eca35ee0b680e3da6742097de3a9229", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876652, "uuid": "7b9452a7-20a7-43d4-8e9f-b5295083c4cc", "comment": "Malware payload (Mirai)", "value": "e808680f00a895f85938264e3209720126af0ea9c2195ec9f7148ae4b06643a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876652, "uuid": "1fc94de4-6520-4fb3-a953-a3272df7b694", "comment": "Malware payload (Mirai)", "value": "b165c17a6cefb4d2ec9486ee0ea701f61565b919", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876652, "uuid": "82ca6243-899a-4473-9dc2-160472a9ddb5", "comment": "Malware payload (Mirai)", "value": "08867a936a0c3cfaedd7e0c9d1d4f0331c7f7feda1ee48a96dc2165775a4edd83737c18568a77f18b62487183e6c8bef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876652, "uuid": "34e5a266-fd9a-4acf-a871-679090c3535b", "value": "T112837C32BA751D27C4D0687A61F30721F2F6479B25EC8A1A7DB20D8EBF2564032477B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876652, "uuid": "00dbacd7-2ae0-4c3b-9d15-25ab9f9c983b", "value": "1536:BqjSIdmh69OHkGvTdN5zo05VzQKt0qrNM5owQovwVY4t/7o9VNNus73:sWTlEG3VnXScN8vQKkK+s73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876652, "uuid": "58825167-f89c-4fd3-b5fc-3fe3a112d140", "value": 85512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876652, "uuid": "cb0b5d98-822a-492c-ae26-1d75af5315b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876652, "uuid": "e1ef958c-7e5c-43c5-92a2-dc65f0a39170", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597576d6-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877050, "uuid": "850cf7e8-8433-4a89-b24a-934ab59b8b72", "comment": "Malware payload (Mirai)", "value": "3a1996e63e4555a9b73b5d4b23e14d62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877050, "uuid": "8eccd56d-3b08-4dfc-91a9-3d4f1929f387", "comment": "Malware payload (Mirai)", "value": "e865bb385faf6cdb51f2b3a1b7e4a640578d3be75e97f2d9f483e15a0ee45dcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877050, "uuid": "b4d55451-b2e5-4dc5-9233-96b27cba4dc7", "comment": "Malware payload (Mirai)", "value": "bf61d0551c00c77608e13940adcf46de012ad84b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877050, "uuid": "43acba06-7cb9-45af-8926-2be14916196b", "comment": "Malware payload (Mirai)", "value": "5afd1deeee00fd765f467bd02db0152635ade9b05dcd16878d1f8a2a451530a631f0dbeb980a4650a41fc255ca3c64bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877050, "uuid": "8a10e5bb-4c82-473e-b555-a445b41fb106", "value": "T101E32C46E6814B13C0D2177ABADF42453323A764D3EB73059928BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877050, "uuid": "a6f319cb-87a4-490c-946f-7d04c6392b1a", "value": "3072:U+UgBWIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+UfIxLEaK0U456xl9RI9c3+ZgM/9d8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877050, "uuid": "5c76e9a8-342c-4ec9-948d-d6e231cd7072", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877050, "uuid": "581c723a-84f1-4698-8691-88c6594f150c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877050, "uuid": "04312c4f-8838-48cf-9124-3dde94c6908a", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e404431-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876924, "uuid": "2b948a46-9c1a-4b4a-9786-4224b2d8cd14", "comment": "Malware payload (Mirai)", "value": "6f5c260c0413f862ad04e86e1df94632", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876924, "uuid": "e4d93c75-0fd9-4595-bb64-95e250c1e732", "comment": "Malware payload (Mirai)", "value": "e8ef433a72ab1d858bffaf3989fe4bdec7d1557b9ccdbce9b2527194e14070c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876924, "uuid": "fe79dc0e-4881-43ce-b8ef-b31d5be4958d", "comment": "Malware payload (Mirai)", "value": "e8bccda15d117d5ada0de19995e50c08d6eaf9b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876924, "uuid": "8ac867d3-5843-4893-9087-c021feaad3ef", "comment": "Malware payload (Mirai)", "value": "4bc961c938e1f6aa0d1b927f82e8da1aeb715a6248532df9dd140cae9df8e6cc1dc8a91cd70dfb71f0b86d0a711d4156", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876924, "uuid": "19d18e37-0f15-4b80-a6d3-fdf269e150bd", "value": "T11003F174A797A5F6CFF42872DE7C8A5216C716BDD0ED104105B8884B15C3690BEFE9C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876924, "uuid": "075c279f-7949-486f-86c7-8ce557b96340", "value": "768:EbhbUpgfK/Aw0ipp01/tk+m+SDV8Gu7T3bUNHNS6u8Lf9q3UEL+K:IxUpgy45akmjX6TL6460LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876924, "uuid": "d33fb963-dfe9-40fb-ae9f-769b2f1c720a", "value": 38000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876924, "uuid": "c456114e-996d-4e4e-a9ca-3701e4fadf60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876924, "uuid": "30237d1b-3b70-4711-b933-e5ad4c22daf7", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8095730-3e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854553, "uuid": "8c06f7b8-bb7a-4294-83b4-01d0239a3a3c", "comment": "Malware payload", "value": "6c9d7649d7558f487bb83a46aa1ed3ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854553, "uuid": "a4f6265d-39df-4fe3-98ec-e4ee43285d83", "comment": "Malware payload", "value": "e90163b8ffbe74ef786301ab54e25a07a67d91988efdeec3f6507ddc64e51d0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854553, "uuid": "34dd560a-b850-4729-911d-2078e5ab568a", "comment": "Malware payload", "value": "769cc3dca657743ac55050077212a23177a47776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854553, "uuid": "901d3262-be6d-4d90-8523-f9ce0205b73c", "comment": "Malware payload", "value": "1f96b954717f00c2786bd0cdfa2859b0d179df0147b964000d77c468fa6700599d8d09743cedb25b8f95d04739cb71fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854553, "uuid": "3ed96760-95ff-412b-a027-68e3b0f68571", "value": "T17525BF83D293915CF41AC1715B2EA273F537BC458B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854553, "uuid": "2ae6c472-105d-45f2-b593-352f545ff9b4", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854553, "uuid": "a8cdf2c2-5e6a-4b58-8bd3-bc13b5b1a476", "value": "24576:m+pqs2ThOEe0JRh+w+yY5bkY5bBY5bor:mrT0EeiRhLYiYDYur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854553, "uuid": "361586d5-4bc2-41b2-a738-d9cb0230ca05", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854553, "uuid": "75ac7b99-0d6b-402a-8a02-01b7874f7f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854553, "uuid": "b83c810c-93e8-401e-9d69-185d8cd6cdae", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911aefe6-3df6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776826463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826463, "uuid": "e115f1db-66d6-4997-a4dd-36ecaa7fafe9", "comment": "Malware payload (Mirai)", "value": "b67630c8b10bf5258d1ce29ff6bb66ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826463, "uuid": "11598e5d-630e-445a-bed7-e09a0f6ad4be", "comment": "Malware payload (Mirai)", "value": "e9121ee0d14131466be33b166371afae3f5212b016736fdbcd0e0d4e650bfde2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826463, "uuid": "983116b0-10e9-427f-8e47-faec30f5b41f", "comment": "Malware payload (Mirai)", "value": "2a44af36fd87351cb6f76537b9232405e44402a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776826463, "uuid": "b013dcb2-0969-4dc9-b090-ce85801a4dc1", "comment": "Malware payload (Mirai)", "value": "3308e900fa433f8fc08ec8b828b09096a6e78403b227e3ba2c6b6e632ba9b358fbd5abc91cfccdd601f3fe7c573c35bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826463, "uuid": "1d3c9622-b51d-4b0c-b5b0-f127e47e7864", "value": "T144D31A41F9404A27C6D612BBFB5E42CC772A17A9D2EF72039D215F21378786B0E3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826463, "uuid": "aa5745c5-f791-44b1-9710-fcb3dda00bf6", "value": "1536:8+rPxAWgV+8JqvU5ZlVq8KApeLIK4Vv6t9T5KEizD7dmOHyISjBtEu27gWlv9wyY:RrP5Ns/lU8K3/4kDEEizHi/jK1HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776826463, "uuid": "2f2b9c91-f54a-4248-836c-909f0be1303b", "value": 142112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776826463, "uuid": "4369b6c5-5469-495c-abe9-4136d07b0ea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776826463, "uuid": "afc90b0c-519f-4e75-bc02-a0212537b63e", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e99a798-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776850886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850886, "uuid": "1d7f7cdf-23cf-4c61-86de-d62afc9e759b", "comment": "Malware payload (Mirai)", "value": "a65b2f002efde9b3d0d2f9ff4fe176aa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850886, "uuid": "0206d480-0e7b-4d95-a737-763365b0bbcb", "comment": "Malware payload (Mirai)", "value": "e99116e843033a68ed37b65c55628dce1e4d0834c4643f7a0ddaafe43b757272", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850886, "uuid": "eee09d25-d11a-40fe-bb0b-0f6eb0b9000b", "comment": "Malware payload (Mirai)", "value": "332cf69b6e7b9306ea416b4e931cbca2de951911", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776850886, "uuid": "b9c67f3e-bd88-4705-b9d9-96b8723918b3", "comment": "Malware payload (Mirai)", "value": "d477aa394d432c0257481745026ed2c9807224db77e03700158a30262c5aae5564f63784f22005129983ed15d335d042", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850886, "uuid": "357327df-a5d7-49d3-9042-cccc5e17a9dd", "value": "T18AE06DEC65712AC757249F00F86E83989A43EAC834B15A10A55534AE97BC1027D60F5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850886, "uuid": "c7dac15e-3878-4c61-9609-d3812912ca9a", "value": "12:3J3u9qxurNIl5zAxu7c0LKjxuzCxu5xuRiAUn:3J3u9ZrNI7T7fKEzhKR2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776850886, "uuid": "b35ab28c-5c99-48ce-934e-4b4a55c33d2a", "value": 393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776850886, "uuid": "75b4e8fc-6b59-4ee3-a6dd-a214cd0343f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776850886, "uuid": "31f35829-ba55-408a-8ac4-cbf0ff8b5829", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e947a63-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894963, "uuid": "d184e669-4c15-4665-8f03-28f9e3bafef6", "comment": "Malware payload", "value": "008911760290799e1875a7d893cf0182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894963, "uuid": "f40df38f-235d-46af-adb1-f570da75234e", "comment": "Malware payload", "value": "e9f439059d9f2ed5d7954345065c33995164fa700a3f43c0d7789545ceb2a807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894963, "uuid": "9ed90c41-d936-4b26-923d-8cc9a19416a7", "comment": "Malware payload", "value": "f56b42394ed8ea707c0d903cdee91c04ae9c25a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894963, "uuid": "860d7508-9604-4b2b-9ab8-10103ca5247e", "comment": "Malware payload", "value": "b6f486952d6b9888042cfc3c17cd4ed6e359ddfb63cf0e51eb4ca578517b474c64a6ef6ed3f3ec5f60280b1f29507c8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894963, "uuid": "fa07bcd3-04e9-49bd-81e8-9412ae3e937d", "value": "T10A565B43FCA555E9C0EAA1318A629253BB717C495F2163D32FA0F3386F72BD06AB5740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894963, "uuid": "7667e61f-4ea2-486d-aab1-6f284f99d855", "value": "49152:jB/YP46lKrfyTj8qCPCUIdGP1v3ahk7baehbOmXRbpf0gNhAxGz/I6jM8R5OHKQ8:jHXT9CWJik3aedJ70gDAS/fTOkvmCEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894963, "uuid": "597e982f-9006-4978-bc2c-8e24ed5a38b0", "value": 6136100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894963, "uuid": "b13eee2c-b6e8-4f0a-be80-1af7882ebe9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894963, "uuid": "96f9d03b-34d2-4203-8a44-358c0beed09e", "value": "h2rapidreset.