{ "Event": { "published": true, "date": "2025-10-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-10-26", "timestamp": 1761523381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fa76edeb-4c8d-4968-a43b-f79d9826fb28", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c99f665-b257-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761474739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761474739, "uuid": "b7b6b874-8744-48e3-8392-e207981b4a12", "comment": "Malware payload (Mirai)", "value": "3529c05d2ff22ec041ed1f371418576f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761474739, "uuid": "4764363d-456b-4ad4-b19a-1bc7c45a0e9d", "comment": "Malware payload (Mirai)", "value": "0329f60867ee24b046166e08496e38d80bf3c2941c1830049887ee2253e74b1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761474739, "uuid": "ab41c627-bc1d-488c-b4b3-16f5e7409235", "comment": "Malware payload (Mirai)", "value": "3bd23952fabd41bb782754003340d9539ee31c54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761474739, "uuid": "a4b2c452-853c-437f-8921-ec9ffb7a6030", "comment": "Malware payload (Mirai)", "value": "d58fd97d3f054a83fd53b6992ef7ee2fc4976485944731d385dba0d5c94e5a72c15898b3eb846de67d510504b26fa64b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761474739, "uuid": "75221252-ea4d-4e3a-8cdb-ac43a48cd76e", "value": "T112230981F947C4FAD8870D7104F6F2BF973298AD5026C76AEF48A936D52332052597CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761474739, "uuid": "e951f52c-f344-4880-be9e-135a400c691c", "value": "768:7u+CoQ87+SAQY1+xotk+J9DQ+Cx2N+mZp0dLt9AjjcWW8Tbh0H0/KlFNAkoWqQKO:S+CoQK+SAQg+xotk+J9DQ+Cx2N+mZp0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761474739, "uuid": "d75d6226-db85-431e-be01-09eda95a57a1", "value": 46192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761474739, "uuid": "3d221b7b-fc37-46c5-ac3c-2824dcf1981d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761474739, "uuid": "20bc99d5-d108-45c5-a392-d9f7f0b6b4e2", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328f8519-b252-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761472655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472655, "uuid": "71e58f68-cfa2-489b-b7d4-5965193e98a2", "comment": "Malware payload", "value": "13fabc8c14e6b0c90c671d988ac34c7d", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472655, "uuid": "1769780f-7c1e-437e-b4c7-2d7020dbe513", "comment": "Malware payload", "value": "03b12d76366947a8fa141d29a1e73c708d3ab6a3ebca7ebbff026ed0722c621c", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472655, "uuid": "e6bd0a45-fa0f-46ea-87f9-d590b34d2436", "comment": "Malware payload", "value": "fd8422a551b3fa92cd170f7e9adec90673d1f83f", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472655, "uuid": "3117b76a-fff6-426e-8bf2-ec630fd8164b", "comment": "Malware payload", "value": "7f51353ad3dd72b80ebdd4c0747b5905127afc53bd15765151a959de439f9f47bc26f78deb093174f1322442aed864cb", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472655, "uuid": "43b9f8c7-2b39-47e8-8fc7-dfa942ccdb75", "value": "T10CD73317E39340ECC52BC17047979772B870BC681134BEAF2264EB353F66EA0576E629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472655, "uuid": "d3295720-a40e-42eb-9a53-3384e6d55114", "value": "d49615a3eb128e46d517908fa72917e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472655, "uuid": "d8347c02-0b28-447a-9690-632e4c7997d6", "value": "786432:3TlccKwV3NuQW+v7l/WB7XD1CePa4WxMyCN/yONi36ZTmisK5RuEzbIRBlIcaXEk:3TlccVV9Nv5uBQayS+6ZNsktqaXEZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761472655, "uuid": "e3fcdba3-88af-4a43-89a5-880bee03d58f", "value": 62414615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761472655, "uuid": "cff404ea-ee98-4d8a-95c8-093077e9ffb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472655, "uuid": "7b1940d5-0c50-4405-98b7-b17f8b0bf105", "value": "ldmnq-9.2,6-windows-x64-installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e2af7f-b2bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761519768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519768, "uuid": "c99e8c19-629b-4394-b0e9-f11befb4c440", "comment": "Malware payload (Mirai)", "value": "5870054e53c30450f198c2c7e8def664", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519768, "uuid": "ce60405c-c883-4f83-964d-50a64f6ed6e0", "comment": "Malware payload (Mirai)", "value": "04057a7be46e60ef83db18d0362ba373725c0d3ff14c00905353be2604185cd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519768, "uuid": "19397131-1a96-4a93-9c7c-5e18a1ce1f29", "comment": "Malware payload (Mirai)", "value": "8a524cbc926d548ef46cecb36dd19f79439033ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519768, "uuid": "21e361d6-f2a4-4058-a466-c38889f3d400", "comment": "Malware payload (Mirai)", "value": "cb834e22036f81ead9717c42014aafbbb60517a81c9a4395595efe89086ba57b8c397837af42ae2b0552f8b51cc8f584", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519768, "uuid": "869b6e2e-f534-4667-9539-3d3c6e50cb15", "value": "T152B3D64E7F329F7CFBA8C23447B35A21A65923D227E1DA85D19CD6011E7024E681FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519768, "uuid": "5544ea68-9e6f-4ea1-8361-3d9499ad1350", "value": "1536:hkUl7xt4FyhmfqtOh5EC5f3CFXFq1vEnSCy7AfUmPvePBd3ZPdZ:3l7xlwC6EC5vCFXFqhEnSCy7eUw4ZPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761519768, "uuid": "7fe7d5ba-f4dd-4562-9c8e-85323e01a130", "value": 109760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761519768, "uuid": "f2a1d237-fa54-4ab6-ae54-f662bfbd816f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519768, "uuid": "2cc898ca-3d21-4574-8101-9e4d0a05f399", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb066f7-b28d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761498279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498279, "uuid": "2c5fb2db-323f-4fc0-b3a1-a2a8933c6a1e", "comment": "Malware payload (Mirai)", "value": "2989a71c255f907852668bb81edf1680", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498279, "uuid": "c6c32722-355f-44d2-9794-e84f0cc18624", "comment": "Malware payload (Mirai)", "value": "04382be05fdb76807fabb5cd35d8d077648921e00f80ec73c9a96840fed11b3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498279, "uuid": "8b978c23-b98c-400a-aa9d-60bd1241397c", "comment": "Malware payload (Mirai)", "value": "2cb6cf9fc99a3eab4c68b68e71f358a6ed7e5ba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498279, "uuid": "4ecd7e21-f8a1-486e-8202-9df2c009c27e", "comment": "Malware payload (Mirai)", "value": "6327d7ccd784dedf0ea118041ad665fa0494cda9d94ce9f66f05151c952849453e28e61666c03e8b5e5c493bd5e7758f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498279, "uuid": "7aad0312-c2ab-4b08-867a-f072e4bb4566", "value": "T1C8147020FA0663B1CC721A34A7992E1A6E7B14559FEB26312D1F533CDE628509F31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498279, "uuid": "763730e2-a915-4da6-bbbf-f66b7603d193", "value": "3072:5RtVC4KQd56nLhKYRUdcRwnKH1NCO/mkqJ1Ucn:58XL8yRVUOwEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761498279, "uuid": "375d1bd3-d6d8-4fa5-8dcf-1283dee3f34e", "value": 193268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761498279, "uuid": "45eeaa7e-1bd1-4867-888d-4f670302eee8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498279, "uuid": "2ab7efba-8336-4550-9fe4-e5c20ef988cd", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1c5131-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761497585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497585, "uuid": "42a71f89-62df-492b-bfdb-f925aa7aa9b3", "comment": "Malware payload (AsyncRAT)", "value": "385332f8a101c09222fe0dafa027c470", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497585, "uuid": "cbeb4fb2-ceef-4487-a11c-52f250bf580f", "comment": "Malware payload (AsyncRAT)", "value": "0490fa93788099c6fb744a34706339072e2e511c3495818f5ec03380ed00c9e1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497585, "uuid": "3df34211-0913-4f84-b5c1-609dd08ba96f", "comment": "Malware payload (AsyncRAT)", "value": "c886d6bf3f5811954d1eb9dc32584c18f10ee98c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497585, "uuid": "55d1e1fe-ea0e-4fe5-8503-0c3aac355980", "comment": "Malware payload (AsyncRAT)", "value": "011f4925de7b2cc2e50c671395e0429fe644a8e3fb44e5b0b170128e63fd80ca7b3298cabd886b2c4051d8e21b72b8af", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497585, "uuid": "e9dd8543-d6d2-4fd6-9af0-9f929665d4c4", "value": "T1E716331961891195C27A22C56F8D46C2F92CA17EBDC13C0DBD1601D8AF382F79F9BEE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497585, "uuid": "4ccabd9d-1bed-422a-b999-0ea3b02c0fc5", "value": "768:kDNXa/tGA7WR4xl3oZKx1ppHuXd+y9v2ruWWMf6rZRmPfTWpe/n2mqDbqqD3c0wb:itauREfs+ywOErWpkgbqqDshb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497585, "uuid": "554f96ed-c33f-49be-86c8-d17a9300a439", "value": 4151020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497585, "uuid": "0f16514c-5bdd-4ce4-b904-d03e3553bbf7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497585, "uuid": "80f9109c-3087-4ed5-87e3-f8806fbbf972", "value": "Description.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af06256-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1761497607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497607, "uuid": "8b0101e4-8103-409f-a644-2a9af0872d29", "comment": "Malware payload (DonutLoader)", "value": "5231801f4034892f033e14bac4d83b3f", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497607, "uuid": "c5e14c91-dff1-439e-a6a0-b2c94582eae7", "comment": "Malware payload (DonutLoader)", "value": "04bc05d04322f77feb0b6f3cc8050f0c7a1c71b952d12d450cba5f8a11391c9e", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497607, "uuid": "6305b3cb-a4e3-44ff-81f3-a0193fa64352", "comment": "Malware payload (DonutLoader)", "value": "3fc3919807df37f35b7d279d33363cfd9552e9f6", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497607, "uuid": "a8103156-2e04-407b-a145-340d1ad346e2", "comment": "Malware payload (DonutLoader)", "value": "75082675bf0ab2be3a53bf1b56e939c9f0f9fdd141d75d98f5a7c6deb919dba199623fc96be408b0048aea118a8e0302", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497607, "uuid": "a6b20ded-65bc-475f-8705-b643736852ac", "value": "T1AA86D6006BB0249DD2D7CE26EB1E65D0EC0A2D6F38454C0BB12DBDAA75A715EFB74930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497607, "uuid": "eaa263c9-6457-45bc-982c-605896349d46", "value": "98304:wfslB7H8STyjRT5Hu2cumNILtBBpK8iIPmqjocXQdMsmvk:tllHkjN5HNffK8ilqbX1smvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497607, "uuid": "76245a28-0fbc-49fb-b835-ffd526ad8256", "value": 8066666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497607, "uuid": "c9da53af-8467-4e6b-8e37-647404745c5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497607, "uuid": "55bc4723-5634-43ad-8043-7d459c0187fd", "value": "RFQ Tethis Engine.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c01d44-b27e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761491793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491793, "uuid": "7ebab97b-f07e-4a01-aee8-c029fc737c1a", "comment": "Malware payload (Mirai)", "value": "e0aff6d30d60d168fc32af33ad3be55d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491793, "uuid": "66627c26-7652-4904-9b82-b2dd1a19d423", "comment": "Malware payload (Mirai)", "value": "053129da488a004e4b92c16d182a2b967368097eefa5ee1e406ac06af26cfbe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491793, "uuid": "4230d994-c868-4012-b721-01224d90dc17", "comment": "Malware payload (Mirai)", "value": "792998d6236cb7957a81f749c04d746dd389f25f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491793, "uuid": "903c8bad-640a-4b96-af6b-2888fa7a8110", "comment": "Malware payload (Mirai)", "value": "99577681f165c1a6a968f3fb2bb18559b84cc6447abf55593354c33eabb1bd62b04a46fe22e2338c7d0ee413add3321b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491793, "uuid": "a31f418b-82e0-42d6-97a6-fd1136c3cd8d", "value": "T13EE2D040F8842E02F93FAEC1BDF5E4E1036C3ECDA9D3CDDA2595AF21A5068556F848E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491793, "uuid": "bbd9aac7-afc7-4e85-8716-ddfb7f4cb563", "value": "768:RAQu+i/ASAT13RY5HRXUV66HvSisI4TiWkmgRv4uVcqgw09w58LsR4/lt6mgsh:mQuxwLY5H8HaiITiWkmgRv4u+qgw09ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761491793, "uuid": "ca039534-914a-4e58-b04a-5e58eafad63e", "value": 34076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761491793, "uuid": "8f0b7274-33fd-48e9-b518-43306578bdf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491793, "uuid": "03ff2192-b328-4e4d-a285-7bbccb5d7c55", "value": "dlr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db580a0b-b293-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761500855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500855, "uuid": "cc321b75-a983-4546-809d-4f326d60d131", "comment": "Malware payload (Mirai)", "value": "14443e35a5a0ccfec570eefb8f088d1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500855, "uuid": "028aaef7-279b-46c9-b704-adca99e35efc", "comment": "Malware payload (Mirai)", "value": "0555e8b77cd196c440fb51bb6cb815da42def1764ec32f68b710fdac4ee3cf4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500855, "uuid": "7e91e772-02f6-42b2-bd9a-3dba50e2c9b3", "comment": "Malware payload (Mirai)", "value": "bfb0f24c470745d19c4c31ecb9486fafaa8c013f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500855, "uuid": "e75c01ba-6eb9-49c2-aaec-435c8d0390bd", "comment": "Malware payload (Mirai)", "value": "e683f8e9eaf085f1762d6f11cbadc011aea5f5ec1382bffcad92724d4ca2b3671637fb6b4d14d414f0daa7366560468b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500855, "uuid": "42cf4762-d167-4aed-b848-117d5d7da251", "value": "T10A043A57EB405B13C4D22BBAB69B424133239B64D3EB73054928AFB43F867AE0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500855, "uuid": "743b1504-2fd0-407d-8fa6-24a496d66929", "value": "3072:ZkUiJMpnb5dVua0W60Wau2vDeR/g/x1U1JncWEM/9WI0CH:Ziqn9ua0W60WR2vD+g51iJnc9M/9WI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761500855, "uuid": "f7a48012-a59a-4c26-a547-7d9bbf03d8a4", "value": 177583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761500855, "uuid": "edda4c1d-8920-4713-8a10-e76617118141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500855, "uuid": "d2d28da3-75dd-42f9-8a15-e5c0397ce25a", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd9aa03-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497507, "uuid": "e223e696-23ee-449c-a9b5-8e1306bd2ccb", "comment": "Malware payload", "value": "86d6fc1cd0bbff26e470bbeba3694783", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497507, "uuid": "76c658d2-3d52-43c3-a63d-262240d84808", "comment": "Malware payload", "value": "05a09212fa29cf5a3140113c5d7cb33272159620d37c16a59a4c53f7f37d3cd6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497507, "uuid": "c6fd8420-f770-425d-8a64-2fa9742fa9be", "comment": "Malware payload", "value": "4724332cd245c5bf70e5453c529b975df653ef30", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497507, "uuid": "55b2fbb5-0f75-43dd-af24-7f1e248397f3", "comment": "Malware payload", "value": "b75a043b068f1af8fc6a864a05c3d9c16aa8793593ab73a52c6c424cbc521e63774851f4ba1f5f5500d437424e737bdf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497507, "uuid": "1f572e2f-0628-4181-99bd-dda49d1c1882", "value": "T170233A206BE64204F4B74E3DA9777611887A7974DF3BC34C1086DB5DD532854C069F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497507, "uuid": "02fbbc64-c543-4024-909a-a66ba3d28fea", "value": "24:8d/inxjFfGuiH42vAAvyxWaUuYnukGOUbd9u:8lMpf842vPxrn4Hd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497507, "uuid": "4dbc2299-edf6-4dd5-9474-956fbe7f2196", "value": 48994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497507, "uuid": "3ad8e48c-2fd5-4f50-8fdc-32f6a4d2405e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497507, "uuid": "3d27b8f5-9946-4c87-8e51-3f095be5691d", "value": "Dodatok_do_zapitu.xlsx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6702028d-b24e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761471025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761471025, "uuid": "53336fe7-5441-40db-b8cf-978757dd002d", "comment": "Malware payload (Mirai)", "value": "3a0e57bb9abf87fa8eedcfcdc8e0c952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761471025, "uuid": "b0bff68e-dfb1-4375-9cc6-55be1d0855b0", "comment": "Malware payload (Mirai)", "value": "05e181d3896fcabce938c451b9115499a4c9bafbb6fcc9f855801f763b3cc32f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761471025, "uuid": "f1e1acde-2ed9-468d-ada1-b8f98819aaf0", "comment": "Malware payload (Mirai)", "value": "700af4d82e226d324ceee212c5168395c9af5d35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761471025, "uuid": "7c1bd877-ebad-4889-bf5d-5e6a813007b8", "comment": "Malware payload (Mirai)", "value": "23ec1235e3a344befcd46d6e468f02e10b6cdfd5cb11525448bdc9dfa2ce296d837c3e790ee73af5ea20d4c8c3577de5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761471025, "uuid": "3988a97c-91ac-4dff-b389-5cbb8e738ce2", "value": "T1B8043A2277760A27C0D4A57671F75733F6BA47CA14A8C61B7EA10D8C6FA45903223BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761471025, "uuid": "560df9c5-4ca6-48c4-aabc-35dd8c96bbb7", "value": "1536:kYeAQUL/TqzLPNe76W+nyJn9YDLMVhKU6HtPuC8niWGwdNhLLBz/gCFYt7aeRVzN:VLkE+nUYsQ9pSGCt/Ia4VHlrqhh1eKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761471025, "uuid": "5c10d87b-26a9-4452-8fa3-a6be489416eb", "value": 175368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761471025, "uuid": "c3830b99-903c-405a-be91-ff30d71cb584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761471025, "uuid": "80d20407-97a4-4079-84c9-c12a8726af5c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1911f58-b2c1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761520542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520542, "uuid": "13dddcdf-3580-4da2-b0db-22d3142674ee", "comment": "Malware payload (Mirai)", "value": "9e9350e1cea75020018a760cc9c79920", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520542, "uuid": "28e11eab-78ef-43ee-8d5c-0ebe1405d686", "comment": "Malware payload (Mirai)", "value": "06d3ab83348b2564fb79a24d47cd790d251b07a1378285493102fd03382f481e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520542, "uuid": "d5392f5c-ecd7-455f-b3fb-01f8bdb7af16", "comment": "Malware payload (Mirai)", "value": "73a1de87617cd3b254b0154f8971d9665232a4bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520542, "uuid": "8cd230f7-defb-4a66-afee-fee94232ce32", "comment": "Malware payload (Mirai)", "value": "ebf8cd4991a95886d257c0ec17aa9ca33eac580a5bb8095e57230d64870c73495b8fdb5ffde67fe0f44e354e7e5eed07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520542, "uuid": "218413ad-1a0b-4ca4-8be5-c0301001af15", "value": "T17F03F1B4DB1A1607EB7AA234E8D7F3196AECCF1EA741D7C320468B519D20B257608DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520542, "uuid": "fc7f9f55-b7ed-4605-b002-a43dd6a4d86b", "value": "768:Arxm+q/FNfq6AJFl7vWRii7FwUUF4uVcqgw098M:AxqdNiliiIwUUF4u+qgw098M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761520542, "uuid": "9dacb6c1-6c60-42e0-9bbe-9ff2c3c46225", "value": 38156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761520542, "uuid": "d200e99b-71a9-45fd-83c8-5e6dabd52f13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520542, "uuid": "9a557425-24dc-4a49-99a7-2fa0d2e79f37", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ab8865-b282-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761493551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493551, "uuid": "2e004657-4e70-4cb3-9f6b-cda6241ecf7a", "comment": "Malware payload (Mirai)", "value": "592123088fa210ef56f6872a04613dda", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493551, "uuid": "f5e8c250-717e-4e3d-a695-e68a14e32721", "comment": "Malware payload (Mirai)", "value": "0706cc3e9ebedc0accea81ceca78c6cd10b908425312169d68c24db43e1a3ce3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493551, "uuid": "e83bfc9d-c336-44a9-91d5-2716801cf7f6", "comment": "Malware payload (Mirai)", "value": "b635d9ecc89186253fb452d3e15b1399b1b5da04", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493551, "uuid": "a443fae7-bfc5-43e6-891e-28c97ba53e35", "comment": "Malware payload (Mirai)", "value": "dc041632fc13dbe13f1040032676798084ff02b5cdfcc788bea8660082f70b22cf50f13c8118aaac92294e1a8f4da978", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493551, "uuid": "8cc8ab2a-25bd-4745-928e-ed82994eed2e", "value": "T1F0F0129B8C52270B08D8FD8571638818503AE2CF7CF69BCFFDDC64A9D1985147126F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493551, "uuid": "3b4ec59c-3199-45cd-babc-b195ce190f8e", "value": "6:tfLwVIjZEazGgyx0FZE1o+jZE8NNIYesaZEUabLK+ovSZE9NZdxhXZEGJN1G:tzwcLYlVNIYJUGvK+okmXhpDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761493551, "uuid": "cc0de7fa-0f7e-44f1-a81b-18d0a5b87b2e", "value": 504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761493551, "uuid": "7e6e94fb-454b-4aa2-8b87-63253fb519c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493551, "uuid": "312c5207-2b13-4cb4-a208-7a7cacd48d9a", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b9eafa-b293-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761500629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500629, "uuid": "ff161eb0-37d4-4e2b-97a0-0d6ee8684e2a", "comment": "Malware payload (Mirai)", "value": "d59f4e515c9adeeb4fc72334e92568ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500629, "uuid": "5e9e3c71-703b-47cc-a916-0a608dc6387e", "comment": "Malware payload (Mirai)", "value": "074c628f18145b1bfd1178ef0dd6e1999fec2c6f8bfc6aff9167fa3728d59409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500629, "uuid": "66ac3981-249f-4125-83e0-3c6f42cbd894", "comment": "Malware payload (Mirai)", "value": "cb2f96faa09aa9c9875c5130acd35c922b620282", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500629, "uuid": "abfe891a-372b-4be8-9106-0a13aca1bfc0", "comment": "Malware payload (Mirai)", "value": "c5615a37e4cdb79fbca4dcedf8d305d572b06c26fc50d9821b5faef227afb0d071b1539159c3ca300c919114309f1d66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500629, "uuid": "0613e20a-1c05-4ce3-87a4-7c7047e3a386", "value": "T1DF53F143333DE9F0D89D45F6116CCF84E69734A3B202166A79FE61AD2C4BC211A74BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500629, "uuid": "9595a5c5-63d2-4c19-888d-3b96addef1c6", "value": "1536:WZWG6/gQu/bmJDUJYUuZ/LgbvkgKHS3qspx9E3Z3FfIrU3wQ+BdiU7EN/li:WZb6/gljmJAJYUqDgbM3ypLc3hIrU3w9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761500629, "uuid": "16f4d769-0b5a-48c7-9360-23d27141a4e2", "value": 66288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761500629, "uuid": "732a2717-bc2b-488b-a2ec-b5f52dcbf396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500629, "uuid": "dc653d9d-3974-49e4-a797-29d111904cbf", "value": "Orbt.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43433ffa-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518639, "uuid": "972a0dca-f833-454d-9c37-cef0d5c059e6", "comment": "Malware payload (Mirai)", "value": "f39d54871f6b5ca8163460e2ff0e256b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518639, "uuid": "6aea8f36-dceb-4230-97fa-e1c96b2b2552", "comment": "Malware payload (Mirai)", "value": "0779e3aaecf413f7e1cf4bda84bdbd020093977742df6889dcf6cf535070690e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518639, "uuid": "72d1c2c5-430d-450b-935f-a5f42e624b6b", "comment": "Malware payload (Mirai)", "value": "49a90cc34adaa6f508fda84d9963bf4a6003c191", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518639, "uuid": "3e112d2d-dfdf-4b21-8ad0-d0dd6e676f4a", "comment": "Malware payload (Mirai)", "value": "39db775053e91a8ce6626651e41ed14fb2f1dc055b4758410674df99d32a92ea88791bc8fcb910e238dbe27390dda566", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518639, "uuid": "f75e6bb9-e233-46e2-8eb9-27c6e50446d6", "value": "T1F5815A8D24565F7358ADAF62E26A054B7357649186CF8F06FBCC68E98088D0E7304BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518639, "uuid": "be7c99f2-18a2-43f8-a5ae-6acfccb3a21e", "value": "24:ItrsZyV5bZ8sUYo7vJFC0CLF8O8NIuHksLsK6wCsLqYYO7/NYGsM:igZSNZRUYo7BILLcJ6+LqYD7/NYGsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518639, "uuid": "6926d18c-425d-46df-b327-9a48390c8c9f", "value": 3874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518639, "uuid": "418b6027-d698-474a-bee5-00b7cb6f17cf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518639, "uuid": "f3703321-5802-4fae-b1de-4221a988a14f", "value": "lol.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdbba1c-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761516991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516991, "uuid": "54603a14-7edb-47ab-a091-0a70cc77756a", "comment": "Malware payload (Mirai)", "value": "17a499b9782809bb07aa979d571ee2ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516991, "uuid": "e9dfaf6f-126e-4805-97cb-e12bbd329075", "comment": "Malware payload (Mirai)", "value": "08662018518132ca560c1fe348a75fed763e4f99ad8bc75ecf9877883177ddbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516991, "uuid": "8724831c-27f9-4307-8bc9-9fdafe11cc4a", "comment": "Malware payload (Mirai)", "value": "0185a645bce1ed103c5c5d559fed8eb28f5af3eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516991, "uuid": "a2beaf0a-62ac-44c9-b36d-019d12a38acc", "comment": "Malware payload (Mirai)", "value": "8cdfdc02b21ed1e9daf9efa347ecfd2769f1b1fbde6e56c09ba34b1f57f9b918adf7906029786c04e1cf79bb39775cc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516991, "uuid": "f85e38b3-9e9d-4cdc-af75-629c5f1ec9c4", "value": "T1ECC3F745B881AF20D6D626BBFE4F018A33135BACE3EE7213DD141F2427CA55B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516991, "uuid": "536ed6d9-7335-4381-8357-f304bbfbad64", "value": "3072:VlFJrGh8TdgSutYt4h89ETasTrVqCfbFMHu9KuEs2XMKavvEg6hz6d0nzr:VrJauTdTutYt4h89ETnToCfb+Hu9KuEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516991, "uuid": "1848d636-9f54-491f-b573-bcb41e79b519", "value": 129448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516991, "uuid": "a86fd9d8-3fbc-41a0-812b-b63749ccbd98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516991, "uuid": "bcecccd1-2f65-4c1a-9530-4b280c6b19e0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4050f5-b244-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761466636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466636, "uuid": "56d479f8-78ca-4b4c-abf5-06054fb09577", "comment": "Malware payload", "value": "9c8f5e0f8ff9a58e745285435a0091f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466636, "uuid": "edf7b2c1-f734-4f87-badc-ce514809bad2", "comment": "Malware payload", "value": "098f018082eb92bfa2f9091071106617ac2d025e3e7a2bf799ebbed80ea4b5ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466636, "uuid": "a414a23e-3785-4c9a-857f-46e3e6970ff1", "comment": "Malware payload", "value": "ca49b23b8021c3baa6b56e38a184b47932f10ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466636, "uuid": "61db9a30-679a-4840-a9ca-f6a7f28feb2d", "comment": "Malware payload", "value": "792391d8f91c8d216a2624791e2c6838aa959b01858b0cc90d4b04abeb2285738a9f4a17302d061a33d41fc40ee84159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466636, "uuid": "5c6a9710-62fc-4b80-bca7-cfb4047132e9", "value": "T1F4144B4A776450F9E467913DC9668A86F7B2B859077053CF036443BD6F236E09E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466636, "uuid": "c1d75605-02ae-46ee-ab9f-48fe88ca30f7", "value": "8118829b8ffa6d0681e0692bc01a578e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466636, "uuid": "a479c965-8bb3-4e80-97f9-9a33ec4039b4", "value": "3072:rhu8OLzpe+uYPirDdpzTYN6jFlA4+49THfw+GTcL+Rkm8EvAB:rhu8OgI6rDPzTNDZ+O0q+RtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761466636, "uuid": "4357541b-32f6-4db6-a65f-03d44bdc58d7", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761466636, "uuid": "5dd7564a-f83d-4edb-b018-337b5e3f55d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466636, "uuid": "d49e6186-3a12-4c9a-b881-eddc46aa84dd", "value": "SecuriteInfo.com.Trojan.MulDrop33.7812.4126.16548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c0115d-b28d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761498110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498110, "uuid": "fbf523a8-7664-4239-bbcc-e8d707b62e1a", "comment": "Malware payload", "value": "aedf4f7b64160200ed40c5235b011e78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498110, "uuid": "9c8d02d1-c969-4950-9de5-3c7a649ee1e8", "comment": "Malware payload", "value": "09b00d0e69f788d823d3b39bef378eff05805cc3a623f9f9b3361ea663f01b6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498110, "uuid": "e34f8539-697e-459b-bfe3-6d3e76700e49", "comment": "Malware payload", "value": "e05b522c17f7fa9322e6f4a375a36f053e79bf09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498110, "uuid": "367a9910-843e-4a71-9c0d-4c0940a156b5", "comment": "Malware payload", "value": "2020a29600e4011fe8d5bdce5427521a4d19da7637737067fa519706b05f6714fdb61b0aecd6c50c7ec82c43188d5414", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498110, "uuid": "62bb7d8b-22fe-498d-8abc-d8d9c562288f", "value": "T17763020C60E9A52EF25F4F7250A712C2315DB40DA0D2CA77A1A516AD3A0EFB23E5F985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498110, "uuid": "061e82aa-399b-4b2a-955f-2448a8fc7abc", "value": "1536:6PeyZuJqyHyfebKM+Nj4nJkVesZ5eQerf7i4230rPD:HyZuJvIebXmVteFfW30rPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761498110, "uuid": "a2bc315a-c02c-41d9-b9c0-1d0432289e53", "value": 67000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761498110, "uuid": "17d2950e-f2b2-4eef-b380-396b2fce01a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498110, "uuid": "23104672-18bc-4664-a582-b6d49cd5c5a9", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1355c24a-b284-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761494077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761494077, "uuid": "eda0271f-bf51-4d6f-a309-3e171494479e", "comment": "Malware payload", "value": "030731699e376d93baac5845b17c4ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761494077, "uuid": "1d28f403-0f48-414e-b289-d36043c8efeb", "comment": "Malware payload", "value": "0a8cb617196f4aa7ae49fadc1edd86b4c71cf21307bc959a47040fdf2db705c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761494077, "uuid": "793436e1-f6b8-4420-ba24-1b0ab49e909d", "comment": "Malware