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4cdd72-3e73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880301, "uuid": "91d9f87d-03c9-4e8a-8aee-986661875699", "comment": "Malware payload", "value": "72f5bcc14e6081c322017c31d0133006", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880301, "uuid": "db84b29b-c852-4dd0-890d-68eb31849b69", "comment": "Malware payload", "value": "ea5a88c54d61d962e477bac042b17b8549b87de3a99109d523e0554cab529fb6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880301, "uuid": "75a441c4-1b0d-4481-8c1e-5dec8a03ddd6", "comment": "Malware payload", "value": "8e10baf733270335f5ca5784f143fa05828ffd71", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880301, "uuid": "2c3b98a4-c181-4f09-9629-e447267aca02", "comment": "Malware payload", "value": "f3333618b619c00f9b38293f10b6d0e742f251814377abb0560398180cc4b1bd55ba7eaf606d9613e4133decd97966e7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880301, "uuid": "9e6ba1cd-822a-4318-9bd7-d1bf09acbc2a", "value": "T1221633325E54196607E4872BF05B3F327FAD5A43460CD4EA899AF193368AFD4C22F4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880301, "uuid": "c5013fd6-a644-4e43-b0b0-48abb56be656", "value": "49152:9ZtyfEWSpQJMs5cJTWpO+X8s0MXv1rCe4yiGnKUKek1:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880301, "uuid": "d295bb27-7690-425e-b1f1-c00ae8a9eecc", "value": 4025103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880301, "uuid": "f33aaf3c-85b1-4dec-bfff-5ee05eb6b6f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880301, "uuid": "5008fe9d-0128-4398-acbe-d5cd64c8f433", "value": "600170M0XCombnr_IYPFEousqx356459-U456DHHQNV.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbfbbe1-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776888734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888734, "uuid": "2eb16077-ca81-4e28-9d96-9c2f8133ca59", "comment": "Malware payload", "value": "069202e054cfdb9828bccba719bff6ed", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888734, "uuid": "7a766388-b0c1-4f66-bb1d-3f5d6ca3c8e9", "comment": "Malware payload", "value": "ea84af2f8981e23d6ad01b42a446eb3f63dec940d8b219d95238bab0eed742f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888734, "uuid": "5b1f9492-ad3b-40e5-bcc7-c6b5f6103c0c", "comment": "Malware payload", "value": "f4d9a59d6c178cfcdfc182e3ca0522b278f07b78", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888734, "uuid": "d02fa293-63b7-4aba-b668-76448bfdf57d", "comment": "Malware payload", "value": "093c66581443a33c14f041f34a0a374cdbb4729f406016ee806a159bb6560247c3168efc5aaea9654e2ed07c4ad92ca1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888734, "uuid": "8890c0b8-86ef-4ca3-bd58-5d70ca1e335e", "value": "T1194164CB205207F36DA0E83337744490F4D1A199A8D59F8B6EDC3DD84CBEDAC6549686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888734, "uuid": "686ad2b2-ee73-423e-99e3-fdb2a3c82e7c", "value": "48:1Qd8R/ttQdMug1bTpYTuS2LywtL335vLywV78T:1Qd8R/ttQdMug1bTpYTuS2Gwtr35vGw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888734, "uuid": "82d7dc61-3d3d-4f1e-bd58-9ac22f6cdca0", "value": 2166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888734, "uuid": "477e2310-ea1d-4acd-8d92-9511a65ae8a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888734, "uuid": "58d5166e-ce80-4689-9680-8e3e3cf45715", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655df32f-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897686, "uuid": "c66337df-fc21-443a-b668-19669115c2b8", "comment": "Malware payload", "value": "d694b49c7a089c09c90562753bf9e404", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897686, "uuid": "ff8cb31b-542c-451d-acf7-15293244537c", "comment": "Malware payload", "value": "ea983f7e5815f2e7eb1d37562eda56ab9a4c472a7ba96c178fd31d85dd1be24d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897686, "uuid": "7417c9db-02af-4b7e-9ba7-3d723b856188", "comment": "Malware payload", "value": "aaecb114e73c4c8a2abec2d2dab0dc8f92f9c6a3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897686, "uuid": "96c23e3f-2253-425a-a110-fadd1c837a90", "comment": "Malware payload", "value": "8a31298162feabe3b8dcce17cca9b191a198bc14eb570c053600f89d01da7900f3d653adb4e01e450ce4ba061d12079d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897686, "uuid": "bfb9351f-cb7c-4cd5-900e-8beae5e4b304", "value": "T188C2C063E3188A76EB5696B710E76A62DCAD6841720B3F97DEC482231C73DCAC215734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897686, "uuid": "8325c87d-1ea1-415d-bddf-b4c87dc2f048", "value": "384:V3w9gnt2S8DIsdV21a+rne/SnaZpPAaXjHGFZJ20APAWQ4+w65sCqf2ZM0w1W:19n47QI9nDz0BsCHiz1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897686, "uuid": "993be0b9-6704-4bd5-bb87-e3a36c8f1734", "value": 25803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897686, "uuid": "a5ad18c0-ec71-4c11-b18e-37ccef509da0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897686, "uuid": "a9507396-53ce-4638-943f-c9837c86a3f3", "value": "RandomBlockPlacement_-1.21.10.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245847b2-3df9-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776827569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827569, "uuid": "dec6f9ef-50cb-4d79-8331-bc6c95cd94ab", "comment": "Malware payload (Phorpiex)", "value": "ca3ff1eb26702eef0a2fefd636d5c3fe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827569, "uuid": "10bbf249-6673-4e8a-9418-c0f725ff5352", "comment": "Malware payload (Phorpiex)", "value": "eaa6fc0957da85282da01af471314a842f103b810006c224e2fb514ed0589660", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827569, "uuid": "969b2225-f042-48bc-b0a9-7f478597bc67", "comment": "Malware payload (Phorpiex)", "value": "12d14818f54ef76e68d73e818c1f750d3cfb3642", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827569, "uuid": "ea1a175e-3177-40bb-abc0-4f7e36e91c0b", "comment": "Malware payload (Phorpiex)", "value": "8d9fed46b3b49b3301413ccfd44b23cb431790f8c377272beee4638219c90b2255025b0f4d9a609d4685f77d870749b7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827569, "uuid": "4b62504b-be85-4918-b6a6-e5bea01528da", "value": "T18A824B0FB942421AD0D100749636867BDAB998B637D814EBFBD08AED1A686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827569, "uuid": "278eeac4-9a15-4b25-9811-d5409e7e611f", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827569, "uuid": "64ba9879-f232-4253-ac34-5582558539bd", "value": "384:eI7MVGASM1KwngSZb7u9NHu/gRhav8U9cw:TQ8Ub69Jha0Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776827569, "uuid": "50aced86-a1f2-4546-bb94-46c27f43b697", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776827569, "uuid": "1faeb51b-8691-4ad7-b198-e2378d4a1202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827569, "uuid": "e1c3170a-3eb9-452f-9562-532e417dd015", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cfa67c-3e7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776885068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885068, "uuid": "ea246424-df92-4cd6-ac04-0c79eb744aed", "comment": "Malware payload (Mirai)", "value": "81d9706f517cc5b39a0e4a5a1f567fe8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885068, "uuid": "b7cd7ac1-a9bc-4254-8168-c6e72a71b6ad", "comment": "Malware payload (Mirai)", "value": "eb57ca3dbad519573d65317a8b35ddfb6921e6cf6d44aafd466f856283e28803", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885068, "uuid": "048cff91-51be-4187-941c-7d58d9d6a048", "comment": "Malware payload (Mirai)", "value": "87a63a554429cc08e3522c0f09fcfd2556477864", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885068, "uuid": "86320721-0a05-4e0b-abbc-b35ac33764d5", "comment": "Malware payload (Mirai)", "value": "53ead12b16f5780cffce0ebfcd7e203662507824a5ead0cf94581a4e282a2a3cb5611cd0239e81c81a5a8c037e14174f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885068, "uuid": "b3e2920e-724f-4095-9ad5-28d2e2254387", "value": "T100A69E47B4AA04FDC4BAC470835FD2B2AE3474A40161267B7E8456713F67E205BAEFD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885068, "uuid": "748e6501-525a-4e22-b4e2-23b5f0912abe", "value": "98304:PX7reuk0fJh3X1OrcNtYk3NKZoSLkF5PKcS5IkxB6CbQGe4YQfWfbU8U46/NM+oP:o4XF8kF5StxJbWfDUvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776885068, "uuid": "ef106cd8-9523-43a5-b2aa-6cf8b7ec8589", "value": 9787288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776885068, "uuid": "d55df2f9-c3e7-4760-92b9-be99e57db0d5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885068, "uuid": "77fc7571-70c8-4c82-b84b-cbe176c9c326", "value": "eb57ca3dbad519573d65317a8b35ddfb6921e6cf6d44aafd466f856283e28803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee52d5b-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877139, "uuid": "b647f1c0-d70d-4ce8-b4b7-e90a587c7e30", "comment": "Malware payload (Mirai)", "value": "8b545115c9b219d67bc3e2e2d45bc7c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877139, "uuid": "0ac2ad0b-e797-4c81-bcfe-12d47286707b", "comment": "Malware payload (Mirai)", "value": "ec068220033a4cddef8358039db341a33937a75f59d89453c8a1bee3f5840554", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877139, "uuid": "1403df6f-0aec-4356-97a5-862a20bd520f", "comment": "Malware payload (Mirai)", "value": "c6b39f4ac5b3513416f6b90f5584231a8be348f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877139, "uuid": "fb77d7e3-8ef1-44e1-942e-8ba022c0a375", "comment": "Malware payload (Mirai)", "value": "d7c232882092b9d1be6a92a4a95fe36a43b0aa2655afaf1b3a5f605285685417c42dfc3c7db5bbb68a9883ee5d2bba92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877139, "uuid": "6741b9e8-b049-44b5-9455-bcbd19d8603a", "value": "T1DDA3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877139, "uuid": "2dcbbf11-93eb-44fb-97fb-37b7d2bfbb56", "value": "1536:yk8NZJjWAaUP/cve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBaUnzhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877139, "uuid": "4758ed07-8031-4bdd-b26f-1598f4ffd676", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877139, "uuid": "ef1e86e6-596b-4d57-b8f4-35823b3ef1bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877139, "uuid": "1d8765e5-2be0-4139-ae69-dfe4d571c77c", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cdf444-3e95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894927, "uuid": "bb67451d-c6ed-4ba6-8f20-76d065bebbfe", "comment": "Malware payload", "value": "b76df5dbde6804c69fafe2e1f59042f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894927, "uuid": "1c897f6f-93bc-473d-8412-9ef1a5d0c16d", "comment": "Malware