payload", "value": "a91918a510735499a7a157b88a2c1892cd0a4245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761494077, "uuid": "a747faf6-65cf-456b-a2d3-598c20b34482", "comment": "Malware payload", "value": "30e84bbb7f42ad333030b9e806484203ed836d9fd90e852fe057d3ecd3497dde22823a62e4b528f886468a724af8a7e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FixStealer", "colour": "#8F8F45", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761494077, "uuid": "cb085b98-f5ef-4ae9-b1af-795f9639011a", "value": "T14508C05333E20566E0B791348BAB5142E732F0275735C6DB394C43282F6BBE4AA7B764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761494077, "uuid": "5d1fb2d8-1303-4232-99d2-ff2b6177fd23", "value": "66b10d8b5718b0fd6fb4865843d44280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761494077, "uuid": "d7e0a5f9-70ed-4ed6-9640-9276c455bb3d", "value": "1572864:dMoCm/sXwTMuGurPiKOTo/O7DbpkWItP6HmukEh4gu:q4sXwBTiDFDbpkWItP6HmbEhhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761494077, "uuid": "a5c6f03e-94ff-416a-a009-27f8e33571d2", "value": 77889220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761494077, "uuid": "f01717ad-537a-4957-9e91-5f1bc54e8907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761494077, "uuid": "5dbc7e25-e562-4a06-bf60-75be929acb95", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec683c9-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761497318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497318, "uuid": "cbe15e37-d972-45d2-8891-8dc0795ce03f", "comment": "Malware payload (Rhadamanthys)", "value": "fe4399c7a720c0f83ef053a83f1f06f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497318, "uuid": "d2ac9bb1-a0bc-4387-b0cd-77a2920f1dc4", "comment": "Malware payload (Rhadamanthys)", "value": "0a913b33ab4bcd8f1425da9c164ecf53013ceb154c50899908e4907340ff824d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497318, "uuid": "62219fde-e0fc-45a8-8dc5-06da47e9f7fd", "comment": "Malware payload (Rhadamanthys)", "value": "94139a5aa602c4719aa7243739671180f4134a7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497318, "uuid": "65d0ed88-8e3b-4b6e-849d-03e80734949e", "comment": "Malware payload (Rhadamanthys)", "value": "ba2a1611aa524494e873761685c06ed28f40820def7d16b7f51837344d5316e4e1bb47dc67c72b4d58d90de22e6734b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497318, "uuid": "eea08fe3-5fc3-49bd-b2fd-630d396e95fa", "value": "T153953342CCB62ADAF59342756CF54AB3F9E07676A2357CCE489B326D7917B0293B000D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497318, "uuid": "7cd0b11f-aafc-4b0d-800e-22137ad5c131", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497318, "uuid": "d17e97d3-8474-4d02-a914-7f6a91392d55", "value": "49152:bha6kVUaQ4gKS8mLPRlSPfN1zSRdnmnKaodJ:taPc463L5wHN9Yaod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497318, "uuid": "eba1bd80-5db4-4180-be91-a53fbeb5dc52", "value": 2027520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497318, "uuid": "f5118b6d-7027-480d-9962-b41704eafc27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497318, "uuid": "96e9df23-ea8f-4e1f-a99e-9ebc64755c71", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1debc79-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761516731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516731, "uuid": "8555c1d3-979f-4100-8e98-260018f2bbd3", "comment": "Malware payload (AsyncRAT)", "value": "8ae944b6607302cb32a82b02074c997a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516731, "uuid": "3d81896d-6d0f-45fe-a5c1-a14fe1089fa5", "comment": "Malware payload (AsyncRAT)", "value": "0ae9ea082007630fa50e0f84b3ee8e1dbb7897d7583a4bf0fc554c0cc79085a4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516731, "uuid": "4364ece6-2208-4fa6-99a1-02a045373750", "comment": "Malware payload (AsyncRAT)", "value": "d921a1941f053c513a7ab7633edbc33ea0f03903", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516731, "uuid": "91f2bdc7-a098-4a7d-80d6-7807d1dff3fb", "comment": "Malware payload (AsyncRAT)", "value": "a55e539a7a9a64798b33d17d66d5621e0a07b59b33244085b1988763ac7c8138d4f026fedc1a998d2663e8745cee3b75", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516731, "uuid": "21324b2a-7641-434a-b645-da1f2f987992", "value": "T12E430A403BE9C219E1BECFB459F6759045F8F56B6602DA0E1CC401DA1A33BC29946BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516731, "uuid": "f0da9bdd-2653-4f9c-b22c-b7094541cccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516731, "uuid": "7dc38da4-391b-48e4-bea3-afd9513cff00", "value": "768:gwY5cp8BdbP3CBD8ddnyAhPUdM6P4NhyPiln0RMBghl/x3mdAb+pGfmpjxALCYA+:gXBzs8dR9Ng53Pb+QfmNxMdAptr54/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516731, "uuid": "30083881-63e3-41ae-b3d1-c78d1eda7c11", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516731, "uuid": "267b4761-4c40-408b-bba1-26563c74bcf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516731, "uuid": "34770b7b-8888-4641-b4cd-4ba16c2adfd2", "value": "Markegot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba90f8cb-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516692, "uuid": "ceca0750-7288-4f7b-aeac-888820f6483d", "comment": "Malware payload", "value": "389d8aba72f01046b7b7817e49ea1bef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516692, "uuid": "3091bf3d-5cea-4da2-9476-3c4f9e3df82f", "comment": "Malware payload", "value": "0b6399908157808739e2081853632f9b62aae810c81b818921406a31d13d232d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516692, "uuid": "5e3da0eb-43fc-464a-9132-1c64227aef2f", "comment": "Malware payload", "value": "69f873e939f73f98b17da8ff6baf286c3ce963df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516692, "uuid": "0054ba4c-0e07-47fc-b892-09f3fc31aa68", "comment": "Malware payload", "value": "08c9d0e0953d35e1e8f249bd5eb478201ecaec46e5a04b8cf4c93e6e2c52e4d873ee7010b4419f13a80a9a516c18fc39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516692, "uuid": "ec50199c-fee4-4dba-90ef-2b9400c0c2c9", "value": "T1795733FDEA32C4F5C4E62231B2E3D5966A6EF8A483D3F51991FC694907274AC0D1F188", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516692, "uuid": "9fd0df12-accf-4a16-91f4-f09b393a8037", "value": "e1a617195887b9304c668489956651f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516692, "uuid": "7b1341e9-cc11-4db7-af9f-c284b122ae5c", "value": "786432:PKI1pEPzcuGNYUpWcUkrBFKYLyfF/MpiTVa:SIXiFUpWHkr7dOd/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516692, "uuid": "c9e324b2-9e5d-409c-93de-0fb2a14a1edd", "value": 27732992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516692, "uuid": "1c11e77e-5f6d-40a6-889a-31420bc1b78a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516692, "uuid": "8048d072-6f2c-4ccf-bca4-8d509d9a0c69", "value": "Credential_Guard__Key_Guard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873c80a4-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469361, "uuid": "5e46b42a-bd21-4137-8c44-d88f976d6c20", "comment": "Malware payload (Mirai)", "value": "8cff9d93d6b1461613b65e0c353e059a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469361, "uuid": "8e36e475-3072-4c15-88e0-903d9c9167b2", "comment": "Malware payload (Mirai)", "value": "0b64faea999a69b2686f0230f523176032374ccfcbf483f0f64fcff38e3f6740", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469361, "uuid": "366b1c76-10e6-4f6b-b3cf-8e58c0b754f8", "comment": "Malware payload (Mirai)", "value": "b7663281bb402db79f79d88024be04aa2d6a74df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469361, "uuid": "b9e28985-dd2f-4d1d-9689-82b2e6dba441", "comment": "Malware payload (Mirai)", "value": "fef6e7f38efb69f2ff14419a94a10538fa9185dfda7e65278f10924d37995500694a65d8e8c25040defc792cd6f0f7b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469361, "uuid": "85624ea3-3cb7-4fbc-a7fa-8eb34de706c9", "value": "T176930817B2C148FDC04AD0344A6EB539F822B9BC1379B6A72BD0BF325C5ED210E59D65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469361, "uuid": "cc05792c-a855-41cb-b243-1632b0f4c980", "value": "1536:Pu9xvdDK6oO8+ZjO8o/yZBUORMUDLmoBVVHyV8LCfXJM9HoUXEkTQv3P4QwDmt5N:Pu9xvdDK6ot+Zjto/6BlRMULmUVsyLb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469361, "uuid": "3abc3e10-ead8-4f99-9f86-ed9fc1df327b", "value": 94000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469361, "uuid": "f3bc9ce8-3592-4b6a-aac4-69e14274c91f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469361, "uuid": "7d079feb-502a-4d16-81c0-f3ba6e085cd6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4866fa1d-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518648, "uuid": "d4f076ac-5156-486e-bbd7-a4d6d3737e58", "comment": "Malware payload (Mirai)", "value": "db77fa0e87587189edd13aaba3fc9526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518648, "uuid": "4d6097ba-be87-4ee8-b321-20d0ab0be0a4", "comment": "Malware payload (Mirai)", "value": "0d5351f3ed49e734489e5f38dc31fe7eebbbe6403b58848f55f1e52fba82299b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518648, "uuid": "3cb56665-925a-4034-9511-17d294679eb8", "comment": "Malware payload (Mirai)", "value": "c7aa655bede1ead6381a24c36df2b8bbddfdf579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518648, "uuid": "f0ec92c7-1b2c-4f20-a894-ee3b5310f265", "comment": "Malware payload (Mirai)", "value": "3d5b9d92940fc535ae9f419618d44db3de455545092595aaa9fe0a05503171dea16968c3ea82b05bb1c3a2638c53e0be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518648, "uuid": "a451020f-b848-4317-8a74-ffea01f118a0", "value": "T13613F196A6ECB66CE22D31FD4CEA7EDE1020BA0D7561C5E16784306354E9B318B24AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518648, "uuid": "bc30b288-032f-42d0-98d4-b50020397e29", "value": "768:RKkMwJiAqWpMWMcLQbQZj1uQZpVNh+Pcs3p7djmJLdVrOWjSzeaQJBRaHOnbcuyk:XM0pM1cz1BBh8fZhaBFO8MeaUmunouyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518648, "uuid": "24681569-f9ee-46c0-bd8a-0f37529b1404", "value": 45312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518648, "uuid": "c36a6384-fa31-44b9-816a-1ebbc00636ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518648, "uuid": "8c7370c4-8d8f-4200-b587-c22ded74357d", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fee5bb-b2bb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761517707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517707, "uuid": "0b2177f4-29ff-402e-a3d7-cadf6cf5721e", "comment": "Malware payload", "value": "3817fa6396b263473f5569a589fff848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517707, "uuid": "ecb7feba-eddc-47b1-9022-7a077630d25c", "comment": "Malware payload", "value": "0f93a3c2de1adb53cf308fcc5ee1fcbbfa9d4f5b371dde1e5ad69d1ff017373d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517707, "uuid": "412b3ae0-89ee-4546-90b2-d7aa64e1a256", "comment": "Malware payload", "value": "f07fcecad8dd232bf33133b72f36d8456b8efd0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517707, "uuid": "ef162d76-2168-4052-bdbe-04a0dee6bb25", "comment": "Malware payload", "value": "618aecf83309b443501960c87bc843075b08d0de3a6ac8f0114f47d982d1f9f11a672914ddc816db2fdb8ea6d5914965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517707, "uuid": "80954c83-5e21-44d8-959d-87aaa22c6263", "value": "T13C8612476694DAF4F08986FC3271414D30A1EC9A94B8CA6C59C9F8237BB3F5E045E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517707, "uuid": "309e5eb0-9075-4a9d-8254-99fe3bffc1b8", "value": "577240208564ce97e456e1877f7b193e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517707, "uuid": "0299c345-4821-4a7f-9d2b-8fac62e793b6", "value": "196608:eiqLX6SQOV5NcSVjK/0aIpu8Jd4OY/8zcHUjZvfwd:eiIrbjokJdrcFiJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517707, "uuid": "a96a0169-0541-4581-9bee-f57935cc5e1a", "value": 8382896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517707, "uuid": "9af9e857-07dd-4b00-bbff-399b5fa793c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517707, "uuid": "b9398689-c0be-4aa4-a01e-4acc7341ebe0", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81570359-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761517025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517025, "uuid": "f0f8dd23-707f-4d36-8b33-c12627f9310b", "comment": "Malware payload", "value": "574e4d8cf105f7f20dd7a155c88e6cc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517025, "uuid": "b879be0b-d1b6-45f5-b8f9-c2a33ed1a120", "comment": "Malware payload", "value": "0fee2926f5708e448c1bd2e14d0b49c6dabce9ab9903e4baa09e3af9ec619389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517025, "uuid": "df4b36cc-01a6-4906-8c1e-02c783d023ae", "comment": "Malware payload", "value": "565d3d26fa78d4ab49fe656fce34bc6161396495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517025, "uuid": "bbf7a055-2c8a-43ac-aa4d-f098208a5fd9", "comment": "Malware payload", "value": "e4bf0bfac9a3152b622c62e955849818e3a150b37877b85d55a8dcedd725da257564d806c325173d1d72536be5dc7676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517025, "uuid": "0a439b33-2ee6-4dec-a1a5-9f8ed473f973", "value": "T1DA5633E973859853C1D86A37094927F80BE2E10F37D4B39B2A4337B74CAE6592D17392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517025, "uuid": "abb5adaf-66e9-419f-9270-3679481cf728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517025, "uuid": "81c523d6-34a3-4695-bcbf-6cb78719cf2b", "value": "98304:kxyON/5aH7vBd6z7YrofcpyedmVX91f8/etZhDDMgQsYugnK4Fa5chw:uSfEandwXDdtZhfM2gK+q4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517025, "uuid": "9c38a7bf-56d3-420b-a5ba-24a30f6f539f", "value": 6444032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517025, "uuid": "55c2ec23-4100-4408-bc91-2efbdb510c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517025, "uuid": "38197f07-2c1b-41c9-bba5-5888bbd8934e", "value": "ActivationProgram_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f40d7ad-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761496406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496406, "uuid": "eeac5786-86fd-42af-9047-6b52203c4f4f", "comment": "Malware payload (RemcosRAT)", "value": "a4363c25fd45bfde22f0ad9c16c632a0", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496406, "uuid": "322ed01c-2c95-416c-87d6-ee0958ddec64", "comment": "Malware payload (RemcosRAT)", "value": "11cb1fe183c89a6e6f0a4ea39bc3f2a7ab6bf60af93536fdecef633c877da70b", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496406, "uuid": "d97e3535-9e71-4699-b49c-998dba0d2e9b", "comment": "Malware payload (RemcosRAT)", "value": "c471d8cbf63799211521996c5c5408f2fbc894c0", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496406, "uuid": "dca98567-a892-4d9c-8850-ee5f9edfc215", "comment": "Malware payload (RemcosRAT)", "value": "9735b42fda020286e2af5c0b8e36f2fcabda29f1d2c59ae6c4b54593e621fea7262fea157f3cd78c94c6d85da678bebd", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496406, "uuid": "469ac72b-7bf5-4269-92bb-eb800ad34412", "value": "T1A7C5BE5D94B05D926024FE74AAC5F7938CE907851A1B4B920FE5E2A63205C43FFBB372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496406, "uuid": "b948431d-c50c-46d4-99cc-8997b773d0bc", "value": "24576:wRTJJQ4a4MWEAMqBxBNsqf0vSx+FINzQLDPioh:iRI8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496406, "uuid": "63c3def5-0868-4edf-9379-ec0b22c0b08e", "value": 2681070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496406, "uuid": "fe468094-470a-4090-9a2e-a655c431dc32", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496406, "uuid": "cfa3d8c7-6828-4c11-a30e-6b27e8c9ae06", "value": "INV200398488939.