payload", "value": "ec0fae819ad870b0d4bcdc48956f3fe034389395959681d4e5058d9781aa95e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894927, "uuid": "6e34317b-d5fe-44c8-a265-dbad95095d40", "comment": "Malware payload", "value": "8af54009191bac0bee5f69ecf269af3412c030d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894927, "uuid": "e819e7c1-2e57-4be8-aeec-ce28561895f0", "comment": "Malware payload", "value": "bda712209dc9b79c78779caeda81cbbd92332cc410301d9c3437fa12cc704084ce429ffcb00b279391c207cc6cfa3fbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894927, "uuid": "3c7ca615-ebc0-4a7d-b9bc-4954ded8508e", "value": "T1D05608C1E9A1D24AC63D6D31EFE6EFD8E2673E315D885A4AC9C4F33E1CB214580B55A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894927, "uuid": "ad77e6a0-332f-49f0-ac07-31c975f8961f", "value": "49152:9H1oe4TB0Rizjhb4+OAv0pvDEA6PF+85PhnGomkqQHxwt5ET:9H1oe4TOREj3OR8ZPRwjET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894927, "uuid": "f0aaf21b-89b9-40de-9a34-d925e3de2dfc", "value": 6422712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894927, "uuid": "9db3a105-56e9-4ef1-b1e7-e54634fac21f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894927, "uuid": "ce10646e-301e-4033-9a29-59821a05fa1b", "value": "h2rapidreset.s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594a3c8f-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876191, "uuid": "1189767c-eb4e-4676-8a59-0764756d4d04", "comment": "Malware payload (Mirai)", "value": "ac434442e1f0837e003068d15b31b27a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876191, "uuid": "0876ad9b-af4b-4b4c-a158-43b3bb27447f", "comment": "Malware payload (Mirai)", "value": "ee2a12220aa049365a4b8e216327c79e7b6c7da3e11d4d22f5a97e88e2f4bdd2", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876191, "uuid": "0d4d33c8-48fc-4f64-a5e5-b52a3a260962", "comment": "Malware payload (Mirai)", "value": "19e5ab8180560cea51a04c4656e1c50a7dcb647b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876191, "uuid": "b1e81055-802c-4987-a8ed-9a7231e9641a", "comment": "Malware payload (Mirai)", "value": "2759d2b45c3e61a4d2291c801a9f753ddf0653571518a84c2b9b8a3449ad837956e1073d07f0bcea59c01ea52b9647b8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876191, "uuid": "f15f38fd-0e30-4ca4-8fce-58962c215b0f", "value": "T13FE25CA3CD252F28D1A9CAB670709E355763A010918B1FBF1A79C26C9493DDCF5863B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876191, "uuid": "542cf8df-c494-43f9-824c-c7b6edb37b52", "value": "768:j86iKTLy5gaKAEaucCiNi0Wdkfj12NNsap9ZClLSI3:uKTLy5bZUc06cNNs+9ZCxSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876191, "uuid": "d9fb3fa8-bf3e-40b5-817c-9c8d4065b9a6", "value": 32852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876191, "uuid": "ddd694c2-f7b8-4e80-94ee-f1f3b2b6b597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876191, "uuid": "0d46527f-83d7-406b-a4ae-f7eb9481c4c6", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85685b30-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874117, "uuid": "fbb1a2ba-06f4-4242-b531-41cdf32d72f0", "comment": "Malware payload (Mirai)", "value": "5a10f4aef93d485dc8a3b71906471a48", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874117, "uuid": "de8e22ca-91d6-42d1-ad9e-aec16aefbbf1", "comment": "Malware payload (Mirai)", "value": "ee35e97129adbf882d22489c5e1feff97ba3fa2f03d2fa397e08f648c1f6320b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874117, "uuid": "f9c6ecd5-dc84-4a8a-af31-4a0b1445350d", "comment": "Malware payload (Mirai)", "value": "fe8dd5e7dffe7668f570aedfddc3e086ba4e54ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874117, "uuid": "3034b149-af9a-4029-90b2-4a3f7ba6b2f2", "comment": "Malware payload (Mirai)", "value": "d88c28842c654648f0c402ba1be4b1f565870baa899ad627169743ebf300a0f85df1d4d3bc4f14cb0d98177a9631dbf4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874117, "uuid": "1c650035-03fb-4fd1-9194-f68171568eb7", "value": "T1B8912FDE0590EC738DB5DF01336797B090C4CDA738E7EB6CD88C386588A4954B2AEB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874117, "uuid": "d73ee87c-f05f-439b-94f6-fef9be0daae1", "value": "48:R0ZTWe3DxR9TWGesWJ9TKebb9Tdeyi9TuevD9TPeUc9TTeYo9B9TaerD9Txem692:R6SDWjZXAsYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874117, "uuid": "f7c14d4d-78b9-42c5-a06f-7875c8fe9bf8", "value": 4335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874117, "uuid": "f3ce5c25-2d78-45fb-948e-20064131f312", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874117, "uuid": "c824e860-8d29-403f-93af-cab85c31fab9", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fcf8f5-3e51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776865686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865686, "uuid": "6bc0b11c-a822-465f-96a2-af9162f852fa", "comment": "Malware payload", "value": "4db13446e6e57470683a9f07d22b2682", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865686, "uuid": "bb798633-5580-42fd-87f4-de18ce4eaec7", "comment": "Malware payload", "value": "ee6677f5cd3d5d6861dd1ff790a8cf8c6ace9e09808b6212a0321d7b57f398e0", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865686, "uuid": "d290f595-4a7a-4bcc-8945-e6c6b30d65a2", "comment": "Malware payload", "value": "b916ea541ce947338bfa11aa19ee0c015139944d", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865686, "uuid": "5cd4d837-9324-47ac-9146-faeb6679fb64", "comment": "Malware payload", "value": "8931ae11c8c09d14f8ed49d8cf1fa31e5c0fa0c69833a0a4b5ee5812dfeb8eaab1bb01bb411847aded11bb71bec9abb5", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pulse-srvc-com", "colour": "#AF874D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865686, "uuid": "ba5df624-2bfa-4623-a448-e43896fdc765", "value": "T1B04633DA18C897E97D072C30E3DB879836E69E0F09A2A1713468E251B0513E2DF575FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865686, "uuid": "67c7ef0b-d939-4336-b024-628cdee6c642", "value": "98304:FvME6rJ/S55oYOkYjMuTS94ktW2du8mHBZJE7NFedqrEfb:FML9soYOk0q4AkHShFeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776865686, "uuid": "c103af03-6ae0-481b-85e2-ea2ce72ea7e2", "value": 5728114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776865686, "uuid": "71c95645-16be-4345-a63f-aaefc13e1029", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865686, "uuid": "27f67835-e2f3-45c8-8af5-2b3ed8082301", "value": "jpn.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1c2894-3e68-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776875472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875472, "uuid": "5e23e22b-c2a2-4ccf-bb26-06dca72ef852", "comment": "Malware payload", "value": "a8bafdb454162ba3776e551f6b552f8e", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875472, "uuid": "07faa003-67c1-4e3f-afc5-5f9769219e7e", "comment": "Malware payload", "value": "ee8844ffd3879190fb389b0f613cb2dcdcd83375cf0a6994170a648c5ca8c479", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875472, "uuid": "67947874-534a-44bf-8cc0-e92d68e12689", "comment": "Malware payload", "value": "ba349735882fef5e60d8b6f7791d6220bccebcb5", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875472, "uuid": "bf0486c9-8b66-4380-afb9-82d80d750499", "comment": "Malware payload", "value": "4377d84f77045e53914bb856ce5da31c828e0a905151ee5d4dcdc2a446bb720dc445de965859bd3772366bdf2eb8801e", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false }, { "name": "WHQL", "colour": "#5CA41A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875472, "uuid": "8978f88f-2c3f-4e93-8436-f44a3a2b3e1c", "value": "T109A26BD1A228B9C2DD1AD9B043C4C917BC3CB392175099DF42A8E9351E53BD9EB34A8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875472, "uuid": "a77ed0b5-c001-426b-b11e-f55c9599a9d6", "value": "fb7c5ff17455f725aa59f998a0f324ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875472, "uuid": "c736f767-c067-421c-9082-55a300474d95", "value": "384:J4XDmw8oRwh9Rg5UIXwYtbFdNiZFRLscmeR9z2JO:JQn8AAGTBdYL7N9zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875472, "uuid": "bf3cf6d3-0d60-4ea7-a82c-1ee95028b2eb", "value": 22104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875472, "uuid": "416e7a96-c176-4bc8-99b6-b0815b0dc132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875472, "uuid": "8cb69dac-4821-41ea-b232-e7685656b2f2", "value": "devhost.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c4d9f6-3e8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776889908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889908, "uuid": "a855fd44-f934-4b1d-af55-e59c39c7af13", "comment": "Malware payload", "value": "2bf1f1e9092b4a535fa4ae2c9fe5c132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889908, "uuid": "b8923cf0-292e-47d8-a332-82e35fa1b5f5", "comment": "Malware payload", "value": "ee8e43b6be1f405fdddb1d5f035734f154a5e23c5476102786bb2329d1f30ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889908, "uuid": "14963648-72c6-4acb-8cf3-4866b22ad451", "comment": "Malware payload", "value": "7cf1d16e1ec3db833dfb944944d3e4a3e1298d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776889908, "uuid": "21474291-12d9-4a74-af53-a685cd163dc6", "comment": "Malware payload", "value": "0fd8572b6d1c6635f98b4e116a7701da8304371e3a5bfee328d1e60934aa57982053922a5d85643bd09712f767a7c22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889908, "uuid": "07d8085f-7536-4296-a323-b09860cf21bc", "value": "T1B3F523162AA40CFDE9774A7ECA674609DAB1BD4247A1EACF43B546864F13BF05D3E300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889908, "uuid": "2dea5976-08f9-4a90-973a-9e7e9ac7c1cf", "value": "98236a5bb699888899f60e3bbfa36dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889908, "uuid": "937bff4d-d9ef-4316-8883-4f235c3e5d00", "value": "98304:BOXZ6of21SRag8czOGUMx1bO5HwG1t4VeGvXRZXPt1:4y1Swg8czzx1bO5p740gjXV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776889908, "uuid": "e6f09fdb-e2c7-49ce-aa78-34b86d3413e2", "value": 3463641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776889908, "uuid": "ee5e0e5d-905e-499c-af69-5ef2d303d19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776889908, "uuid": "09185a9b-db65-439a-bc4c-c6109a5109e8", "value": "5252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa27360-3e7d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776884434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884434, "uuid": "1d2f3a47-f369-4ea3-825c-a04f02523282", "comment": "Malware payload", "value": "40fe576c7d3b5e31e0c389a35a0b08ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884434, "uuid": "3989ec29-9bb2-4211-b4c5-93f80cfa39c2", "comment": "Malware payload", "value": "eec6a83cbf747d32cffb41bb1d867e3d92c219088d01e0f8512c29c13714145a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884434, "uuid": "6062cbe5-6b95-47ce-a766-d42aabdeee2a", "comment": "Malware payload", "value": "3ecf0e91c40e7ae434b02277746a335ff36dfe1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776884434, "uuid": "db48ab52-18c0-4f79-bf7e-b79b45e32213", "comment": "Malware