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3ddc33-b29c-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761504565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761504565, "uuid": "5f7b4be7-1aaa-40d3-940f-f4c032a7a730", "comment": "Malware payload (SalatStealer)", "value": "47bb45f18df3657e957d30b0a037244f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761504565, "uuid": "230d34c3-c5f7-4bf9-8c67-68b835542706", "comment": "Malware payload (SalatStealer)", "value": "126f4d79d4130629026d2be67f62e6c1615a3f715efdea8b1f349227b149307b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761504565, "uuid": "826b027f-bf19-4e3b-b419-38906f02f36e", "comment": "Malware payload (SalatStealer)", "value": "938da9b7fa96081e1f03e13989e777bee242e1ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761504565, "uuid": "c76ee80f-7169-42cb-a5d8-4903213a7331", "comment": "Malware payload (SalatStealer)", "value": "99281e157cd13f77775b1ed3f71c74c87fc51fa388b9298f30f14617bebe7db9957a00ceb0c3ff1e14bc55c7030e8e53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761504565, "uuid": "068009f4-9360-457c-8b3e-6fb376aec8b9", "value": "T1A4C6332BA6D00497DC2B827C8477431CEF61B8644771D28F27E89A7B2A1B3E25F36751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761504565, "uuid": "c21067a1-cfc2-47d3-acf4-3dc56d7cca2a", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761504565, "uuid": "7374a03a-135e-48c4-829a-7b2d2527dc50", "value": "196608:B0SN/W84zkSYKjhzEqUcsSeS7zj9AKm6gUU8gBk6vdQmRsIkaqdVTVjMulnIhDCj:N/jKhYPFSeS3GH6Yk4dQ3Iwd/TlnkC+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761504565, "uuid": "de1bd360-55ef-4371-9129-e874706b9753", "value": 12113799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761504565, "uuid": "039d7daf-316c-4f01-a57e-435a99d463d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761504565, "uuid": "806f44e3-de9e-44cf-81dc-9ab5370b7bb6", "value": "winx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09449824-b277-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761488477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488477, "uuid": "50726dcc-23b0-4486-b8ad-bb9de024eb77", "comment": "Malware payload (QuasarRAT)", "value": "1d14a0ad37986aac81f72242c12f5777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488477, "uuid": "2c597940-f1e0-4b52-84fa-372230d8cae4", "comment": "Malware payload (QuasarRAT)", "value": "12ce3769229d84d3e5656fa6d96fbfaefe3a844c5124378c30de5139031dc6b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488477, "uuid": "a54f8a2c-6d75-4fd6-8e48-344998bb590a", "comment": "Malware payload (QuasarRAT)", "value": "168e73f837511323d7851b885fbcfdc80e777483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488477, "uuid": "3661b45d-6581-4e21-9118-1510c29a30f9", "comment": "Malware payload (QuasarRAT)", "value": "32b87f5758ed03cf1a817b35b91235104394a8479590c638522c4a32d290b68d3c95a222aab8c4ee945951a51867cf1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488477, "uuid": "d8693a0e-568b-4742-a231-0bb7b83a6eff", "value": "T1A815BE5463F8460BE1BF1BB9E4B205050BB7F453E536D75F1988A06E0EA3B81CE607A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488477, "uuid": "bd1f3123-fc4d-4335-900c-edba55e11d42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488477, "uuid": "c946ba0e-30c0-40b7-b3ff-24e8b41dbbec", "value": "12288:sMen0tWfOzAbQyg7oZisqtksOtgg+WLyDrQ9/7WxdtbiLNg1O5qYNRpY0+pZRr/W:FDtWfObyclOoWLuyWfaN+OfpYTpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761488477, "uuid": "0e584c08-ce3e-43d9-a78e-474e57ac641b", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761488477, "uuid": "2769fda9-ea1f-4049-b3c6-95dbfb37eb12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488477, "uuid": "08def0ff-01b2-4c2b-b7ba-d226d2b536b0", "value": "Voidstrap1.0.6.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b9797f-b287-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761495501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495501, "uuid": "57fbe503-44a3-4599-9bc9-28de60c78a2b", "comment": "Malware payload (Mirai)", "value": "8ab78e59f350210c17a78d2bf7389338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495501, "uuid": "8644175b-15f5-4086-9228-6208f10160fb", "comment": "Malware payload (Mirai)", "value": "135f1f164ae8a704d1519d0d25b2925ab6bf33042d4fc3325aa5472f8e78a04b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495501, "uuid": "5bf1ec18-0b26-4841-b5e3-b8e8bbd24146", "comment": "Malware payload (Mirai)", "value": "33b0ac155a730d747a0172ec09c6921abfedae3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495501, "uuid": "15e56f4f-f2b4-4e05-bc65-693faff3ca18", "comment": "Malware payload (Mirai)", "value": "5ca241a245ab48b1e173b5a5d5d82bd5c29ff29e9adeb016cacd71cfebbb999596d53d3ef9ee4b3d284394c7c2f583cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495501, "uuid": "726e46e0-c3a9-4d84-be73-40ce27273c52", "value": "T1ABF33A2F248192F0FA411B7467CBD3976C690BBF51A990DF6B415329B6E0B7BA03C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495501, "uuid": "d10f504c-710d-4b24-ab0e-1b1ee6a5859a", "value": "3072:hvLFy4JZYH9YSZoL8zjOHmgcoH6UsNVMT/C9NWDX4no558TUVe:hvLsrZoIPmc2+GTq/WEno52gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495501, "uuid": "c831b5e6-b55d-4795-a1bd-7c28c983eede", "value": 172756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495501, "uuid": "8f12f5b0-cbb8-48cf-8746-37738522e9da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495501, "uuid": "0e18f84a-63a1-429f-8698-e59b3d0e49ec", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ef3b19-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1761496551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496551, "uuid": "d1567da1-f491-4d37-9d47-9e66e7bff152", "comment": "Malware payload (LummaStealer)", "value": "ead08b586a827e6f7b720523b1b7f0eb", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496551, "uuid": "7226d8cf-e111-48f3-983e-0e4817dde4bf", "comment": "Malware payload (LummaStealer)", "value": "1370caec7bf0f5a8ae1846c7b981554d254927e33d047adb3d673f451c387066", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496551, "uuid": "750d2c62-9b02-45e9-bac2-5e6532bdf077", "comment": "Malware payload (LummaStealer)", "value": "8fdd7c770329b47d758a5f01189f03f348794fb2", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496551, "uuid": "8c3b7535-df46-4413-b5c0-9df6b209f143", "comment": "Malware payload (LummaStealer)", "value": "1e022830c10451ae655deb82708c6600d5a9e3ce0b331547e2297a33d7e5fe2e1494629c9b0387223686dfafdc722ad8", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496551, "uuid": "136ef76f-4aa9-46b8-a195-408e6fbdb27e", "value": "T147F733A27F64F2CCE0038CB195983594F218B466B1517FD9D6B35AA0AC55BF3A623333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496551, "uuid": "9163562b-e876-4cd9-a7f4-055c93f0c970", "value": "1572864:FO4RLM+1f6O/cNe7QAagX1PdDQ0Hoyf8FgweO8xlB2+YHjy:FTR1ff/kUQANXLDQ0Iykyw/b+YDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496551, "uuid": "1fd3dfcd-a6df-4e54-b271-da247619e124", "value": 72743023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496551, "uuid": "0e23e4db-bf64-433e-af0a-87b1701ad4af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496551, "uuid": "f38962bb-d5df-4957-adaa-80bf2d9e08cc", "value": "KmsSetup_X64_x86_2025_v.1.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debda966-b236-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761460918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761460918, "uuid": "2f3b1d40-20aa-416b-b962-1ddb22c8b414", "comment": "Malware payload", "value": "e757f6350d0bd20792345f4a8afe9737", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761460918, "uuid": "d24050ae-7429-4008-aae0-707fbe32e58f", "comment": "Malware payload", "value": "140a9d29403a6f5070ef81098448c50a718b44261251130aa8ebca9f3e8fc484", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761460918, "uuid": "411004cf-766c-4131-a349-03333182bd5a", "comment": "Malware payload", "value": "1df6978adb9c74b7f522f630e5f7df10c433f929", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761460918, "uuid": "68ed08fa-1c28-42db-9362-fa657b902087", "comment": "Malware payload", "value": "44d229323c753b9aad38f2d894b7db11f0fc896f42b76908c6b6ac350c9d62f1cec9ac3df02dacb7a1a29891671ad233", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761460918, "uuid": "aedd356e-7b80-4c55-bb53-c670c7b92102", "value": "T194A53309C22C9F44BFAB739D05096F8863DAAAD9C89DA4575944C64F4EFB3C131EA0DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761460918, "uuid": "394dc2fc-298e-42fe-89c5-960c42ba5420", "value": "49152:05sV5ZLZZI968AHaJWGetjm9qxf94WEbUn4GrqCxj7e7M/aERedw:0yBs08aasGqjeyOCl7ewLRUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761460918, "uuid": "841b6e63-3f2e-430d-a35a-2dfd2cf428ae", "value": 2122793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761460918, "uuid": "e718d247-645e-476a-ba39-af67f0f3f34d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761460918, "uuid": "d4310cf6-8b55-417c-a3d0-8d90e31f24b1", "value": "AA_Testotis_141025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3edafa-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516939, "uuid": "89c25529-d4f9-480c-9aae-694027b97309", "comment": "Malware payload", "value": "792cefc37c01a902e4fb243c06ab1df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516939, "uuid": "8270ddd5-8f6d-449f-bf12-f8a1540fcef8", "comment": "Malware payload", "value": "14e0105b582540087009c118eb0874a66403accc9aa59469a11fea0e032156be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516939, "uuid": "c6868454-297f-4bc5-a38b-6bd8d8f5f63b", "comment": "Malware payload", "value": "630ca81babd726467af618355322354347e987b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516939, "uuid": "c3103e1e-7d69-44ca-bdf3-9367a96c70f1", "comment": "Malware payload", "value": "b8b14546ea00178aae1de0b6b8c31f2e67470f691da93e111eb7b4c5ed5ad16aaf08251cda22e51b578bd0b9acb27360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516939, "uuid": "beef1358-4313-4bd1-bf3c-40e8ccb97a8d", "value": "T175620F154C5A151186B7CB6CCD0AC8C1E55B0B779B7E3813F6AC85A12F300A5DABCAFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516939, "uuid": "2dc035d5-3d9c-4367-90a1-c9640e6a917c", "value": "192:bRU/X1x0X1HreH/zyOCyLWEyjkhNXd/be4Ud/+PcL/toQge96F4U0JsN+d/B92uO:bR+qlLeHZRWEyj+Nte4StotyFqKm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516939, "uuid": "9df87d87-eaa7-4e78-bc60-57e01c0d107d", "value": 14936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516939, "uuid": "bcf8ffb1-e419-4cd2-aef7-fa3363c1700b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516939, "uuid": "4c26b16f-23b9-4f0a-b9e7-376d47307ff3", "value": "f8t2v6qz1smdr8kp7e4bad3kygwh5jz.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88edc6b7-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761516608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516608, "uuid": "c1ca62c3-6c68-47a8-a4b8-97849190877d", "comment": "Malware payload (AsyncRAT)", "value": "b522be51df28baa7efd9cd399afd346e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516608, "uuid": "da750f73-8314-4049-a695-9aad2700ea39", "comment": "Malware payload (AsyncRAT)", "value": "15a66a0ab11c10e6d28b2b5200c20da4e880adf470e562049b7cb57a171566ec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516608, "uuid": "f56d8163-2020-4b39-905b-08244c7a8c31", "comment": "Malware payload (AsyncRAT)", "value": "7a2e48f017b8f5edc2650f8e0d148701cd88f8a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516608, "uuid": "91c3206c-5cb1-468c-ba52-35b53370365e", "comment": "Malware payload (AsyncRAT)", "value": "1d9d4485586dd9060d7cd046cfa01b41ba80dfa232a40357c1b7cfc0451c708155f1ff91a8e28085dad5d5b0cbe9246b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516608, "uuid": "f2f06b2e-9980-440e-b7b9-139501902728", "value": "T1E834B6963AD9326EDC2F4A78035FEAB21B756CD17382496E5F80320D0D3694A80EDDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516608, "uuid": "75976a24-0339-4bd1-99df-80a243cdd6c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516608, "uuid": "15d171af-76c1-4b8e-8bc6-9f730659626f", "value": "3072:tiJzFIFzk5p+bIXvbDOnodFsvjhheN6PoB+ffm:tfogbSvb7duVheN6Pu+ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516608, "uuid": "9ef43c49-9eae-465c-aa92-384231005d82", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516608, "uuid": "38291a67-786b-4971-af18-9944a60c3414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516608, "uuid": "4139bb39-d126-4280-baa2-3023c733f7fa", "value": "VisualStudioSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f27a5b-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761497170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497170, "uuid": "91ff1d2c-8641-4f03-9855-8b6fad7895cf", "comment": "Malware payload (Rhadamanthys)", "value": "526445ce737575ef0f362e0a0b6b0549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497170, "uuid": "3724d10c-f37b-4185-a036-febd7bf5dbda", "comment": "Malware payload (Rhadamanthys)", "value": "1701b622be8e27724e9e676a084f980955ff65537f3ab3eb33d90254e7e36db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497170, "uuid": "383ed520-0262-4dfb-b46a-5edd240c3d76", "comment": "Malware payload (Rhadamanthys)", "value": "503fa7ffd0faf1c71d88ee95b721a0a3a68f7c67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497170, "uuid": "364ec71f-c116-4fe1-bb9c-32bcc3fa2487", "comment": "Malware payload (Rhadamanthys)", "value": "61854f4a073aec0cc58a7edcee4419b2331e7375a681380d79a89b6bf3936d90862e6db3fe83764d1a6e04547c9fa3e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497170, "uuid": "37baf930-d219-4c5b-9dd5-1d335c6d170b", "value": "T187663A0789D091D8D09DF5389AB2B262BB747C45973533C36B62BBB91E3A3C4663D318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497170, "uuid": "f6953341-ef76-4806-a42f-5a8eb524ad85", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497170, "uuid": "220cf220-ea4f-45fd-93a2-ea4ca58528f1", "value": "49152:y5ZubVAt3Dw90/2t09nrgLrMOiOSvyHvckVjMeure5EZ68TN+Q7SuUKOjJTW9qGE:yRdwadoy3WkQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497170, "uuid": "136aa710-6689-439a-99e2-653f9beb95fa", "value": 6620600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497170, "uuid": "6bcfb2b4-b1af-4f03-888d-32a629d4c256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497170, "uuid": "d7f37479-536d-4c3c-80f4-40123d5d65f2", "value": "526445ce737575ef0f362e0a0b6b0549.