payload", "value": "d0528f9b014bac15f8c08b5e77060375a804b1d8d4712b5bce0b8570d3b7bdefe8cc876e06664d912a9983f038bc73b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884434, "uuid": "b1e67882-f1ab-4c75-9251-26a960ddd67b", "value": "T18665CF02FF805FABC0AFCD30492EC35711EDD98656C1A62A71FC4B9DBA5D25A0BD3588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884434, "uuid": "973d334b-7c6d-4462-80d4-0d42ada7b9c9", "value": "24576:ZYnr5PrLsOf860KhwVfLeyxFuBW+Znd8Btj6tyyJPJKZqBuKS:ZIrLyrVTyBRZnOjMKNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776884434, "uuid": "9d30f371-e262-4694-8a6d-dbc4bf15d0bd", "value": 1432058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776884434, "uuid": "49ddc317-5389-44be-9598-453337083da6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776884434, "uuid": "3e3903d1-9c06-4203-b809-6acab2137ea9", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9a5ef4-3e6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876652, "uuid": "9cf3bd3b-0eac-4a52-bc8e-b691086b9721", "comment": "Malware payload (Mirai)", "value": "4f7e63fe2e15323878c9411e6c59e2f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876652, "uuid": "8f59ecd5-bed6-40e1-a25b-9db417f04eaa", "comment": "Malware payload (Mirai)", "value": "ef24cde08526521cc32a30608bc7ae641ec9a04a84dd3ffcdf07cf9587cefe50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876652, "uuid": "6ee5f132-8cc0-494d-84ce-240a0c33c138", "comment": "Malware payload (Mirai)", "value": "0d70aadfa47b88d79d6f63b79518fb568f4149a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876652, "uuid": "50f80365-dc3a-43f8-9fbe-e946703f3cf5", "comment": "Malware payload (Mirai)", "value": "5a75ff186653e811213287c4b216727ed3c9469a4f18de4dc3c8fb563cddfaa5320d36e7e8f8e4f79ac58901832b08e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876652, "uuid": "d3716340-c1a4-4352-b633-fe2cb02ed69c", "value": "T110F2F11783D84189F5B5017D1AFA7D5E0700E4AEA0EDC6E2DADC22705EF2F1426396AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876652, "uuid": "f2273e2d-9d36-4b95-934a-3e33134fb1d1", "value": "768:oT7+FNO2hBl4y8k9KINU5IvpzCe3f5KIV14pBCxHL01uLAw3q7nbcuyD7UtQRjt:oTAI6BeybKU5ZNxViB+HL0Yonouy8tyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876652, "uuid": "b349d2a7-f01b-40c1-90f4-59c2376bbb95", "value": 35264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876652, "uuid": "92363c5d-2232-4ba5-992c-c6cc99643fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876652, "uuid": "0fa8efba-a53c-4929-b226-4c5ed45783e8", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa0c1ae-3e5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776871468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871468, "uuid": "8ecc0dcc-b089-4222-818d-23148ddd1b92", "comment": "Malware payload", "value": "5508489a05414dbc28b463fa263aabbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871468, "uuid": "fef9b42b-16e6-48b7-8ebf-ee06bfeaacf7", "comment": "Malware payload", "value": "ef4ed0a1548e268ce2d52a750b5a6900389c273d4aae1e3f6e501aee392654bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871468, "uuid": "4e3857ea-2ce8-411c-97c4-c12c301a418d", "comment": "Malware payload", "value": "827dcbf96ebdeadea4c22d6c60272a914a3cdc4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871468, "uuid": "2b02527a-e83c-4786-815a-4184b8c0fb31", "comment": "Malware payload", "value": "ce2d6dcd8d869cc061f312575ca0a1b587f9357dd7af8ae984096aff61174000871fd6aba55808f6b74f03b6647bd799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871468, "uuid": "7bef77da-8839-4a97-bd28-6eaee56bb7c2", "value": "T13D16129128E6097FC596C7B1C6C928BDF14FBE854D31C857EF4A6D106E32904E832F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871468, "uuid": "694d4613-f8b5-4e24-8206-dae3a63dbcf9", "value": "66e4622a2560a497065719058a0b3263", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871468, "uuid": "66c0d8eb-a6e2-4333-91d6-96534ef9201d", "value": "98304:2T5aEDlkkGbOmcMGBGGtIiChe3YBP21yGTe3yzzZhr7KGii6W2:2mUzAhrO1yGyiphr+XFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776871468, "uuid": "6cd2e75d-c6f1-4dd5-814d-f058786cf420", "value": 4345856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776871468, "uuid": "8450b50d-04ec-4564-aa75-3d3c32144330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871468, "uuid": "4efa1c63-f4e7-4dfa-8cae-4a24cdd35a7c", "value": "Agrm-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9ba7c9-3e9b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897480, "uuid": "08e072fe-54cb-4957-8a7f-18121dc2698f", "comment": "Malware payload", "value": "5b5e0a0d8a078648bb53f34ec0804525", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897480, "uuid": "bea34c03-6eab-42eb-b929-e92d51b7e4b8", "comment": "Malware payload", "value": "ef99738b071ceaf284e4868cb57afc6863f70a96145068000d68f2f519a2e384", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897480, "uuid": "f0c18ea2-7d0f-46f4-8b7b-9238f6f5c32f", "comment": "Malware payload", "value": "d659b541d9af2041b58998a20016ca4c3722ec89", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897480, "uuid": "0775b43b-7e56-45db-a15d-8497641ba7be", "comment": "Malware payload", "value": "5907836797f73cf9fd42471954a402f7054eb8df8dbb4725502b3b1ae7fde486354caa3593a6cd2099fedd94dae24d3c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897480, "uuid": "d4e96127-e92b-41a5-ac05-b7d8c262ac1c", "value": "T13DE4B787F1208AC7F84FDA7F14504210ADB0F4704607F2561B6E886A6FEB9C89F657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897480, "uuid": "70d35bd4-1d2d-4862-a1c5-078b9d9f30f3", "value": "6144:m1eMX5Uh/W94gpr2TUPjhMoQY/Tpnef+8GEXDBQn4DUEDrM4/1Wp3x1Z84N:m9tb8Fnr//1YLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897480, "uuid": "3eb4ed98-14b7-416e-9082-d1183eb8e3c1", "value": 702567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897480, "uuid": "c14c6d66-ed92-4848-8ea6-ea19866ab3aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897480, "uuid": "47032757-e978-49d9-999b-fa2ab8b088ae", "value": "5b5e0a0d8a078648bb53f34ec0804525.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db30a346-3e2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776851068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851068, "uuid": "e8f1d5ac-99b2-4d46-aad7-03081bec0973", "comment": "Malware payload", "value": "d22fffc96dfc4d429ef64e114da92536", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851068, "uuid": "f1dd3e61-b11a-4c44-ae45-12b072efde1a", "comment": "Malware payload", "value": "efa164afd191be86b87b26327c725c2b1cac19cbb6b55fc0223d4d30196ccfb9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851068, "uuid": "401a0d4d-cd77-4aa2-a93b-aeffea1bce9c", "comment": "Malware payload", "value": "87d72bc9fae420b349b101e107a95fcaad338794", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776851068, "uuid": "102058ad-7a5e-4353-9efd-5ed8d289f5c8", "comment": "Malware payload", "value": "5faaf11866a046cc5c3afdbeb9fd8df752cf8edfca2512eabd9ba5752103d3fc430b96a7847d70bdf9bbe57a7a2dc068", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851068, "uuid": "a7155d32-2db3-4525-9ceb-b440d1e1aecb", "value": "T12301C4E9B2297FB6059D9D9B7A274BAD301F614C4D0F06883D59403CC3F07D17A6048E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851068, "uuid": "6fcb65db-a2f8-4b40-8a91-aaa3eb022875", "value": "24:um7XX7mrNXlmlqXXIm99yXummTC2Xqm0xqX/mWNX6mx10Xfn:7X2XXXr8Xm+2XYqXzX8Xfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776851068, "uuid": "b2a7b7b3-58c0-41a0-ac64-dbeb84879e92", "value": 776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776851068, "uuid": "b07d9749-c241-4b4e-9069-2ed38967e931", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776851068, "uuid": "84b4d2e9-da44-4b65-b551-165259bed516", "value": "ftpget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed6180a-3e74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776880414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880414, "uuid": "4039034c-1147-4a4a-b5d4-602cafb64641", "comment": "Malware payload", "value": "03d3d15e517bd06244d15ef67d437a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880414, "uuid": "daedbc80-0ef2-4bdc-a890-8a84acbead33", "comment": "Malware payload", "value": "f055d95dbb698c29019e4be74bdbd6d87f554899c8bc9b935d70c478af8f9592", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880414, "uuid": "d5c57a1c-2b9e-49b3-97d1-b776ae7c5e14", "comment": "Malware payload", "value": "cc01ac50ec91c602b96d480ccfe0afd585197c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776880414, "uuid": "c493d8ff-b28e-47c9-9459-f1c764de1f87", "comment": "Malware payload", "value": "8a657634cf7aa8252c29ca80a62088640f30a281b18ef71a025f19884cff62e499e9b4b67ae0d9ff1eb378e00de8b848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880414, "uuid": "07276b08-5a00-4fd5-ae46-3bd86b3f10f7", "value": "T178268C20B592683FD6730331766DB32AB26C7A750731488B7AED5B1D5BB18C24132F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880414, "uuid": "d2f34c51-409a-40f9-a651-24b8d2549026", "value": "dcfee13027b7530b5176aa92ffa44fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880414, "uuid": "43fcd941-4972-4dad-a25c-96e028ac5ae7", "value": "98304:x98/509XjeTeg4BnbV/VjLpDyA/XrfyfTfKQRbCUe:x9eTuuA/Xrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776880414, "uuid": "2c6aa9bc-bbc8-4af2-84e2-9e22887c36f8", "value": 4559304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776880414, "uuid": "69bc39bb-21ed-4111-9582-f18d9fda41ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776880414, "uuid": "2b77bac4-7bdc-4a84-a0c0-29bb2b815a8d", "value": "KUMP7TWS8H2FDTZ7D6C1PFO8G", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d7d714-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776888555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888555, "uuid": "98d30344-bd25-4299-a7ca-dc1cb08519b0", "comment": "Malware payload", "value": "2946036619108a08079d2721df257269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888555, "uuid": "37339a71-62ec-4e54-b633-28d399d202c5", "comment": "Malware payload", "value": "f07780c6d003d0bea76f133a9e5ba4b612de0cb177358109f4ba87c8c66f305a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888555, "uuid": "a6a34f18-c124-4cf6-8ca7-6e1298643c29", "comment": "Malware payload", "value": "d21d88002ab8a07e23294f836837854ef9487530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888555, "uuid": "1f1dda85-81e8-4004-95bb-ac6bc734f45d", "comment": "Malware payload", "value": "574a4149282a31c4d0d8996a40b80fb62067702f3e8054ff412f9f6f18222207529e026a4e79d00e2f99cfb1a23fdaa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888555, "uuid": "a9faa713-d058-4e95-b46d-294aa9b7fd96", "value": "T14F567C8773A60185C16BD23CCA8BC617D6B3704447628BDB216ACE592F337E26E7E744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888555, "uuid": "c4919b6f-eef2-41ea-ad99-698e43e76754", "value": "3e9ad50c4da66460cdb140e11a29ea41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888555, "uuid": "5e8d9c98-654c-471c-9c0e-f6f0d5e75a39", "value": "98304:RyXoLshbZZAV6ifxLtL2fBTKH3YCQiigL3/3VJwzL:RyXoLshbZZAV6ifxLtL2fEHigLv3VJwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888555, "uuid": "693c0892-4665-4e76-a09b-986aa2baa5dd", "value": 6167552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888555, "uuid": "3679656a-8712-4a55-abd6-1996292a3890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888555, "uuid": "a45b8cb2-9e73-4c16-add4-3a4b8a91e05e", "value": "Qt5Widgets.