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219d2cf8-b24c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761470049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470049, "uuid": "f9530636-af19-4c6e-91f4-7a1be82311f7", "comment": "Malware payload (Mirai)", "value": "5baac569899d4705ac70d6d664b52b0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470049, "uuid": "7145de3e-21be-4db2-9096-340bb28d116b", "comment": "Malware payload (Mirai)", "value": "17a56d1c632a3dc8efff0523864d1f6eead0afcacd4ae6d2c2993cdabb105bd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470049, "uuid": "085d1ba3-796b-4626-9c4f-8ce3d588b665", "comment": "Malware payload (Mirai)", "value": "ad04a538b71a4f868d411214a53212897de23b90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470049, "uuid": "d74e594a-bfb5-483f-b1d5-f80313f16874", "comment": "Malware payload (Mirai)", "value": "f0b8acd9ec7e8c69839cfd8049a1ed8b7cc18645154fc61eba21a4a2cb66930b406f3000f1070433844ab4a8b724bc9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470049, "uuid": "abc7a2a6-9acc-4c77-8f0a-515f4a562282", "value": "T1AA73C50AEF605EFFDC5BCD3305AC065134DCA85622A82B797534CD28BA5F28F46E3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470049, "uuid": "050fa28c-3a2e-4bb8-b752-56334f8817b4", "value": "1536:AlCT9T+TfTETzTOtc1+UjbDw5sMJRTM1OA46F8kqYbta:galOLon5FsNMlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761470049, "uuid": "5b5edc4f-9a27-4d7a-a147-6630c4f40415", "value": 80484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761470049, "uuid": "fa725d00-a126-497f-a3bb-93af8d222114", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470049, "uuid": "ede6527f-7980-449d-8392-48a383d866f2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3270fe-b244-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761466794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466794, "uuid": "98e4d0d2-e7ef-475a-a651-ca26a952bbae", "comment": "Malware payload", "value": "d33d6f648d133ac72404d2dbb9285044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466794, "uuid": "d69f20da-4449-4c3d-8bd1-36f762d7e039", "comment": "Malware payload", "value": "1893b2250c4f2bcdb9b3c97661d6c6fd971f96a01cf39de28bb4b752bb45bd56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466794, "uuid": "addd2d88-f778-4316-905b-3c77cc03da72", "comment": "Malware payload", "value": "448b0367d3df2a96bac89300611cfbc425130e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466794, "uuid": "c4d902e0-0023-4b91-baac-6c352363e8f6", "comment": "Malware payload", "value": "47aff7fadad3cdf388cc998ff08c821f343eb4d002e78a8151039e65c9dfb94bdfcf66bab31168b107d98bb78b62ed74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466794, "uuid": "c55976eb-00ed-4b76-b5a0-341eeebec380", "value": "T1A6247286BFA03FFFD81ECD3342958A0916AC490A52D86F762A74D418B78B14E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466794, "uuid": "e2efa979-d134-462a-82f6-e71708b90716", "value": "1536:PKfrS/jDuGmjGaiOjYRvVAmwHp1bJPwTFOfTbDrbHVpNmwDP2FIeZJMElYrnTerM:PKfrS/jcWhEJwBOTV/haF9ZKnT2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761466794, "uuid": "f6cec2c4-5998-4059-9582-9f591be00da6", "value": 227648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761466794, "uuid": "51d25c9b-6636-4d64-834b-fa2ca3fb86f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466794, "uuid": "4d7dd1fa-d257-4140-a2e2-63356bef3da0", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467cc682-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518644, "uuid": "6f1e16ff-1243-44ed-8368-868ee949662a", "comment": "Malware payload (Mirai)", "value": "65569c8184200614f547c90ace32d0b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518644, "uuid": "e5efba56-946d-4481-bbbf-50cdca34b562", "comment": "Malware payload (Mirai)", "value": "19a3bb38caea6b2d896a63e416a70b680311cd77373aed43c92701c1a9cc88e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518644, "uuid": "2e961c80-c4d5-4128-9411-2a86251668ec", "comment": "Malware payload (Mirai)", "value": "eaa8cd74f6c5d4d688892d71bec87d6d007b852a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518644, "uuid": "4ddc880d-81d7-4482-8f58-e23d7df83723", "comment": "Malware payload (Mirai)", "value": "0a74db0b1a70025caf97e3caaaf579f1652f7ab2ef9e2a9b7f5ddf31dd15e9396d0a8b4dd41785c60cbabb101712d49f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518644, "uuid": "ac8d6156-a1cc-446c-a04c-47d36235b1b5", "value": "T102A329CEB405DD7EF41BEAB64CA7190AB53193715A871B267397B963AC320F84813F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518644, "uuid": "ee0cfa12-3f0d-4285-844a-6c1e86ddbb2d", "value": "3072:+hwPvjcwVQ9ffR6besl4rBZVixBxipdTqEr21Gpgk:Hvj/o3R6beslVTAplq5Gpgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518644, "uuid": "ce3092d3-6ca1-41eb-8c70-f9255fcd5558", "value": 106904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518644, "uuid": "98081681-4ae3-4131-8315-b9ca66f1d342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518644, "uuid": "fd9ce12a-867f-429a-b55e-5bbe7920f074", "value": "executor.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9159e5c6-b24e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761471096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761471096, "uuid": "fc103e37-88d0-485c-9d22-577b32b6f86d", "comment": "Malware payload (Mirai)", "value": "ac4491d3d0dbdf7927a73c1478fdaeaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761471096, "uuid": "4dba6764-2ff3-445a-9662-541bf954e0b3", "comment": "Malware payload (Mirai)", "value": "1ae5addc22b40d35e0f412586c4efeb9219782a9e8004dc0bc1812e2a0ca1bf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761471096, "uuid": "fbd78caf-2dd4-49c1-a122-e38bb93ac0b6", "comment": "Malware payload (Mirai)", "value": "33a3a6e300f58f243267dcea5101837e282ab248", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761471096, "uuid": "b4eb94db-8a11-4fb7-89e0-8532d0db40c4", "comment": "Malware payload (Mirai)", "value": "2605c8c92ce00b32c9372d9c616a5ca12e017c1ae264e181d680940544e778f33b54cdadfedfc41730ab7c99be60e856", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761471096, "uuid": "76e8683c-c628-4184-9b7b-59a4964888eb", "value": "T1540429D7F800DDBAF80AE33748530905B630B7E604929B337267756BEC3A1991577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761471096, "uuid": "067b3018-627c-46c6-aa64-a7ac7ab08c8a", "value": "3072:q6cnuTA3Z6aoG5/LJcBw5Yt+Apy0jfdVNjbiOLLLEIyaeAyuh/F5QK9/:WKB+Y55jf/LvEIya0qQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761471096, "uuid": "063f632a-74a9-436e-9d16-a6757ed9b7c3", "value": 173312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761471096, "uuid": "e6de29a4-982b-4b11-9291-ecb87db376ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761471096, "uuid": "21346ae1-c37a-4897-8323-353bd6783f2c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7414f164-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499823, "uuid": "da90ae9b-1b75-4331-9adf-9946f7db4da9", "comment": "Malware payload (Mirai)", "value": "66a86caae743bc38e79f9a6463034285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499823, "uuid": "f1e5fb2b-192a-49f5-acbe-41c9104004bd", "comment": "Malware payload (Mirai)", "value": "1b9da9aa25f95a64019871bef8f1fb4912de5d5d5904d049b04ab36d31b9a412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499823, "uuid": "a2c6b16f-497e-4264-a802-7873553ffb37", "comment": "Malware payload (Mirai)", "value": "0c3b8ff8839cd4d4e88c5c3ecc606ae2bf4d473f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499823, "uuid": "6388ec4d-bfb8-40c5-84a0-e43acdd46701", "comment": "Malware payload (Mirai)", "value": "4626f9ba7009293287fd1b017533b8485a54219eef0757d0752d5f406eabdd28ad7098f0da7f5a4c024d77ea41338022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499823, "uuid": "be88abe2-6ee6-40bc-a1f5-f86a2c72027a", "value": "T1C4931896B8819B16C5C1127FFE1E128D3323177CE3DE722399245B2537CB5AB0A3B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499823, "uuid": "261c9333-036b-46ef-b082-f75cf2863dc8", "value": "1536:7VcnsUAt/5zmWAiIFpUa3S2ucFTOmMkiF0jZMKxZwqJwQ5SYAJZ:7pUAN5zmPpUai9z+ZMKxZwqJds3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499823, "uuid": "c14a37c7-9722-4ebb-abc2-370f9b76db31", "value": 91556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499823, "uuid": "6b45d8ff-ee44-4b18-a67b-fc9fdf72d835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499823, "uuid": "960e2d1f-1475-45d3-97ab-cd3eb91d81cf", "value": "kvariant.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54dd45de-b292-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761500200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500200, "uuid": "d3651ad0-63b2-4194-bf0a-bd205dbe5b72", "comment": "Malware payload (Mirai)", "value": "43458eb9b8d4ca214ac60f09ff4503b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500200, "uuid": "75f6966f-a6ad-405d-900d-e08b2a517efa", "comment": "Malware payload (Mirai)", "value": "1cf998f4621788fae73d34cf13e247fadf8b2bfaea0d861e35ac1077f1d404da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500200, "uuid": "604d87f4-d35c-49b9-b888-f2923f236edb", "comment": "Malware payload (Mirai)", "value": "48ab5f508e44d38e56832a1032844eb78d5cd1c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500200, "uuid": "6e170c00-99f1-45ed-88f4-712f7b7a9d18", "comment": "Malware payload (Mirai)", "value": "7a2c4b5a5c15839a697c9c9026a90627527b505651672fcda491d1318d23e6a6378a2d289b9af5f33cf3807d921f4ef9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500200, "uuid": "656a182c-780c-42fe-a378-4117fbd00a91", "value": "T1FC342A46EA804E13C0D627BEFA9F42453333D754D7E77306A9296BB03B877AA0F62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500200, "uuid": "db9c8d48-6ed1-4160-b473-c0c817002693", "value": "6144:4JJNH2avDMiSPalxNRJYgRypRdufXmhTeGV/GaqV:4JnH2gbSPa7NRJYg0f4fI/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761500200, "uuid": "dc97993b-3c87-412e-a56b-72cfe82bd438", "value": 247431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761500200, "uuid": "30d9257c-bec0-44d4-8be2-65fd6d0747b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500200, "uuid": "2b8689da-011f-41d3-bd5f-32fb0760d45b", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2716185-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761517108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517108, "uuid": "bad392ea-3f9e-4078-956b-911914036830", "comment": "Malware payload (Mirai)", "value": "6f2c73522b56eed998a9c399e84ca483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517108, "uuid": "db01f8a7-0d6c-45bc-89ea-13a7eb875a0d", "comment": "Malware payload (Mirai)", "value": "1d27373d25cc12e0cfe5a408917a566f1f901c6abc6466a06d427deffecde6aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517108, "uuid": "f482b4f4-dae2-4d9e-b45b-f9a1c27b00b9", "comment": "Malware payload (Mirai)", "value": "5a625f7787f9f4c2cadf7bde421f9a0e15acbb1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517108, "uuid": "b6fcd0ef-0457-4fd9-bc8a-4f25df2617c6", "comment": "Malware payload (Mirai)", "value": "909b1bcf7db12c6353afc7469194a45f77104d377e90926bf742439331b07afc2f5beaf8df3154ac4c0944c62b936473", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517108, "uuid": "1f695971-aa59-4abd-b171-db2657a90989", "value": "T1E0B3E80E6E229FBDF768863447B34F65979D33D126E0D684E2BCE1105E6028D681FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517108, "uuid": "bb7ee49e-4f54-431f-b33c-4a37b41a9057", "value": "1536:dch0s85bL5YDjhb5aSxcQUTRGfhvc1USlYG4ml9eummRNIb7em95TsD:dch/85btYD9xcQUT+hvc1USuulIh5TY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517108, "uuid": "d3b1f1ee-bd8d-41df-b654-4edd67acc195", "value": 111404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517108, "uuid": "aa1adae4-ee23-4e8f-9b9b-1f7078e8e205", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517108, "uuid": "ce65dcb0-d62b-49c6-a110-a618cf3e4b66", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2080c94b-b247-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761467900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467900, "uuid": "e9b175df-9d76-4e51-94f7-21dd0f31a502", "comment": "Malware payload (Mirai)", "value": "2ad5129c8aae97d18601147a2716556d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467900, "uuid": "207a61f9-fdf4-4fc1-93d4-7d03c1206db2", "comment": "Malware payload (Mirai)", "value": "1d72bf54d2c1b362de9b3722e0667e3c8f36c1550179a82940b788d8ab7888fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467900, "uuid": "a8faf251-1c63-4d33-9c0b-ba2e5aac68a1", "comment": "Malware payload (Mirai)", "value": "c7cffdef5d92f7dfa4042e9b4a3aee63332859ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467900, "uuid": "543f2f7a-a6bb-452b-aff4-7b8c5a091538", "comment": "Malware payload (Mirai)", "value": "83f585d39c3918ebdbfa10df3822f5d70b196d8f9d5cc571baca1aec3cd3a84e3290318f7d10264fb8a1ad53cc708615", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467900, "uuid": "040cba21-de83-4fd8-9c0d-bf0df13e2d94", "value": "T1CAD3B50E2E218F7EF368C73487F74E31975923D622E1C685D2ACD5151E6438E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467900, "uuid": "45ce5f42-553a-4657-ab58-47d962e012bc", "value": "3072:wvooJ4T9bqioF1cmTGuYq8sDLdx0BXnbO+OS/nTaN:uJ6orh5YqqrOULaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761467900, "uuid": "aaa7067f-8c67-4941-a9ab-bda3fa21e86b", "value": 139664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761467900, "uuid": "f7af4cd8-c833-4aaa-9c73-0e5d17e3caa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467900, "uuid": "c5b54582-81da-4238-b3f2-f4b2969fe588", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd57486-b27f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761492132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492132, "uuid": "f7a6f141-c8f6-417b-a1d3-e0096f1f907b", "comment": "Malware payload (Mirai)", "value": "cb4c30d8a34cc7bc1c8d73cfe24427c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492132, "uuid": "1135ee6a-c6ac-4789-ad17-310379b394e1", "comment": "Malware payload (Mirai)", "value": "1ed67f7a03abc93aed509ddb3f14a7e52a6dba99b6f50b65ec91c700dcc621f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492132, "uuid": "5e8fe778-93b7-47ed-8345-d687a55ceddc", "comment": "Malware payload (Mirai)", "value": "c36f1ac6e42ea60393d216d1c3c75824694ac245", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492132, "uuid": "3f31bba4-044f-4ca5-8aa1-3c8f0cc65f41", "comment": "Malware payload (Mirai)", "value": "dd90a01c5f52c4fe6bc534b0b36d00b5d1e22c33ce26c3da7d03bcb7a80743d4d0cdc97211b446e2dc371b7e30c6ab0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492132, "uuid": "e3365426-0d39-4a29-8978-8d146f702aad", "value": "T15C736BC5EA83D4B6EC6302711277AB765B76E9350029DE52CBB4B976AC07603B32731C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492132, "uuid": "70860db5-4a84-48db-84ed-fdcec6fbea95", "value": "1536:dU0xFIx/P0pm5FlCGzx+p+RtO/9mwNOXsIV5g2xAOS:dU0W/8cta4OVbE8IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761492132, "uuid": "ad50eb6c-ac62-4761-8b02-f0856f4c75ce", "value": 73428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761492132, "uuid": "7eaa6448-af07-4289-94bd-d64c6c39944f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492132, "uuid": "625696e7-4ced-4c48-ac85-ae83ea4d947d", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aeda92d-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761497633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497633, "uuid": "ab8f8dc3-2ec3-474f-8a54-c1ac29a94610", "comment": "Malware payload (RemcosRAT)", "value": "852d3c6bcdd3d38e31a0d61c6d999e4b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497633, "uuid": "d03af51c-4f3b-4753-8cef-929f5266bfd2", "comment": "Malware payload (RemcosRAT)", "value": "1f0c9c08260580d32bf3f2ba499d5812b93d792a99b6f0b6d4767510219cda3b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497633, "uuid": "6ea5571d-037b-4235-af9a-ad44d723cfaa", "comment": "Malware payload (RemcosRAT)", "value": "c5388acac9523ca8e9e92f470735b471832bd410", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497633, "uuid": "b006f228-ff76-4228-92a7-f7ea6211865e", "comment": "Malware payload (RemcosRAT)", "value": "7f50cafc6b721ae441de01b05936a78afbffc0791b742648f7b8338e0a1d025066ae14b067cd5eaf6b620e7feead9e2b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497633, "uuid": "5f96e3e7-7c1b-439b-b704-9af85b8f75bb", "value": "T1B1C2C836C884BFF0072FA1A3AD4B395644554366B678360D74CEA5AC3B35361CFE41EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497633, "uuid": "30c4a44d-5211-4b89-bf14-04a5b58b07dc", "value": "768:K9WYuZoQ21ul/fE8y1Cvo8z9C/VcaDNjr8:+7uZoQ21u5fE8y9W0Zr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497633, "uuid": "e1ec33c2-4311-4691-a855-fa92a6433366", "value": 27607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497633, "uuid": "fa768557-a5cb-429b-aded-cc4f7a089094", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497633, "uuid": "1829d2cc-a1fa-463e-8fdf-fdf8f5388bd4", "value": "ss.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0e6f33-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518682, "uuid": "353dd9d8-f9a2-4d8c-bc86-e09318554960", "comment": "Malware payload (Mirai)", "value": "68433cc3206526adb6fbb82e18560f7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518682, "uuid": "f71d18d1-b89f-4f1c-a0f0-ad390f1157bc", "comment": "Malware payload (Mirai)", "value": "1f8a9a77f0f2881c01716c9e31413a5edbb8c636d37f76ab7588cbefbd34168a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518682, "uuid": "da5c523b-b03d-49fb-a978-52f2b24c516f", "comment": "Malware payload (Mirai)", "value": "ba9e3e96bedfe9e0809aeb06617fee4993862830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518682, "uuid": "bf34b81d-0bd9-4c4b-986f-37d347aa8250", "comment": "Malware payload (Mirai)", "value": "87c7e74172c5b6bb11a8907888193cde770573c511f92bf58009a424a8019b6ce0efc47b81c482aa156f82bab6d01b0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518682, "uuid": "a8e7536c-cfe3-4f7a-9a39-2cc613d296d2", "value": "T133044B46EAC14A13C4D2277EB69F514A333397A4D3D733069929AFB43B836AD0F63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518682, "uuid": "9b3111e7-b0de-4917-996e-4074cb1ec7ae", "value": "3072:cMnvV0j5RkRdGarUojx1wm89QrdqClp0U6tT3o29M/9L4nKv7e8Q:cMvWQPGarUojx1L8akCj0TtT3ooM/9cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518682, "uuid": "c6970ce3-6672-42a8-87ea-65104b1a8288", "value": 189444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518682, "uuid": "0101b748-f03f-4233-8fd1-913ad9c95067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518682, "uuid": "32384e44-214b-4d65-bbb9-ca60b6b80392", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3dc535-b288-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761495916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495916, "uuid": "27241b56-921c-4203-9613-e2d0d7d21010", "comment": "Malware payload (Mirai)", "value": "3e969f66542a617322c1760ad9b0bde7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495916, "uuid": "981923c9-97d9-47d7-b65b-de1bb58ba61f", "comment": "Malware payload (Mirai)", "value": "2145030fd725c11eb341929944bc5407a8566a531747779b9ba342e1bcfb5a3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495916, "uuid": "cd94e610-7d16-4ab5-b4a3-93063cd25e99", "comment": "Malware payload (Mirai)", "value": "47fe484e283a1e98c3c0dead4e90e6b5873b5a44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495916, "uuid": "356c54ca-c89a-4c00-b6b1-481b9c9a9d1c", "comment": "Malware payload (Mirai)", "value": "71864dbdc48aca10f9c092b4dbfba5d2e9a09f1f591751c660a70e7c943110c391d91f9088cea21cf49ffaabf455280e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495916, "uuid": "20d187c9-c04c-41e2-a56c-7ea1edbb23df", "value": "T14D146C2BB3C39CEAD51023305C302366772FD7491958EEFFDA163790AA977225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495916, "uuid": "e1aa2b7d-5200-4d3e-9808-ee3fbaf90af2", "value": "6144:6ltOm5154yawmB9lb55D0Fp4d90i7IKTtD:DyaX995On3i7Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495916, "uuid": "91705054-eca0-4b40-b414-4f047c254ada", "value": 197592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495916, "uuid": "f5450c09-cb42-4057-a308-55c103a01ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495916, "uuid": "58b16b53-88f4-4e70-8dd2-945a2e640a04", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d457c0-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518643, "uuid": "2f583ec2-fe5a-4d06-a043-c416561f5272", "comment": "Malware payload (Mirai)", "value": "256606755366b42c3640c61c2a433f85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518643, "uuid": "ed34fd84-6ad5-4cc2-b0b7-35381f408227", "comment": "Malware payload (Mirai)", "value": "22cdead66c15bf3eff550429b692c70be0e1741f2522d8e174e81187d57a6512", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518643, "uuid": "ae0453c3-ec71-44bb-9e83-0446fa12af3d", "comment": "Malware payload (Mirai)", "value": "d0bfe57bf81943fc75192ad00b510b6228c1a3a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518643, "uuid": "37cf6423-53c0-40ce-ba4e-69b2c4337c90", "comment": "Malware payload (Mirai)", "value": "d51468928695c197aef29196a34b54d02b0b57814a64a96552f75c00f0ed27bc46393124d8ed381585e0acbd9864fc11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518643, "uuid": "24f2dfac-263c-4b0f-8a1d-b256f1621360", "value": "T1303422281648CC98CB74E6A6413A41D6EF437B40CFF2A58EA527628173F3C4BCB95677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518643, "uuid": "4b588021-aa65-40bd-8646-33bb24f2afec", "value": "6144:wCI2QludsyfeMYinB9pCEgFjJETnCjLJqa4x0F7qQk:bQlqmibpCdFjJETCjL205qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518643, "uuid": "f928afb4-ec4e-49f2-b072-97755f035333", "value": 232780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518643, "uuid": "f6d2d54a-ccd2-4c88-87e4-18f7e6b5c999", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518643, "uuid": "c8d4c400-cbf1-48e6-97bc-abf9e9219401", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fddd8ba2-b2b0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761513369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513369, "uuid": "b5a881ff-ce49-48d5-afda-60a506891e2e", "comment": "Malware payload (Rhadamanthys)", "value": "bac308999ae644415cc57125d0bfa2ad", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513369, "uuid": "54ff51c0-1ae9-4c52-93ef-8fdc74d226e9", "comment": "Malware payload (Rhadamanthys)", "value": "2581798b8a6907e9d92487715c548b645f2a0a0fff8a2de4c4c63fec8f73df8a", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513369, "uuid": "e8321590-57e1-4e92-9428-40ce07e0fc86", "comment": "Malware payload (Rhadamanthys)", "value": "8dc0d4c43b5a7f486373524dd8a93eee10aed5b9", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513369, "uuid": "12cf9c78-4b5f-4126-bec7-5319105d7455", "comment": "Malware payload (Rhadamanthys)", "value": "c3a5e37b1e0377d1262e55e3d39cc16783f9102e1c7a7bb06fde6aa9c20bbf485980d652defc4744e76a80891afa531f", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513369, "uuid": "2ef93256-da36-465f-9164-d9f2ae8fc0a9", "value": "T18A446D4676951CF9EDBBC53DC9424905EB727C5647A0EACF03E00A960F27AE09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513369, "uuid": "93d01f21-8cd6-4c4e-92a3-43b606d6ee82", "value": "7a30bacfd7c73383390074276a42a91f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513369, "uuid": "3eb17b75-61e3-44c2-a184-54d97e8e13ed", "value": "6144:DRVj/uk8lP+8EBs8qUvULYPggufqEmLp8e+dYs:tm0rTvJPgguSEK3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761513369, "uuid": "08a27a27-15c5-46a5-8f9d-70c2cf0a99d4", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761513369, "uuid": "1f1c5ebb-b5f8-4f5c-9f57-16eebdc68a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513369, "uuid": "4a23d3f6-b96a-4130-ae96-f72de5d955b3", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e4c7e4-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499720, "uuid": "e80d1fe3-9365-4393-91e6-039ea8aba6fb", "comment": "Malware payload (Mirai)", "value": "e2ca6557e04e7d2da2d3b378ab65f134", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499720, "uuid": "ac0c834d-62ba-4f47-9414-cc47f138f244", "comment": "Malware payload (Mirai)", "value": "258647802965c914df2282ffbaeb4bddd3ccf0d8ec0e2f24b7099dc23c268352", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499720, "uuid": "f306bf38-8347-450a-a4cc-3e71cfa7b575", "comment": "Malware payload (Mirai)", "value": "081f38c49cd6373f78aa6e37e1c32bd047b369e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499720, "uuid": "30eab079-f611-40e5-887d-8c404e921dfe", "comment": "Malware payload (Mirai)", "value": "f8f5a594013fd84c350ed818f49ff4db5fa894f47d9dec9d774cb98161cdcf6cda95eea221df5fffd0fe80e65588a178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499720, "uuid": "214e052f-7208-4141-be47-caf93a44d14e", "value": "T121A3B71B6E218FBDF26987304BB74E36A79833C627E1D641D19CD5141E6038D682FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499720, "uuid": "b3039567-ef01-4c84-86a3-287ee4aa8aa3", "value": "1536:VF7FNcKcr9dbmkj6Lx5A6jVHeG+qvHHnqDD:2Rj6Lb1jV1+iHmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499720, "uuid": "c525cea2-5811-4339-9832-d3f36d56175a", "value": 106420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499720, "uuid": "1a38da1a-5371-4a61-94e7-699ca62f7b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499720, "uuid": "4f8adba1-8bb1-421c-bf54-ba1f0c7b36c1", "value": "kvariant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ab48a6-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761496360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496360, "uuid": "2d69a599-8a0d-440f-b503-9156c268d664", "comment": "Malware payload (RemcosRAT)", "value": "2b251a2f1a1c6e83916d6a02c63faa4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496360, "uuid": "d5271b11-8e93-42c2-9592-47347cff750a", "comment": "Malware payload (RemcosRAT)", "value": "25945a7fcfb1494f09561984726cd96c8a3940ff94ab683ec15b611f7ca376ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496360, "uuid": "2752bac8-c7c9-421b-ada6-621d010d9d89", "comment": "Malware payload (RemcosRAT)", "value": "32d49111f7f80649cd5fcfbbc321ec8f981d47db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496360, "uuid": "e7ae1431-df68-4da7-9375-32ca6a634924", "comment": "Malware payload (RemcosRAT)", "value": "9249ccd1e47e2ce014b7a9a5b9aa653b7f1bde3e101afcf946121424a21e5c558ef1d4224ce111a5ec2048f8ae52d9e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496360, "uuid": "197ce324-9686-433d-9b59-7f73d8413c04", "value": "T14D75E011EE919C3AF02E3639D81BEAD6551D7FE02A14740E7AFE3E583F396C36416092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496360, "uuid": "4973b21a-51dd-43e3-9e2b-1696354b911f", "value": "85f9f0766eb9a2e132753e8630241bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496360, "uuid": "e422b334-e8c1-481c-86bc-b54314ad14ca", "value": "24576:1XlXEs0szK9diw/WxQwaQBwuUOY6cFpNwBuUwjd2p:1a9W6waQOqY6ImId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496360, "uuid": "875186fb-6a75-4110-849e-85f7c69656f4", "value": 1652224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496360, "uuid": "76e7761b-85fe-485a-ad6a-84e8ec87114a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496360, "uuid": "91bfd561-9d90-4227-99a7-c2e38fbb4af4", "value": "RFQ-2025-01160-CUSTOMIZED EXTRA HEAVY DUTY SDH900-MATERIALS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12373e47-b292-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761500088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500088, "uuid": "dda94d70-a1ff-4ba9-b340-aaf58fcb541c", "comment": "Malware payload (Mirai)", "value": "2757fa3dee5cbd0b743ec8a8ccd7f86e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500088, "uuid": "7058e949-b192-4b93-aa75-52b47f55674b", "comment": "Malware payload (Mirai)", "value": "25a3c26e5901c6dfbebd302e28ca4bf77baa8a5c689ac930ba0be373836fdaf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500088, "uuid": "b3466a7b-b099-4694-9039-964594800a66", "comment": "Malware payload (Mirai)", "value": "9d211505588123f9d02895b3bee502ec276bcb81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500088, "uuid": "9874aabc-4135-4444-a329-b9582b9593fa", "comment": "Malware payload (Mirai)", "value": "f32222111d71d1b06826cbf5756a78c80ec1a383cbf639f8adfbf56e595c1acf628b5734d68da164a60b4c1902a11320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500088, "uuid": "0fa89bc9-09eb-4fd4-b2c0-52028f9b7b87", "value": "T13A931270F07ACDCBBFA1C971D7F24AC523654EECE4FD25E806E486EE50A169509EC409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500088, "uuid": "62768ba4-9ced-46c5-9733-923340234c83", "value": "1536:rllYn+GI5FQ4pRE5VFmT2wV+emYZ9DKZ5LMWoM2cJxIKD53LbejD9:ZlYJUFQ4ElmT2remGk5LMSJxv53LSjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761500088, "uuid": "fd2b1e54-c272-489e-b167-442646adcaac", "value": 88976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761500088, "uuid": "5238d6ad-ee73-43ad-8434-657c872b6511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500088, "uuid": "daa1ddcd-5612-4447-bccd-d8e8042c5eb9", "value": "Orbt.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d6ca14-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761517001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517001, "uuid": "654920f3-f771-45a3-84c3-d6ff4070cd33", "comment": "Malware payload", "value": "cc10491ca203b9239740a8a50d8ea7c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517001, "uuid": "127f410b-8d1f-471f-a1b5-36452543cf97", "comment": "Malware payload", "value": "27fba067e44b58654aad8d6a6c00f15b9626a091ee12cfd60344dc4fed178ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517001, "uuid": "351d3421-8c5b-488e-83ea-11f02a8b0cc3", "comment": "Malware payload", "value": "5803be3b840e4720e1e0ab7107dd45c292a9adfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517001, "uuid": "dd69f272-70e3-4b34-80e3-b4030c522a36", "comment": "Malware payload", "value": "1beb3e6c60908434327db94579ae678acbdaf3c3e82c10b6e708fd3b07027923f96fed814398d84710650aa3fe5ca98a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517001, "uuid": "c9d92f8e-0e93-43fa-ae11-ab0c0cfc615d", "value": "T18DF1811D67F98E3FCAE052347A33874CD5A79BF840E0A3A7158B52FC366451408E9A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517001, "uuid": "ebd2c253-7d8b-4ef1-90bd-7c25bacee791", "value": "96:dl88KsHlTlCl2clFSOcDSA6gl2bS34lJO2xNT5MOwxNG9btDEO95cBzEC5MAtomS:f8RnSNSA7QKcxFkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517001, "uuid": "a2792669-4bd7-4f8f-b0f3-d28d71cb1587", "value": 8060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517001, "uuid": "e4a9d137-8f50-4782-a312-9408c34b978b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517001, "uuid": "c328c43a-fc42-48d8-8913-246373cf36b1", "value": "Cruelty.