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92980dfd-3e87-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776888742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888742, "uuid": "4c590912-970d-4358-95be-0e2546f30330", "comment": "Malware payload (Gafgyt)", "value": "e03c6d7a6cf8e395121d9f1dab6aa97d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888742, "uuid": "ee6ab7d7-fb26-4565-8e06-ee26eed17066", "comment": "Malware payload (Gafgyt)", "value": "f09772480c9cdff4f200719e8e582ca47930e13804f947f14d01065fc4150fde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888742, "uuid": "9e33fd76-8cff-4b49-9d9b-3e9d984c5e93", "comment": "Malware payload (Gafgyt)", "value": "758b6c16e05cd78e2cb628dbd907913589c2bafd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776888742, "uuid": "51436283-98b2-4fc0-bc10-196ad6617ad1", "comment": "Malware payload (Gafgyt)", "value": "d940c43e129fec25b9d19946a28f1dfb4eaad82f021f6b742684705b55200c871a2a8cbb5d64c4c0c4e6b9cbc9439613", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888742, "uuid": "1844e809-7fa9-4836-9739-fba19da570f0", "value": "T1E3935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888742, "uuid": "35e619fb-9a86-4dbf-b76a-654d3efeeee7", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK39yPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKNifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776888742, "uuid": "099bba16-7f47-4a4c-87a5-6adce2615f1d", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776888742, "uuid": "644ba449-3530-479e-9a12-f4ad200ad476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776888742, "uuid": "6b9d1fbe-0bd3-4621-8828-5e9007657854", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555a92dc-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876184, "uuid": "5fd2bfbc-a0cd-48b1-bfc4-98fc59a06659", "comment": "Malware payload (Mirai)", "value": "b164aa542e360fb9c5c7da648090a63f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876184, "uuid": "0fcb14ba-0922-4300-a303-73cb5026b910", "comment": "Malware payload (Mirai)", "value": "f0ad98576faf4c79ae557f5c4051796261b56c3031171774f4cf73c792ee8d2a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876184, "uuid": "0dcdfe3a-e8da-440d-9158-87b40fa917b3", "comment": "Malware payload (Mirai)", "value": "92470e2cb8c2aa96682e7e89e8620bef1081e72d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876184, "uuid": "367c3e54-cd52-4478-9005-3d938051bb7e", "comment": "Malware payload (Mirai)", "value": "25da42cced56a318fb229b422c728ebfb337daa20a4aa9369c481300141586258d6f13d886f9e14fa037cea85f40c808", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876184, "uuid": "247c03dc-55b1-43a6-a295-cf10a3c7c021", "value": "T198B2D0BC011654AAEEA9457B41FB53C66C720BD0709AECC95CC76AE2CB914F21076FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876184, "uuid": "bac6c143-e9d3-436d-9f38-600157d6d5b8", "value": "384:6EV2wgKkBeHf+yUs+/M5Xr3Hy8/EBawW8J/djaMgqmTJgGlzDpHOw23a+G:XVnWy0E5XjyOfwfJVjadqmTJgGlzDpuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876184, "uuid": "2ab01abc-ec3e-45e2-8c4c-23d51259f25a", "value": 24092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876184, "uuid": "362f5f08-ba4e-4593-9d7b-75102a64994a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876184, "uuid": "acb06151-fed8-4b47-9dba-a177cb87b8c7", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e297bb-3de9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776820827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820827, "uuid": "6e66fd78-b9f5-4d57-b264-5f48b9403215", "comment": "Malware payload (AgentTesla)", "value": "d0a269cb5c244c8f10ef5e4eba88fce0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820827, "uuid": "a5c9bbc2-ed94-4b76-86f0-8520355a6934", "comment": "Malware payload (AgentTesla)", "value": "f0fcbce9e7f086687180c3da33fea102bd6eab5d7312efe3b4e78f2c000682cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820827, "uuid": "3070788c-7bbe-456e-a829-c2028a9552a5", "comment": "Malware payload (AgentTesla)", "value": "a4f624dce449f177342e7d5fea186c8337b523d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776820827, "uuid": "69a101e8-c3fa-49ec-b51d-2551195ecc63", "comment": "Malware payload (AgentTesla)", "value": "c004187f358fcb4290ddb63285a1caed36b744dc6e02c15d14bca038766466aa2f89acd6e9ed38e1f911306a4e4dff7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820827, "uuid": "23de83b1-efcb-4363-8952-4d488e50fc01", "value": "T11E0412AB4F3FA2359DC54D03E8D2350B891C35564B73140BBA8FB45A7283E6DAE3458E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820827, "uuid": "b4ebd78a-f510-462a-85bf-77cfc79bfe0a", "value": "3072:urdlU6V/JTXXWvR7txESsuL5YJVRIh9ijsYTFsBTHW7z/n75/mkIgI3ClaQYe80t:CdlRVxjWvR7tBBYJVmzYTyBT27z/73+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776820827, "uuid": "549224d7-6add-49e7-9063-c40616de2590", "value": 176285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776820827, "uuid": "9a2668bd-2dfd-48b3-a8f6-06d14a5231cb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776820827, "uuid": "8388be77-2b0a-4cea-aa59-4d6e24fcb9c0", "value": "21042026_1548_21042026_IMG20260421-00215.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d994ec-3e02-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1776831430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776831430, "uuid": "24ea3e56-3c8c-4d4c-b2de-7bda1721098e", "comment": "Malware payload (CoinMiner)", "value": "201483f3cd3802a761fc95b44daf6931", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776831430, "uuid": "faef3189-7c72-45f0-a5f9-5c80346cb14e", "comment": "Malware payload (CoinMiner)", "value": "f11763bc06f64b367517ef79f1bf1d60711d80d3eb38dfb6c2084a75867e2edd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776831430, "uuid": "4268c1aa-28a4-48f0-bb8e-b6d0e086d979", "comment": "Malware payload (CoinMiner)", "value": "ab6c203ad221ff5611789f44e79e62a45c20db15", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776831430, "uuid": "db9ebb4b-2004-4d52-902f-6edcf14414fd", "comment": "Malware payload (CoinMiner)", "value": "2d69e0d7f4a8f161e194039ab499ad0587e838157686def3c2e2b161ebb89d0a0faae204c06f03f8292592b07e42a9da", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776831430, "uuid": "2999d9e9-a11c-4895-affa-b7bfcaefb6d7", "value": "T14D32922C6D4A0331DE6044B8E8754246547D2EE3B393EBEBE673D5CB49D6E4588C092F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776831430, "uuid": "7e05828a-3c6b-4cc6-8c92-15a10bfbb637", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776831430, "uuid": "74d05f94-d4fa-4603-8afc-8a48beae63d8", "value": "192:7d/oOWG1FlfS5BsgQxSHO8rXpM3PpxPFJxTEZmFhqGcy:h/o2FgQsuOSBxPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776831430, "uuid": "640127fc-be0b-44d7-8138-cdfcea2cb7a2", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776831430, "uuid": "46041fb0-8323-4cb9-ae2b-9ecff75ba40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776831430, "uuid": "04d51109-28fe-4e62-9f81-9326658d8722", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931b7484-3e6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776877147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877147, "uuid": "e42f3f14-f8e1-46a6-895e-e0b1990f51e3", "comment": "Malware payload (Mirai)", "value": "92b67e0febefd21d4c9bb1d6daf4671f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877147, "uuid": "596deb4c-0a2e-407f-91d2-98d7c1a268ad", "comment": "Malware payload (Mirai)", "value": "f11e1db44693d03adf5a4a7a58c2f602cac0d764e184ae1a2bf18e5899398ef4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877147, "uuid": "4c5cd92f-0711-4b0b-b577-7b88233905fe", "comment": "Malware payload (Mirai)", "value": "dcc753c7df6cf08bdea52caeff6582db0482c031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776877147, "uuid": "ef4ca5ca-2bb6-4f70-aedd-3e9e09fb8538", "comment": "Malware payload (Mirai)", "value": "a3ae25b59de881ecc7a19297a243f7807ae56ddd480d3ade50dc2f250d022dc872ad51cb0e0c68ded554a1e555a465cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877147, "uuid": "1502968c-877f-4591-ab69-b20aff950543", "value": "T1C4A3F506BB650FF7DC6FCD3706A9070225CCA51B22B83B767674C928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877147, "uuid": "d185605e-724b-4745-8531-7d393c644285", "value": "1536:LvGefaZSdtJP4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdI59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776877147, "uuid": "e08f3d01-2558-4531-b523-ab844fec8353", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776877147, "uuid": "d623d5d1-69d9-467a-a0a1-e9ce17468901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776877147, "uuid": "bd569e53-0fef-4415-a1ca-d56519de9bf2", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c22ba74-3e24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776846211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846211, "uuid": "9d4402b8-bc23-4479-816c-f13dafdf5b90", "comment": "Malware payload", "value": "2ae92350b1273b52e3a0e8e63e30dc80", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846211, "uuid": "3820de0b-6eaf-4b6a-8fde-91275f7d5045", "comment": "Malware payload", "value": "f1555a6142950f493a2d556d225f437dfefceceacd5b5de7c107eccc2ca66dbc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846211, "uuid": "8a521035-9ac1-432e-9aab-4fa013ac1abc", "comment": "Malware payload", "value": "c19f1f07fad68abe4a42c408db57161be14d2161", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846211, "uuid": "893ff5df-7ac2-4f47-a7eb-63aa8317ae05", "comment": "Malware payload", "value": "51b49966c75aceac7c61c07fc1e02bbed15f80a2e6e8337df6202acfa65fe413b15333978b1376d3bfe9eea776a07e93", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846211, "uuid": "2bea0bb1-e919-4a43-a23c-8359700f98ce", "value": "T1B64144CB2122BC36BB4799B6DB9BF3CD305234D3D130A698F08E74526FAD2143685740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846211, "uuid": "31b408b3-3ca1-495e-b3e2-af2d0d3e95c8", "value": "48:DQsHpNYa82C96GNpYMzvmgT1kC/B10Cs/CVbLuH5KS1v75A/wPB13xxaK5nY1p:DHHpND8t4qWi+WWQUB/CxLgKK75Ae3Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776846211, "uuid": "35f43937-cced-48b4-bb92-513e3bd2a024", "value": 2141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776846211, "uuid": "7fc2f54d-819e-4cf0-a748-388252509dd7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846211, "uuid": "5f725d3d-86be-4755-a136-f935f91917b9", "value": "sora.