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0f4ce0-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761497662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497662, "uuid": "45e7915f-587c-44c3-9fa2-978567572310", "comment": "Malware payload (RemcosRAT)", "value": "e47b437c03850cc58b4217bc71059f66", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497662, "uuid": "f1eba9f0-501e-4afc-8316-50a6e36bc18e", "comment": "Malware payload (RemcosRAT)", "value": "29258ce3918dd64f9c36bcec4d356f3b3c7b58b90141d8b14d35d94c42d79be4", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497662, "uuid": "81aaa62b-c4c3-460b-937f-9e9b1860b23a", "comment": "Malware payload (RemcosRAT)", "value": "2a130d9bc390684f67823b444e23c45733d2da9a", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497662, "uuid": "6260112c-afc7-4162-a759-50b8f598316a", "comment": "Malware payload (RemcosRAT)", "value": "fad6c8be433a5899481c182218447d3ab847adfaebec18bc5ab6a549d4b5407477855d9afe923d85033c5915683c76b5", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497662, "uuid": "f5800d08-0683-497c-bdab-c05dd20c6cd7", "value": "T16136161119B70B2CFAD01D6A8D5B6116AA23E7FF0C7D1B5C1893EB254F4B450CAB1AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497662, "uuid": "8948b144-8a8d-4d21-bb97-6899676dc370", "value": "192:5zzzzEzzzzzzkzEzzzzEzEzzzzEzzzzzzkzEzzzzEzzzzzzkzEzzzzEzzzzzzkzO:Sgm8dzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497662, "uuid": "a426b403-5679-4586-aa21-e13825b851a7", "value": 4867520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497662, "uuid": "0db1ad18-595d-4a64-b0b8-91b6ab0c15db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497662, "uuid": "b1749abf-43d8-4bf3-aa54-8ef5766f0e2b", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189c6516-b28e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761498381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498381, "uuid": "25f4ec2b-8c3e-4a65-afc0-26571212136d", "comment": "Malware payload (Mirai)", "value": "8e5c48981b7f22916096cdee3bad0927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498381, "uuid": "c7dddeea-4fb0-48c0-8575-a74c719e1f60", "comment": "Malware payload (Mirai)", "value": "2939d915a832a38ca296649f67f474d373053de9bcb89941baf955e27622756b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498381, "uuid": "6907ad36-584a-4747-b089-b2a16a05cbaf", "comment": "Malware payload (Mirai)", "value": "b6df79bf4c2439a91054ab6f3c7518f12b4fd888", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498381, "uuid": "e75a8761-6261-4fd2-8462-615ec6d69266", "comment": "Malware payload (Mirai)", "value": "50d29afd4be2e683187bd980df68043e952a9462491cd008865f86b5f578fab4730c505579f73cdacab03e4b91af15e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498381, "uuid": "cdaeeb57-cefd-4558-8bac-b6c704c99229", "value": "T1C0C3F19AF62338C1D19206FE64804AC7C39166758BE327480749E7743D7DCFA1BA8ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498381, "uuid": "c20e9a4b-fce7-4f85-845e-9215db15344b", "value": "3072:DBXUlGwL+T5nCBiaAlEtNnFIHznSvlemh+kv2MMTnve:Z5CgaA+tsHznm0kuxTnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761498381, "uuid": "e20ecaae-8343-499d-885a-d98075766607", "value": 119756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761498381, "uuid": "5a987c40-1490-469d-b35b-65b3834c3561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498381, "uuid": "468c69d4-e5b8-4066-9f84-3fb4f4eb0046", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8699cd9-b2c1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761520661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520661, "uuid": "895eb377-8f6c-443c-800c-f940ec5004fa", "comment": "Malware payload (Mirai)", "value": "18bae76dad8d240c4cf1823f49bd5877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520661, "uuid": "c8c93083-3af9-493f-bc7b-ab5d97996e9e", "comment": "Malware payload (Mirai)", "value": "2953d20485129d2597d9db9892c2c88f4b3b2de548430b2ff7a86ce16a317cc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520661, "uuid": "a29405f4-a51c-48b1-84bb-8f9a2130a908", "comment": "Malware payload (Mirai)", "value": "f761a739292a405a32369dcc52b68b729c542031", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520661, "uuid": "52e1b2c3-5160-4899-8504-c731c79ca7f6", "comment": "Malware payload (Mirai)", "value": "d5603992c7249d885601dca5f08f0d830f4764527883b60f74fc9cce08194cd94b5e506fb7a465c7e57c7271ab6e7b64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520661, "uuid": "3b75c815-fe47-4ac4-b8c3-113543071e8b", "value": "T1B2043B46EB415B13C4D32B76BA9B424133239B64D3EB73064928BFB43F867AE0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520661, "uuid": "c625514e-77bd-4e75-8113-267464335c02", "value": "3072:5SfQClbG+agh3AmwatTo7DGpoTD9Kwrh9Dnzmw9nCM/M/9YF3fCH:3Cw+nVlwaFo7DGpGD9KM9rzF9nCAM/9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761520661, "uuid": "d8143112-8abe-4408-8ae1-5b88c88f40f7", "value": 177692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761520661, "uuid": "19a423d6-e829-43c7-beb7-5e96a91139c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520661, "uuid": "46a68d15-a51b-462f-a049-dc963c203c69", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463b4528-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761516926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516926, "uuid": "6d0d7632-cf91-4aad-a13c-9d2218238b33", "comment": "Malware payload (CoinMiner)", "value": "7fe370b603670211186cd199f5dfe524", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516926, "uuid": "9a1183b7-3838-48d5-8109-4a1ca9d100d8", "comment": "Malware payload (CoinMiner)", "value": "2a40ec0c40986aff7080ef66354d9029451e83101df44c63c0b526812c0a5598", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516926, "uuid": "92536de1-9f10-4746-bbc7-3e61a4352a57", "comment": "Malware payload (CoinMiner)", "value": "d5a692c0595ebcebca818e9578406e84cb9371d9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516926, "uuid": "f2aca40c-8d6a-40c8-9a4a-0aaa134aff61", "comment": "Malware payload (CoinMiner)", "value": "ad3c9bff3fc9b1911027740aa918524f1ceb6d3696136809836ac0adeaeabeca204b82ad059fc4fd2572ffd3ddab1d93", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516926, "uuid": "5b17279e-d788-486f-840e-0dd8b5f7eef4", "value": "T1476633071DE11EC3C7BC1F382E89C7ABA7062873F865AA2EF51A5EB10DC511DA34D1A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516926, "uuid": "7b11cad9-ce39-4934-880f-2786363037a8", "value": "b0aaff043a1fcfcfba870e1aa833a37f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516926, "uuid": "f0d25d18-1eb6-4a45-aaf7-265232c1ad0a", "value": "196608:1NHtAvNawev6ButgHuT8jazwOG5QOjAzhI49+f0cOT:DtAvNLbulT8Gz5y4ocL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516926, "uuid": "377972a2-0d07-46e8-a823-fee8c274a3a8", "value": 6718992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516926, "uuid": "d8bc42f8-4db3-4d6e-8b3f-7f8242a96596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516926, "uuid": "96ad24e9-4fa3-46d1-86b3-9af31cc877b3", "value": "fbxzsnvq_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33f5242-b294-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761501298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761501298, "uuid": "44a33994-4693-429a-8499-a513606b1773", "comment": "Malware payload (Mirai)", "value": "a0b1193e7ebb5635e5e9d11119656728", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761501298, "uuid": "f87091b1-407c-4ed0-909f-1e764ee01920", "comment": "Malware payload (Mirai)", "value": "2a5c133a58c574c62951aba43ead8b7fbde2e40bd64e8d54b59b3c934181502b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761501298, "uuid": "c1dcbce4-ba73-445d-aef1-f606bc7d93bc", "comment": "Malware payload (Mirai)", "value": "d75deaa4ec077386300afb898782d318a26a5967", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761501298, "uuid": "dbfb0965-72d6-4615-b1aa-a649e248102b", "comment": "Malware payload (Mirai)", "value": "80146e4419e498e77f00f1eb2d8fff48f985e9819731b6b8a14525e1b44dd9ff31b8f23ae240ae709ddd40adbbc3b3b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761501298, "uuid": "64de9d1e-b448-40be-aff9-cc33288525be", "value": "T1BF834B01B30C0A43D1676EB43E3F23D7C7AEB5D022B4E68D650F9A8991B2D32554AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761501298, "uuid": "066a5fa2-c758-4212-8bde-1ca0f22bf352", "value": "1536:bYHf74JW8BGt53MpfsaP0iv5d8FIaATfUD3q+D7/1em/JZ:E/7l8BGv3GB5d8FjAKzJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761501298, "uuid": "7b211d88-199c-42f4-ae59-15fda0f1cfe7", "value": 85192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761501298, "uuid": "a24b8a12-2edc-4102-b622-43ad01989091", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761501298, "uuid": "670f7480-479f-4e66-b7c8-8a3231243ceb", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11c9ca0-b225-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761453594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453594, "uuid": "6f905a9d-f8de-4187-829c-81f77152e265", "comment": "Malware payload", "value": "083d31aabd92f2bcd0d03797a7b9f14f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453594, "uuid": "2a3f96b8-d9fc-4ddc-8c70-cebbbef67c7d", "comment": "Malware payload", "value": "2a7b4abd2bd0523e6754aa1fa3dbc3caf83384faddb1ee55587a88fb14730329", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453594, "uuid": "e7fb8e59-75d4-4ea2-a117-63cd3c9cf025", "comment": "Malware payload", "value": "b25f3eba3d3e7e7ef7b41f0d5e9f305b3edfc4f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453594, "uuid": "a6929f02-30dd-43cb-85e0-bfda245616ac", "comment": "Malware payload", "value": "9369810168e6bc1e2d5494957d077cad451720bcc82380f804cb8f09c28dcedf07ca33d95db42ca1280d1c539ff3a424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453594, "uuid": "efa1dbeb-d738-4872-83c5-98cda0ccbe20", "value": "T111430261A174498EF1166F3597ACE30317F6731431A9839B287CB94532B498BECADFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453594, "uuid": "78750648-3e79-4b20-96cb-63cc12fc2e67", "value": "1536:Xoi0PDjyDNBNDDgkDgLjHbxJEKhjtLUajAQl:4i+yDhDUjHbxJEKJNVkQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761453594, "uuid": "8bc68566-ae0e-43a3-b4a7-07343cd54ad4", "value": 56056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761453594, "uuid": "400eb3b1-21ff-4006-849f-efc932172083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453594, "uuid": "3ef96a91-3209-430a-bfef-742576b9753e", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646903cb-b287-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761495502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495502, "uuid": "d607c627-c6e0-425a-a33d-4131c1c30c9f", "comment": "Malware payload (Mirai)", "value": "667d2335076c43fb3848822242bed00d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495502, "uuid": "5172545b-b76a-4785-95e4-0d2eb1dcf4a4", "comment": "Malware payload (Mirai)", "value": "2b71a641cd22b7ca6c5cc48a926c932bb7a2cb2c6b7c1671a0c5c25cb071d57a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495502, "uuid": "b6ce91e3-d928-4c9a-a1a7-f79899c1ce0e", "comment": "Malware payload (Mirai)", "value": "431e14f14298ec4b2430f13173687b08e2b4e702", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495502, "uuid": "6e209922-5607-43a4-b866-62af2c67f120", "comment": "Malware payload (Mirai)", "value": "38cd4915de3e04432455370e9b0f016f9871266c389935edf25c675eb85c1052e78d775af70fafc8d577728ac5a1f73c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495502, "uuid": "4ef9cf08-0c97-4230-a038-262a4c2682f7", "value": "T1970429CBF800EDBEF80AE7774C530806B130A7B254925A337257796BE93A1E50567F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495502, "uuid": "978741b3-3e18-4d5c-a0e4-11e64843639c", "value": "3072:t3prOZ7+EwVQlX1JiLaT+Qp7hjnym1QNTIN/17FHqW9yZAZsVKjbijLDQe20x2m:t3IZ7+38JxzymCNTIT7FJkAZALDQAxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495502, "uuid": "6bcfb6f5-ce88-4a4a-909b-adb03ffb5296", "value": 188576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495502, "uuid": "5d085fc6-3c99-44ae-a8ff-11505c5c2aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495502, "uuid": "2d1f1027-303b-45c3-a342-d94daf0b5458", "value": "Orbt.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c390e6c7-b2c4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761521861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521861, "uuid": "2f2bf3b1-5395-4e34-9de3-5498d5cb3413", "comment": "Malware payload (Mirai)", "value": "d3cf8fbfc2a00532e281a20b4006012c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521861, "uuid": "81924e44-8c33-4869-bbe2-01bef06683ff", "comment": "Malware payload (Mirai)", "value": "2bb4336e3bf740fe1f92d7d9ad86bdf4221f0acaa26582ce271e49712d6948a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521861, "uuid": "5737d709-7fc8-40a5-88d9-247149a8f749", "comment": "Malware payload (Mirai)", "value": "5ca7a3689618760692decddf879c8e4ae0d08077", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521861, "uuid": "1a951d5b-46f1-4092-bbb5-c3528860092c", "comment": "Malware payload (Mirai)", "value": "f0d00ca97253b16dd40c16cacd3a6aca6c2ca8ac963e152307db23a4f902fdbd29ec7d4beedddfa354697e439174dfb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521861, "uuid": "0308757b-bd30-4496-b621-b14020f7ecb0", "value": "T159D3AEDB728B5951C46146F00BC78F8E3F6332118E5BC9FB6D0DA63E28761DB590A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521861, "uuid": "e1af06d2-8925-4972-b587-9cc5af3908c7", "value": "1536:Gr5tI8nc8ml7pCU26DQuhb56veLwMHJZYXlLf4lXfx/xqrOEgNnn/LWZ:q5nchl7MgQAtBwMHeGlXurOEgNnnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761521861, "uuid": "9ca6e98e-5ef1-4124-9805-7fc628f37c9a", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761521861, "uuid": "e9702dec-1d96-4f03-8c39-7b508f9bdbba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521861, "uuid": "0b0866a7-0aa1-47d8-98af-1edb7e079417", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c917e03-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761496428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496428, "uuid": "e6925420-9204-4651-8dc7-d21284c90b46", "comment": "Malware payload (Mirai)", "value": "2f60e6a007f4314eb0d75f1ac60385ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496428, "uuid": "945c4a80-cdce-498e-8c42-7b72ececeb19", "comment": "Malware payload (Mirai)", "value": "2bbee07cbcf1b2fb7b241793fbde2a36a366a8db594507363d0f06931b303147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496428, "uuid": "8039d4cb-613a-4213-802a-8468b9474053", "comment": "Malware payload (Mirai)", "value": "463098c90d1f54340963f0aac2b6141791824aa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496428, "uuid": "3897674f-9860-4e70-9520-44da6f90a3cb", "comment": "Malware payload (Mirai)", "value": "6fa5184e0ed02e8c6d25a05e5a52e87fef9f85c96b312edfba78508f5ebd58b1077c46a6cbf50687469937f21fe41f3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496428, "uuid": "e822ff89-6f6a-45cf-8aa7-d9b748053030", "value": "T1A224E70AABA10EFBE8AFCD3706ED0B0124CC552721A87F797274D518F54A64B59E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496428, "uuid": "32367556-2c09-43d7-afae-dbb2aa508a09", "value": "3072:oil5bcdWLTo3075vOr2wvxo66E9wTOkHYLJ5heWkbzxTfK6:oiPbcdWLTo307m2wr6GAOvJCt3xTfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496428, "uuid": "dc9acb74-d808-41e8-b569-a0c92cb455dd", "value": 