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650a1abd-3e25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776846575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846575, "uuid": "68084ee1-2a8f-419f-b7bc-999b077a88f3", "comment": "Malware payload", "value": "6089bdb3627c5b3d8175f4cf76be46e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846575, "uuid": "dbf05858-3312-4e07-bde6-aab2721a35ad", "comment": "Malware payload", "value": "f1b5e92a8287d67231ddf169b38a16083f96c5e1726d99308d2f32e8ea4ab43f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846575, "uuid": "11693e59-1df3-47bc-95b0-388ca8911d1a", "comment": "Malware payload", "value": "50c531c4c360723058b057643a3586fac79da60f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776846575, "uuid": "62c72920-9b8e-407b-ab74-adf55b7d8554", "comment": "Malware payload", "value": "a2e94503024d2c65bafda30d15cc7cf57d00e16691f11a6007416fa2b5b0916f96b54f23d8fcfa90da02f982c135c992", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846575, "uuid": "df890813-9089-4500-93c9-2a14310a2fb2", "value": "T1A8E633E28E112035C276EBF33A46AD7D137FB67720B87795332DB80AD98A451137D8A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846575, "uuid": "54ad1cfc-fc53-4e79-aaa9-662ac5c4e4e1", "value": "a413ffcb413e398d1f798a0daa527855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846575, "uuid": "f4b12557-ecfd-4c18-a696-bdefe7e1fe8a", "value": "196608:igtptjGKZ+fq0sKYu/PaQrBuN1BbWTQscK2pUZMAbUEO3oDDJf6Wv/VJ8KnWWo39:zpI8QrUN1QgUSAoEO3o3Jx/VJWPw4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776846575, "uuid": "b263a3dc-e48f-409c-ad76-7e0cf5746c6b", "value": 14971924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776846575, "uuid": "1c6410a2-7919-4667-b7ce-b1cb2a0fe078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776846575, "uuid": "1c6cf667-2053-484e-bd9a-92c17bd24ae6", "value": "Isass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3bab4c-3df9-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776827714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827714, "uuid": "2ceed098-bcef-41c7-a73d-e74df1f8a380", "comment": "Malware payload (RustyStealer)", "value": "e57fd9604f9006f2163c49b0b98be667", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827714, "uuid": "bb1c0f98-2960-4eaf-9fb6-a821a95aaf55", "comment": "Malware payload (RustyStealer)", "value": "f1e0bdef360ad4d385fecbb10b3bf5f6bdb6902bbe263ebd9bc5427ca8a2d4ac", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827714, "uuid": "5d8a20fe-daf7-4d87-b4b5-2d24f6ba70b4", "comment": "Malware payload (RustyStealer)", "value": "97eaded23c8b370c565e3816533462a390bfb196", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776827714, "uuid": "a0e812cd-788a-4be7-8733-f3e9e8c9ecd6", "comment": "Malware payload (RustyStealer)", "value": "ca4a6d80067a66b1ffd605745d3a6caf5be6004a54ae258dce825058406e815dad64b783fe6b8ecc86110dc576fe41f2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827714, "uuid": "f0a64d02-f3ad-4f32-8808-aebbd108f82f", "value": "T1E4969D03E39181ECC45AC1748367AB33EA73F8894634B2AB5BD85B212F66F905F0D759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827714, "uuid": "3dbe9ae1-e4e0-46bd-833e-a1338746153e", "value": "be9db20a0a086f6fcf0e952dc3183a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827714, "uuid": "88ec3ad9-c7da-4e8b-8bdb-fa90c850ff23", "value": "98304:aT1fllfu/h3BflpgjHiCmu0Yi8IMfEicdDkArixba+s:GB8ngGC+jjDrig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776827714, "uuid": "bd925f97-56fd-4bbb-a7a8-c957fcaa59dd", "value": 8946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776827714, "uuid": "15e4494d-ed48-4145-8eee-cf259d4c5d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776827714, "uuid": "10e209ff-89b2-4810-becf-9eabb99d1644", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12602bfe-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897546, "uuid": "cc1bb1f6-a665-4164-a9e7-24f664cc7c72", "comment": "Malware payload", "value": "4ca43be203bc5a06b091da3a16e16adb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897546, "uuid": "344515f2-9169-40c5-bdcb-626a335d4eb7", "comment": "Malware payload", "value": "f376dd35be1f91a100b03b5b16274f9cefab08ec303611691c6cc6cd14ca2b98", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897546, "uuid": "14d9777b-5436-4626-a7ce-7e76b19f76b4", "comment": "Malware payload", "value": "63cbd88bcf98219c934f9e55ebd7754d2703aac0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897546, "uuid": "b8250e20-b20c-453b-adf3-55926a4fd956", "comment": "Malware payload", "value": "0cfed44add10acff501ed2dcf9f3dd697f766e2211d7fd5937cf55e0277859a5ccc375673bba282661f80231fe013432", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897546, "uuid": "24472a3e-3144-4b32-b6a5-dc29377f0a0e", "value": "T1FB95332DA8068D8D259F8173243D277FEB9524A9339C40A51E988BE1E851032F7FF767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897546, "uuid": "588d66d4-2baf-4007-be25-921ff4b5e478", "value": "49152:NOR7SnPzDQqStv7LhyPFcgq7jYC3eug7aMzB66Vvf3yzgM:oVYzDxSZLQHq78Ac7bzPVvv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897546, "uuid": "fdae7c70-4516-46de-aed9-663e0ff89acc", "value": 2043629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897546, "uuid": "d5411f33-ef2a-4fd9-82b6-1adf80bb016d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897546, "uuid": "ae2a8a20-ac85-4c49-af0e-b4e5e0317e86", "value": "Example-1.0.0(1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8a047a-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897674, "uuid": "b5192065-73ca-4560-8d2f-78ee4d5959f7", "comment": "Malware payload", "value": "1610945db4dfe9c0d40c977f2bc01974", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897674, "uuid": "c0a44969-76fb-474e-af44-0c2e6a1123bb", "comment": "Malware payload", "value": "f54a99d6a61259ce31e6e585605c165b2b7788879a25781a7c6fd912bec16dcf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897674, "uuid": "0d1ae804-21f7-4a46-81cc-8ac004aa2640", "comment": "Malware payload", "value": "0b94b69eb737ab65d34b464f1901b08b3bb16c5d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897674, "uuid": "13343043-bfd4-4dcc-b994-630493804349", "comment": "Malware payload", "value": "299d1aa3da01596996cd451a8db5e2a501c41975613f72e079a20424cafcf915e34eb6436793f4844b6707dc918f5025", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897674, "uuid": "363bdb85-56b2-4d82-930f-a0b1e986449f", "value": "T1BC5533398E839FB2FDCE097182C004DD50B668CDBA85EE45DDA4B13E1439FB2B916527", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897674, "uuid": "4f16c18f-37c8-4c87-a327-338d9df47703", "value": "24576:SIRYbaxx6g2BufVberUeRl6ePST0dTdPod1h:Sk4gxeIez6uSQFdPod1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897674, "uuid": "9a7455a9-5d75-43aa-95cb-8956ea8fe0fe", "value": 1285509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897674, "uuid": "e4ba95d7-dc47-4250-be83-6d8e5674e6cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897674, "uuid": "71046906-829f-49e4-a925-00b5fa571362", "value": "PrestigeClient-1.21.zip.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcb6968-3e37-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776854539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854539, "uuid": "861667b6-b5af-4f30-bfd1-f397582dade9", "comment": "Malware payload", "value": "bc18326c3450ad3abd9224e136d95fc7", "object_relation": "md5", "Tag": [ { "name": "data", "colour": "#B3C2D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854539, "uuid": "4d06d660-2564-4930-ad00-72f54c066d72", "comment": "Malware payload", "value": "f57c6001a33ce32d91d22cad1ed406ba1601bc6856e82d7ac0676b10935201e6", "object_relation": "sha256", "Tag": [ { "name": "data", "colour": "#B3C2D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854539, "uuid": "cea203b3-0f0d-4680-a3c3-8c783c13223f", "comment": "Malware payload", "value": "f796c1f7825bd571d47426739a4254a7795cd6a5", "object_relation": "sha1", "Tag": [ { "name": "data", "colour": "#B3C2D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776854539, "uuid": "811e76c7-d94c-4470-ba0a-1b4a901c17f2", "comment": "Malware payload", "value": "6b9346aff56e9286c090b483da6024e2294eb1670bbacbd980282b598207c270f901120747b530b887b51b7f59a80a60", "object_relation": "sha3-384", "Tag": [ { "name": "data", "colour": "#B3C2D7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854539, "uuid": "5e2720f9-cc1f-4a13-8bf0-8365d263da36", "value": "T19A034B85F79800F8C1F65336F8756F8697B53036810A070F57B85A6A4E93275ED3A2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854539, "uuid": "0d3ec10a-8ef1-4f6b-9d76-dce9a0aae9f3", "value": "3b2dcf30386c4c5da656dc4849549fac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854539, "uuid": "b5ba05d5-eeb2-4310-aa86-411f9b6559b9", "value": "768:Z5XSPGiRTLB3ATzo4+4QMYokCreEiZnC:Z5iPLWTP+LCrepnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776854539, "uuid": "4c5efa55-4fd0-4d8e-82d1-462bfd7149a2", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776854539, "uuid": "53524c22-8656-4986-aadc-16e24056ccb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776854539, "uuid": "8096bb08-ce2c-4c88-bc86-098167234b92", "value": "data", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e89c19-3e58-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1776868534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868534, "uuid": "a468f456-a169-4103-861b-cf5be9626056", "comment": "Malware payload (RedLineStealer)", "value": "1aa21baefecada61d25cf01cd1eb681b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868534, "uuid": "e6059cc4-bc3b-46b5-8ab6-b20c48164bf3", "comment": "Malware payload (RedLineStealer)", "value": "f64ccc637b29a4000090e960789f88470ef02eca8b1e063e4b5611a7f43b3961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868534, "uuid": "f5e0f40e-6335-4446-9399-377c8285069c", "comment": "Malware payload (RedLineStealer)", "value": "289945eb9260f08c0737be586730fcc00295a142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776868534, "uuid": "f0ec75d4-c876-4f93-b06b-e18580c82071", "comment": "Malware payload (RedLineStealer)", "value": "ff136d66acac5486e709701cb9f1a5544c10a03dc91aa531bbf26cb8419eb0b3e8af2197b36b92d365de33f823b302af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868534, "uuid": "a3d425b2-c68f-4029-be57-96c17527998e", "value": "T1EAC30109FA797822DA7D067CD58BF7C0077162151493E39F3A6462A47EC63E2893A3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868534, "uuid": "ac1fa3fa-f35e-4d1d-ae9b-bd46507f4391", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868534, "uuid": "490d4e36-1d40-47af-ba24-6ce1c30e2cc3", "value": "3072:NoMAz04MlxeX6zthYEHlhxI0wYMwPuAvKX3V2qEJG0:NorzFMlxeqzTBfdM+uAvKX3gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776868534, "uuid": "de008b9f-d0e7-4597-a1fd-6915d1e0e612", "value": 121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776868534, "uuid": "929000ad-3b43-4f6a-9082-0768fe7e0820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776868534, "uuid": "fd7e70e9-9692-40e2-808b-368aa4b9b96a", "value": "1aa21baefecada61d25cf01cd1eb681b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b86292f-3e39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776855256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855256, "uuid": "ea9ea629-cadf-4eeb-a69d-6bed40f5690a", "comment": "Malware payload", "value": "9361aa217d828d9744bb2b5f27eb5726", "object_relation": "md5", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855256, "uuid": "535573ab-6507-4d64-9060-e84b93872ec1", "comment": "Malware payload", "value": "f718df96f7770e29619de136e880bc3dda341ab0fe088de81546ef6396855362", "object_relation": "sha256", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855256, "uuid": "ec083b19-81e0-43d9-98b4-0b18d9607dee", "comment": "Malware payload", "value": "8ea50bd8924caab9e0eec55b4b6938de7d10a556", "object_relation": "sha1", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776855256, "uuid": "d00a48bc-c69d-4b7c-9086-3f7b66cd53e7", "comment": "Malware payload", "value": "8c5b8c61acb5f1700598bb29a778bed1008b83d77ee8db4017fccbaed6013f573df8633da2ef20beae91719193390ff7", "object_relation": "sha3-384", "Tag": [ { "name": "calendar-c2", "colour": "#57EEDA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "solana", "colour": "#8FF38D", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855256, "uuid": "4dc09737-46f5-458e-a2f9-58d022e0cc02", "value": "T11EF4B4486EF721559263B07D9F6FA0067234E40B2909DE087E1C97E05F8963897F6FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855256, "uuid": "8ffb5e60-92bb-44eb-8ac5-f92863261f2f", "value": "12288:UEkjHaYhu/UwoxFBJvtpuL2BBK1AeUhsv6uIFTLCNAuKSdE:IHaYhu/UNxFBNBg1AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776855256, "uuid": "eaf23ada-5706-4bda-8254-04947ba0df97", "value": 773766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776855256, "uuid": "a409c3e2-2aa1-4f5a-bb64-142af5a5f05d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776855256, "uuid": "4aa3f7bd-966d-4f06-99ca-f887b7fa8b86", "value": "251_cal3_win32.dec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba41da5c-3e5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776871629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871629, "uuid": "38f57656-b0c9-41eb-b9f8-200d8cefa349", "comment": "Malware payload", "value": "8c836c57ef5cc7ab010fdf2cddb5aa42", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871629, "uuid": "7f5e5eac-4157-480c-81d6-03fb2f58dd81", "comment": "Malware payload", "value": "f7821b3e53d829fffbb05a31237e2a8a0b1469d1f39b2141ea7317e925e7a703", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871629, "uuid": "d31fcc13-3f78-4c14-aa86-7c86ce021657", "comment": "Malware payload", "value": "a8cd30380bc9ea450e67efed21b19fdbaf6e34fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776871629, "uuid": "d150015b-e759-4a46-b5d2-508e42a8c0dd", "comment": "Malware payload", "value": "c7dad11d90f2d49d9f23bdd2df76903c84e437c2c0721b46c36d3496bd41b55c07ab803d457bbc8c013a34e6c1eebcf1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871629, "uuid": "8d4046e2-77fa-47a3-bab1-1e8842ca7116", "value": "T1D306DF12BDE44177C1AB03309A0AF27935BEAD34072581DB63D86F1D3D34AF2663A667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871629, "uuid": "6b9b5ddc-7d11-44eb-bdff-23770ec3e908", "value": "46c883e8c5604e67e9d7627acbc0ac73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871629, "uuid": "86ab2100-570c-4e0a-bfb7-310b232c7ac8", "value": "98304:/aurJ8skfJCsxvHnTIqE6LCAJ18mFHZPJMXRLZVtpxAV:9OaqE6LpJ18mFHQXRFHAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776871629, "uuid": "d7724e08-034f-4e3a-b97d-cf1d5ba09f60", "value": 3797152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776871629, "uuid": "b923538d-5864-42ec-abac-6a9f0cf5067a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776871629, "uuid": "810d2931-b202-4758-a275-29138fc1aaa2", "value": "PDFCore8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf0a1a7-3e51-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776865676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865676, "uuid": "6facb7c1-85c9-4121-82a4-8fa4721a6e17", "comment": "Malware payload", "value": "244293c68d02fa0ea98c68fd3c07e5ff", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pw-pzp", "colour": "#C87881", "exportable": true, "hide_tag": false }, { "name": "pwn-pzp", "colour": "#FB2C60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865676, "uuid": "586c36bc-b86d-47c8-acb3-f18cbd720bd5", "comment": "Malware payload", "value": "f8463a8d37bb3b28f35faa1c885f7a67a3f72923dd4246ab3bc82bd0bcc63455", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pw-pzp", "colour": "#C87881", "exportable": true, "hide_tag": false }, { "name": "pwn-pzp", "colour": "#FB2C60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865676, "uuid": "d2f76f30-cad5-4ec6-b4c7-a063b2950e56", "comment": "Malware payload", "value": "cf83e9626b11f22346544aff894fbb3f18414913", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pw-pzp", "colour": "#C87881", "exportable": true, "hide_tag": false }, { "name": "pwn-pzp", "colour": "#FB2C60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776865676, "uuid": "c5e80e5c-1e5c-4612-9862-c59fa2b5657f", "comment": "Malware payload", "value": "f0b3d23b3e02317e076e9db9f3d60ffae05e42f79e24169339f7c3e40071ccd483a9d89a885545b14bc731eea718c70e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "lkgkdsjd-com", "colour": "#E41E19", "exportable": true, "hide_tag": false }, { "name": "pw-pzp", "colour": "#C87881", "exportable": true, "hide_tag": false }, { "name": "pwn-pzp", "colour": "#FB2C60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865676, "uuid": "3db645ac-fb4b-4563-b236-b3d6b8646454", "value": "T178063371DBB8EEDBC20690BC81174821699E75DA9FE979400AD7D0F0EFE9E801472C6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865676, "uuid": "33130b0b-0628-4235-8b00-69d5ff41cb5d", "value": "98304:vQdjC2aM4yub3ixmbY63FPczUX1I1yWpE1I8c:8C20V4mbY69cQX1IDO3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776865676, "uuid": "0244b6e3-afb8-429a-a069-e9c89d860af6", "value": 4016625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776865676, "uuid": "7b3e6486-60f5-4b9b-9b3d-d21acd3c7555", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776865676, "uuid": "8e2884f3-b7ea-43c1-ad56-ce753375d89e", "value": "jpn.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6280a0-3e96-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776895119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895119, "uuid": "60f41047-8630-414f-9729-a600b75f9c24", "comment": "Malware payload", "value": "611d7ca66355dac6f2e181e260998657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895119, "uuid": "5254d920-5307-42d4-84bf-7bbcc3761246", "comment": "Malware payload", "value": "f8aff29743026250a219b82ea85388c13ed48c21d31124154ad847f75c03d9dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895119, "uuid": "4908c1f2-e6ae-4fb1-9546-7d309c80ee6d", "comment": "Malware payload", "value": "cfc52210819dc1753a04baac9809ea37909cb353", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776895119, "uuid": "fbbcb7e4-eeda-4d86-a3b2-87853171ae6b", "comment": "Malware payload", "value": "d5a494c1019c0360de65a01a7217af08f42f5c5d0385bc137441a66a1d7650c5ccd39c513001f050b10a50abf379acbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895119, "uuid": "f6276003-5abf-4ea9-9a8a-911cb030da38", "value": "T1F666E909ADC42BF6C06C5B7494EACA5622706D144EF14A2626A4FFEDFC762347F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895119, "uuid": "e0db5886-78a0-436e-a59e-925d62116ecf", "value": "49152:IOPlHWSNW6faUEWXPW+5OWo/KPEKpP973Ri425Ec:9nXPWQPpdlsEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776895119, "uuid": "74a29e53-10e8-4ab3-b6cc-45466b21c40c", "value": 6815959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776895119, "uuid": "11385600-ba5e-4fa5-9cc6-90d671700930", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776895119, "uuid": "aec5642a-e988-48b4-b3ed-73d97079f7ee", "value": "h2rapidreset.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90876f0e-3e6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776876283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876283, "uuid": "226f39fd-46d1-4662-8129-631fd2276c51", "comment": "Malware payload (Mirai)", "value": "e07ad0909fe2bcb73dc980425d242ff8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876283, "uuid": "53f5f6bd-b226-459d-93da-3ec5fc294ae6", "comment": "Malware payload (Mirai)", "value": "f8c2d22875fd69b3ed58599a3e99365f4dfb9709b292857d72d1589648a3fbc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876283, "uuid": "4ddb3584-d1be-4c8e-8348-69de20413203", "comment": "Malware payload (Mirai)", "value": "0a148e41888ac22c8fd12403a6b51fc73d256ebc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776876283, "uuid": "7fc3dc0a-dcb0-4c90-ab2c-19af05a0d612", "comment": "Malware payload (Mirai)", "value": "af7d5d5cbbe0d4a2a51ce65eff006006af63a23618f5ee8572c26ae6a26b45c1f30df46b8831307e97e28980d312974f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876283, "uuid": "4f9c8ee2-0c15-4eab-b9d8-7ae82ecc6afb", "value": "T1A023D65A6A219FEDF628C63047F74B20A36973D213E1D685E29DC6001F7138D586FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876283, "uuid": "de4035a6-fb34-49f1-8717-d05bff75919a", "value": "768:zAC5k5gtJksTWAh0yk8tv6exVduxTnbvqcWVYDCWkIL:55kMJ7iAUexV4bi5VYrkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776876283, "uuid": "2e9a3d5b-ab6a-414a-a4b6-9db22c82ddf7", "value": 48492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776876283, "uuid": "7806f0f6-580e-467c-8340-ad13553c948b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776876283, "uuid": "0cbe84ed-5b81-4ede-a920-1453be7b0d31", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58a8d1f-3e70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776879003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776879003, "uuid": "0611db02-3b1c-4e64-9875-5721948e1f31", "comment": "Malware payload", "value": "21bb815aa1f75525f95bba8132d40230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776879003, "uuid": "ddfb7e86-a29d-480e-8741-d972469b86f5", "comment": "Malware payload", "value": "fa52858cd7c98bf7b306de934d88f0c6f21bca2972229b4d9b5912140bbf0ae4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776879003, "uuid": "431ced6b-d96b-4ec8-b9bf-9bd81b72a1d7", "comment": "Malware payload", "value": "5ea89ad42080a6c4fd9531a1e0b683cd877d86fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776879003, "uuid": "0b8cb6b6-283f-4f3b-ad56-dfff85ca8f46", "comment": "Malware payload", "value": "f7e24c11da450a1a935dcf9bdbdc92421fef2ca12f0da0f222c389d47e2b42546642ba3fd73b065a13c4bb54bcc068d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776879003, "uuid": "67580c88-fdc1-4e89-861b-5760390eb85b", "value": "T155B63358749091F4C3AC07790CAF1B4C5AE97E0A6AA6EDDF478260C22F773D1D136C6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776879003, "uuid": "b19602de-17f9-423c-9dac-a194c261a8cd", "value": "376bea5d16f53eba417d5c5fe3dfcf80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776879003, "uuid": "00e47546-6c28-4103-bf85-c9782d0546af", "value": "196608:tCuc5ICCVlc3GNZIlYkm2QWtgOYjVI0Mh2J6au1mnlfPAsWWyrDZfr/8:tCPcGOZinHFh2J6n1glXAcyPZfr/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776879003, "uuid": "526768b5-de6c-449a-98f6-cf144c4bcca3", "value": 