227476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496428, "uuid": "4891ce4d-35d0-4b04-b299-2ab367072aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496428, "uuid": "292e014c-3834-494b-8ff8-e429a6ff9b01", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490d5070-b27a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761489872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761489872, "uuid": "2fdb7fab-9035-4ecb-9c33-e5c80edbe83d", "comment": "Malware payload", "value": "969f054044ef65d87fc63baa693f26e6", "object_relation": "md5", "Tag": [ { "name": "BHWareStealer", "colour": "#FCD9F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761489872, "uuid": "abbc4185-ec2f-4dc5-864a-592745cce766", "comment": "Malware payload", "value": "2c64a1b9a4556e4ea7324dde53318f32f0a07d7ae31c370f737a72645833ec26", "object_relation": "sha256", "Tag": [ { "name": "BHWareStealer", "colour": "#FCD9F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761489872, "uuid": "59d501b2-3731-4817-961f-4c1b080d6bbd", "comment": "Malware payload", "value": "f15b0655f78df28a2b00abbb9cda3460032a8f78", "object_relation": "sha1", "Tag": [ { "name": "BHWareStealer", "colour": "#FCD9F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761489872, "uuid": "c36f2e7e-b8ee-4c40-8ed2-5aa12b77abc4", "comment": "Malware payload", "value": "8eaee54ee134597d2563db5ca79dc8c50a24a74381ff3019f5b2c3975f2d8eb69ffa0e66df90ab217f736e22a01677c6", "object_relation": "sha3-384", "Tag": [ { "name": "BHWareStealer", "colour": "#FCD9F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761489872, "uuid": "4f24adf8-dea0-494f-9895-53a1fce724de", "value": "T1D4187D5263A609D6F9F79A348AE65213DA33BC067F3082DF324C17661F736E04976B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761489872, "uuid": "f43ffb64-9e8c-449e-9caf-1927c8bef4ea", "value": "764090509664248d5254caeebe1e7af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761489872, "uuid": "4be31023-2e0b-400e-a9af-415984d59df2", "value": "393216:49FZH1IL4xeG3pkiJzZstF9dmQQu+iOwUiTZI7FrKNx+4AshdaXmc+7jy464j1i6:4ZH1RHugrIjdIDVNQr8FyRhYpgPVlcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761489872, "uuid": "20f28aff-d4b7-4278-aa11-ab20faf88447", "value": 86102016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761489872, "uuid": "461f2e76-5e61-48c8-8843-388bf5eafca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761489872, "uuid": "4fd185ed-21b3-4399-8d9e-9d1c8bf4483a", "value": "RPReplaySextapeleak2025_mymleakfullvid.mp4 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b072004-b223-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761452456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452456, "uuid": "c0314e7a-f0e3-448a-a0fc-76bda7edc6cc", "comment": "Malware payload (Mirai)", "value": "a952db8f79a15af68d9d39f37a1b7877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452456, "uuid": "f3775335-726c-4918-a8c4-e65f6e7503dd", "comment": "Malware payload (Mirai)", "value": "2cfae3dffa973d69607fa57bff6659758ae02ae9eb165f99436d303df69ec1c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452456, "uuid": "e83eeba4-e9ce-42ac-9b36-ce81c8e96f2a", "comment": "Malware payload (Mirai)", "value": "675155600c9279d60ee75c84237cdf9c563bea26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452456, "uuid": "f0867797-1fd5-4872-8d56-e987d121fe9d", "comment": "Malware payload (Mirai)", "value": "bba103747e034d7432af69991f79853b072cab412f0fbab17d37b2636eb9122ed8e66c58adcfc8ddf31514ffeccbd48f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452456, "uuid": "6b487406-40c1-4ecc-962e-cf1b4e6c6d02", "value": "T1F1144A2BB3C39CD6D51063304C306362776FC7041968EBFFDA1A3794AA97B225A246C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452456, "uuid": "c646becb-a24a-4e30-b27c-6bdc8cc4723c", "value": "3072:qaGQ2rLbzwRJj6XxGWLX6exXt7IKZ5tQ:Xl2rLbz/RLHx97IKTtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761452456, "uuid": "85ba2a77-1226-4e65-82c4-05a85a9f9ccf", "value": 197592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761452456, "uuid": "f57a2284-7bec-4765-9e28-d61045005fb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452456, "uuid": "f9b62070-7a00-4e58-80d8-037bb41facf9", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9eac4fd-b2ad-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761511939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761511939, "uuid": "de690aba-ae1c-41b7-9d5d-a8822f21acc0", "comment": "Malware payload", "value": "3fb8f3b0431e4153b2eb9a90a66558ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761511939, "uuid": "774e459b-61dd-4570-8891-eac44a07cc4e", "comment": "Malware payload", "value": "2e11475c281ff7046bc6fb181b50ae740ff38b8a4105c5e7c670f35862f274e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761511939, "uuid": "a92316a9-c6c3-424a-97df-e3716cc43c7f", "comment": "Malware payload", "value": "5f7a07cb54e2b65e6f544fe260e5bfa44d9733f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761511939, "uuid": "b59c78d2-ed0f-4d05-a3b1-98931d980a9a", "comment": "Malware payload", "value": "e86e1cb2c6346520a901a187e05497f4f796273b8d723511ebe634851bb1dbc5f05478b99b8848d3c000df667413c492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761511939, "uuid": "ae439704-2aa7-4bcb-9b38-955ca91c9987", "value": "T1DE056BC1B63DAC76A4B02D5798B0070C0FAF03B1852B9381B8F755EB5659DA286F07F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761511939, "uuid": "6fd3a316-3f8e-4701-8149-ba9c2dfdaa12", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761511939, "uuid": "72d05c75-ff8c-4f6f-be57-8990fda76146", "value": "12288:zyaqSUrcF87ENQZ/LkIHi4T/svUAPkXxbgVsK423GL4QC+:zlDUX7ENQZwILTkvUAPkXdgVr4pzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761511939, "uuid": "65bfd3a6-ac13-43c6-af6a-93ce2a25d633", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761511939, "uuid": "347ea255-b5b8-483c-b373-08e3291acc98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761511939, "uuid": "30c92436-3ff0-49fc-ba5e-410359bf0326", "value": "LithiumAim.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69ec921-b27f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761492177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492177, "uuid": "7f830925-84c0-4851-af42-8f192eefaf97", "comment": "Malware payload", "value": "229a2d5ef40ce0d3c869d62c3cb375bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492177, "uuid": "103db334-bd8d-4a85-9abd-da78642f1e70", "comment": "Malware payload", "value": "2f192122163ffff5ef10146a363b8d4cefcfb6fe544366b5bbbef1cf00b13ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492177, "uuid": "bcc8e4ee-a39a-4844-ae1f-8ad700edc452", "comment": "Malware payload", "value": "1e5cc6bbbaeee273abdc6775788c227642fe2957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492177, "uuid": "040bffaa-e34f-41fb-ae6b-747ef4c609d0", "comment": "Malware payload", "value": "8f8aa148a3c3d49fe03ae21695e996aea44332c4c4051e41375246249fda47eea486d059b332dc8eea0d4857118189c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492177, "uuid": "963f317d-78b5-4c74-a014-7282e3f2c5c6", "value": "T1A307332C96B408B7F4F7973F9897D918D620AEB51FE3C68B03F8516A2E235C15439E60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492177, "uuid": "57330896-89c5-4548-8be3-8cbcd8c262ad", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492177, "uuid": "4c44597e-8e49-4bc1-b89f-8c197138bf94", "value": "393216:d3io/2y+1r1R2JtWNhqKVZXMCHWUjlVg74wF5zfoPSuFjJF7fd0:d3ypR2JtEhqKVZXMb8PDwF5zAPS477F0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761492177, "uuid": "93d549b3-3e4e-4d88-ad10-46a63c3e2f25", "value": 17491461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761492177, "uuid": "bb64cd3a-a32f-40e2-b556-860531e6781b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492177, "uuid": "59a1bdee-d998-458d-b4b3-25de55b22532", "value": "boostbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735bf1b9-b28a-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1761496815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496815, "uuid": "7850d72c-2008-45c6-be97-457fe1c25e69", "comment": "Malware payload (njrat)", "value": "0af429ecd7f93f0b81360c48bd4bd7b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496815, "uuid": "0ccd4bd8-38c6-40e5-b028-17457357033c", "comment": "Malware payload (njrat)", "value": "2f291eb67cbc8afd88280ca55e6986398defe0d76784356e3f6a51882cf282aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496815, "uuid": "d466dba7-0581-4bfb-9e50-9dd7babe0539", "comment": "Malware payload (njrat)", "value": "5978703a73e3c5b75c0677b3e9877918d75417ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496815, "uuid": "9b1a51ae-79ad-4574-a402-924f068e0346", "comment": "Malware payload (njrat)", "value": "2ea4d816183a8a65fee1dc64a733a91317231b256297d4391221092a999aabe3702b77eeae9c42d34f61e4cd3bc81a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496815, "uuid": "78f2f92e-6cf1-4da3-8462-ad51213e52c9", "value": "T116432844BFEA4A01E2BD8F3469F655150A34BA63E932EB1F48D168DB53327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496815, "uuid": "a24a25ab-5ee0-4be8-b028-f2c14be9fa3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496815, "uuid": "5ac7cef1-d043-47a9-86a0-4cd909048492", "value": "1536:iWv4Dnpe/NoTcwiDESPDywsNMDiXExI3pmZtm:54Dn8ymDRPDywsNMDiXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496815, "uuid": "8eb8f811-0b73-43b1-a0bc-0e27b6001e1b", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496815, "uuid": "7df6354e-f606-4730-9593-89c13d20a2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496815, "uuid": "39cfe1c6-ff9e-43fb-bfe2-0ddd2612e06e", "value": "df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dcc5aab-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516643, "uuid": "b91a30fe-7307-4aba-9571-62d42bc7c257", "comment": "Malware payload", "value": "283eff1a5efbcf9489d087fe1e12feac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516643, "uuid": "41e2e767-eaaf-47a3-b2fc-73e5d77e3c5c", "comment": "Malware payload", "value": "3051602640dbd3e326ea63062e9c03b465377c4dfe19cff88e5c32a19b891ea5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516643, "uuid": "df9f6795-e1e2-49dd-8882-93202227b08a", "comment": "Malware payload", "value": "efaa96282faf274e1697a7e9a3cc25bab2419fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516643, "uuid": "56a81221-cd17-4799-a6e9-19ee53d585a8", "comment": "Malware payload", "value": "5893bccba5ec0265224bcfa254b47bbda49411c1b827d27581738143ab6406dfe831c2dadb41f27395b01f7b54419ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516643, "uuid": "349bdeb4-a1b5-4995-a0b3-850fcb74fc59", "value": "T10B167A2C31FC925EDDE1E036DEC4A97295ED085DBE4041CADBB571303A7B8E34A4C5AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516643, "uuid": "08a138e7-49d2-4878-97bb-8bea96d36538", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516643, "uuid": "c87cd634-369a-48f0-87f9-77180b47eff6", "value": "49152:g6gRgYrAII2a6Yaqyv5GSPooFnanW1bk+EDhYqG3zznFJROD3dYIuuuu:g6gZc+a6Ya/vIjohpkxuzXFWjGIuuuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516643, "uuid": "7cd9f793-0579-4458-8cc0-4503952ee2df", "value": 4069376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516643, "uuid": "d5152b55-5f11-47ca-bb91-35c8ebbf9361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516643, "uuid": "978aeeca-6973-4199-b78c-2b5a4a88135c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59310d4c-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761497631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497631, "uuid": "f607f907-e657-4f56-8c9d-a93cebf3ec91", "comment": "Malware payload (RemcosRAT)", "value": "89ff11f1005b5b90c3619bb972f81f4c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497631, "uuid": "d0b1a04a-d9b1-4b60-ad53-a60efa2ff34c", "comment": "Malware payload (RemcosRAT)", "value": "305e8cf66668a19599e9e03a5f32d00a524fb45a4385c28978d3713de9cca6c3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497631, "uuid": "1d70b7b0-d9a7-4647-a6d0-94b7b61012fc", "comment": "Malware payload (RemcosRAT)", "value": "90caba4c5109b0861e7ff6839aa47177b1ab006e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497631, "uuid": "57391d72-acc0-4df2-b834-f8cbef88729e", "comment": "Malware payload (RemcosRAT)", "value": "9c6f1279cfb925cf6dd1f5e5dd92c9782db21edd7b7a5748e48e10d43ed57b0786b9ba7886d297c0fc9892e4623c330a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497631, "uuid": "fef14641-077a-4849-bb5f-0a933d801559", "value": "T1F6D2E83AC854AFF00B2F60A69D0B2D5945594326BA743A0D75CE99AC3F35321CFD81EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497631, "uuid": "ee4c7004-99d2-4c2b-a77d-ba7561fc8d2a", "value": "384:Kc4UGDa5EG1oH03kkmW9ZlYs8TB8juVCV6ShnqPVAjwH2ru97P1ufvxyntTACBRP:K97qtqH03kPf9qju0jqP2drzeAA5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497631, "uuid": "e8f3f44e-c932-4596-aec6-a01a0772b042", "value": 28416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497631, "uuid": "9d6e0f71-982e-480d-839f-34e3b8a896cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497631, "uuid": "13193e0e-abd4-4fd3-98ef-220180c23e0e", "value": "ss2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ea30df-b239-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761462210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462210, "uuid": "bf32a86f-811d-410d-977e-d632caa067d4", "comment": "Malware payload", "value": "952f86861feeaf9821685cc203d67004", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462210, "uuid": "c1ce7667-f21b-49cd-b88c-5128c9a72504", "comment": "Malware payload", "value": "30a5df544f4a838f9c7ce34377ed2668e0ba22cc39d1e26b303781153808a2c4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462210, "uuid": "efe1a150-cf7a-4423-a8b4-693836992706", "comment": "Malware payload", "value": "93456edf6e375e53bac0c93244eec815f7f3d034", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462210, "uuid": "de76385c-17b2-46f3-8ff6-7e09729bd243", "comment": "Malware payload", "value": "c62eafb4ef1a874d2eb0d420f960af3bb10c770562eb817ab27da9e0393db1e99b43dcd738d1e21342b951c365bd4388", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462210, "uuid": "2e6a20fc-efab-4211-b6f7-a07543c14022", "value": "T1D99633D005E0FBE3BA13EDD0566DF360608FD95B97A20905F85ECA40F8265F842B6B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462210, "uuid": "8c5ad472-00e6-49f0-940e-46003ab94b98", "value": "196608:J0YISzTw8TxZ59/JVZkgAtFUSpC+ODIuHr911me+OJB:JrISvw8zfhM3UOFGIuL9118Ov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761462210, "uuid": "852fe544-ca90-472c-8b84-adc81fa02603", "value": 8760314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761462210, "uuid": "51bc7da5-aa31-47c9-a4b8-bc0d52423fd3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462210, "uuid": "a88aeb52-0256-458c-921c-fb58068a812b", "value": "\u0422\u041b\u0413 \u043d\u0430 \u0443\u0431\u044b\u0442\u0438\u0435 \u043d\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0443.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad61c71-b290-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499539, "uuid": "d4187ad8-fca8-4c81-9641-7f4fe55b4271", "comment": "Malware payload (Mirai)", "value": "155d2abc47cae44c7b2ba97341265385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499539, "uuid": "4ee1f57e-3c7a-4411-b440-f02cbbeb443a", "comment": "Malware payload (Mirai)", "value": "313f7d86508ca0b02ea41d17a66ce728b3e5