11113848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776879003, "uuid": "8c8a4632-9b51-4d86-be0a-845a8ea1699c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776879003, "uuid": "ed159155-8358-407a-bead-3fde6030924e", "value": "OWX-FIX_2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1087bee3-3e7f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776885088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885088, "uuid": "fd3135f9-e20c-4804-bc25-a81704a5c2be", "comment": "Malware payload (Gafgyt)", "value": "96214fdc347a177464f81c149d995589", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885088, "uuid": "a116aee0-59ea-439c-87f0-31c3d6251bc5", "comment": "Malware payload (Gafgyt)", "value": "fcbac81f67202a120780385249cc77d015b84bb4475f2feea07418b6b45748ea", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885088, "uuid": "4ea383a6-a141-4bb3-b3bd-6cf2da5617e3", "comment": "Malware payload (Gafgyt)", "value": "0b3c6ef78f1370eba4a1bef9112c91648512c7f6", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776885088, "uuid": "c21f2ec3-53b9-425c-bcd5-c5412786977b", "comment": "Malware payload (Gafgyt)", "value": "e8f5211998421ad4e51de5cf8a3400722343b4109b50d0135e61a32d315b9ea5310887f376eaa48e75528ee42d492b92", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885088, "uuid": "c922cd79-40c2-4edd-9dc1-f12ec3bf187c", "value": "T11A04717AB7618EB7D80FCE7305DA4912188C968652E93FABB3B4C528E75784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885088, "uuid": "7263bfd2-2de2-4f84-b8f8-e142bafdd4d1", "value": "3072:aaF7XSy6Cv9RDH5hCs1ZQhmv8uqx1BVnKoe:aICGVFH5hCZhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776885088, "uuid": "6610bc4b-279d-4080-bfa5-a6962c153946", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776885088, "uuid": "e10fd6c0-dad7-49b0-86e9-d67caccbeae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776885088, "uuid": "40fb8342-52c2-4675-b5c4-2f9d2df53ca5", "value": "fcbac81f67202a120780385249cc77d015b84bb4475f2feea07418b6b45748ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd1c2d3-3e65-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776874054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874054, "uuid": "d15cc35d-6f88-4c9d-9feb-9fc8ad8bbe7d", "comment": "Malware payload (Mirai)", "value": "87d029e99b7660fc15a050c392ad1068", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874054, "uuid": "c2b774b9-e98b-480e-b920-8a6b92100127", "comment": "Malware payload (Mirai)", "value": "fd16766c7a55c6f2ca4ead37697d0945fad58a816b405f3b42695990fb8e9554", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874054, "uuid": "1a4a518a-6f84-4f21-9896-a26bed3fe0c8", "comment": "Malware payload (Mirai)", "value": "9a82dabe19c59ce3395798b45ece6c354830caad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776874054, "uuid": "b0525669-9640-4bd5-9e23-cf5e5f5166a1", "comment": "Malware payload (Mirai)", "value": "acbdd9a24fbab61cf9c88e0ee1abe143889d593f136c793f7eac61ef7ba833630dc88810e0819c31cb2d0fe1b0ddad25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874054, "uuid": "69de72e5-4fdc-4af9-8aba-af95d6c099ce", "value": "T125D55B41EC509A53C1E15BBAFA7F828933332BB4D3DB70164D189B706F86B5E0E3A945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874054, "uuid": "619fa92f-772b-4e12-a574-b27e36398b86", "value": "49152:0qYfxPp8Y5ZUdes34lSguvSZWvPlaAleeyqKya82xyPgAKR03:0qYBj2db3ZaZWlaAlryqKya82QPFKR03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776874054, "uuid": "497154c5-1271-481d-860f-cb02b9f1340f", "value": 3017609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776874054, "uuid": "6181439b-dcf4-4587-9684-e8189df6ae54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776874054, "uuid": "41f70c62-038a-4cc4-a8d7-b1aaf5fecf3e", "value": "ciubuc_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc46401f-3e95-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776894932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894932, "uuid": "eff1dcd4-c02c-4772-9b56-62ff355b1e77", "comment": "Malware payload", "value": "4c08d4311f674e4c13181f8cdbaa79c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894932, "uuid": "40c05321-80de-490b-81b6-cc061e5cd90e", "comment": "Malware payload", "value": "fde03bc5fa8e02322aec1950b3928b5f5c80747147f00dde3eee8ae72ea97613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894932, "uuid": "ef218b15-a020-436a-b5fa-10ab8d30a0b3", "comment": "Malware payload", "value": "0c4fe2b5c28c5f78ea731c536d7374ccf095d448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776894932, "uuid": "350b099c-3edf-4b20-a9de-11de9a793ef5", "comment": "Malware payload", "value": "342c4dad9dc4f3447ad4e5e9d7988dea0b0094760188116735f3605745ea280de4c0f2f8cd5c2da30df12e1da5c5f1e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894932, "uuid": "aae027eb-bef1-419c-8d6f-a5b67b3375c7", "value": "T1EB562787B8D24942C4E43677B9BE80C433635EBA9B8752566D05FE383EBE5D90E35308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894932, "uuid": "4fd2aed7-2924-47df-8ba4-ad9cadf97317", "value": "49152:0b/uDU7IBridiNjl4ID3ncLSrG1ocbZIrD0DJbOdC9c5Ej:0b/dIBridiNB4BVerDIOQ9OEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776894932, "uuid": "340162d4-4912-4c91-8b76-c6a93380b293", "value": 6029496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776894932, "uuid": "1becd0b9-a39f-4242-a70e-9d567bbd7a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776894932, "uuid": "4bbabcdc-12ba-4708-a75e-3b929e5f00a2", "value": "h2rapidreset.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd259a9-3e9c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776897596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897596, "uuid": "ae3df2cf-a687-4778-be9d-c72bab2043fd", "comment": "Malware payload", "value": "faf7c04f43c0e75f67aaadf26d748f2d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897596, "uuid": "8572924a-9254-42ea-a8c6-7bea5862746c", "comment": "Malware payload", "value": "fe46793649213ec2db2e42710b6d796bf1fa31e70c21885ad8100bd811256947", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897596, "uuid": "49f56721-bc86-4193-b629-960cdc609f90", "comment": "Malware payload", "value": "bd37450deeedce4862210984e1cee866aac5cfa8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776897596, "uuid": "754b2dd1-11b1-4be9-8de7-2190231bf4c5", "comment": "Malware payload", "value": "19c08a81384e72fbe9f7ce8301b1f266de49521fdcdd6a2e271eddec4a637d06ea2533a5a5d61a9e9448a8dbb26dd26d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897596, "uuid": "cb899564-f57d-4de6-ab5e-66a06d127fbc", "value": "T187B2C051BB231F35D067573A48CAA882E93F42C4A1937757A4C84F9EC907FDEB718921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897596, "uuid": "1eaee0f6-fa68-42a5-bac5-10d230a96e2a", "value": "768:e9n7HGq/RwRIt8FSNnlIjFJD2zgVW2xPywMp:MmMzFxSjFd2yxPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776897596, "uuid": "6ac3a7e8-ab9e-4853-a6ca-7358634cbad4", "value": 25568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776897596, "uuid": "baf435c7-d3f3-4a8c-b8fb-a2af418b42f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776897596, "uuid": "8fa334e2-27df-4986-8be9-649283597275", "value": "kryptonclient-1.2.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b0e07c-3e67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776875029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875029, "uuid": "d0c23cc9-66e5-4a0e-b75b-07ae85fb1109", "comment": "Malware payload (Mirai)", "value": "a9cae0f2350f48350ace1528f3a5be84", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875029, "uuid": "93e8dcb9-475a-42ff-99c5-9373fcb13dbe", "comment": "Malware payload (Mirai)", "value": "fe818d1efd3547dd679c67eee784b57565484823ffa4a07a66c9719268a6dc48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875029, "uuid": "c052cff5-a499-484c-80a4-00bd5f2f017b", "comment": "Malware payload (Mirai)", "value": "7b9cc94b66acc4f967ba0f2ea5a2333e40585d9f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776875029, "uuid": "1aa32c0a-a89c-4929-aa6e-cff273e07dff", "comment": "Malware payload (Mirai)", "value": "04144d8d6e435975f9e4cca8a4d7c57495cd8452f4d0369b5f5204cef0ba4c2caf641703edcc9d82d4b9635e2b099cfc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875029, "uuid": "41c29a1f-82fe-44e0-9c09-52dfabe976c9", "value": "T1D331038F60F4604BC5DECE0070E58DC8E305999DE1DA2A3ADCC1AE67CCC9D547499BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875029, "uuid": "9b056f4b-ecd4-4673-a70c-9c0a91f96ea2", "value": "48:s6+6y6w6i6/6Dq6o6U1l6X6c56j6ra6k6q6w6C6D6e6E6Wo78616Dq626W6D6K65:pbPtfiDX1U1IKcM2TxXt/W7RWw4rjDWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776875029, "uuid": "ed696cd1-813b-4134-a83c-032931aec816", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776875029, "uuid": "64e14645-10ec-4b03-b9a6-4303c797defe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776875029, "uuid": "3c848e16-1bee-4111-bd04-938ca4cc9f1f", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d69e5e-3e12-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776838577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838577, "uuid": "91165c18-4b40-4c16-8e34-3e767013a3ba", "comment": "Malware payload", "value": "44eb2eb327e8cf1ec9c6feb01d343e8b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838577, "uuid": "b14157ea-efcb-4241-8698-6600f3f1e8ec", "comment": "Malware payload", "value": "fffca7e05ea91af1c38690f07f2e5a3a21c62ecb04e5ba80fff36e9bf8124271", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838577, "uuid": "8634c0fd-03fb-4d19-bd8a-bbe392a5030b", "comment": "Malware payload", "value": "81801dfb78baea9389f4216f2f2df311a9c922b8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776838577, "uuid": "aba301fa-9abd-4159-bebb-aa6267c363f1", "comment": "Malware payload", "value": "745be23c1b364429e94bf2b1c7305c674ccf396b5f7e4fce155c7ea638fe3bb7f6904c3172927ac3947f21d6a2561da3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838577, "uuid": "aba60358-6fcd-44ec-9cda-1246eef0c505", "value": "T12E137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49ADCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838577, "uuid": "6396b5b2-1588-487f-98f0-b670b93c3ba9", "value": "768:b3+D9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b3+Ecy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776838577, "uuid": "d5e9da04-4d35-403f-9f8c-b5af658ab6cb", "value": 45535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776838577, "uuid": "a8002ef3-0c02-4ad6-97d3-a778565370ab", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776838577, "uuid": "f56b6f61-49cb-42b8-96c5-36b6db61c803", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }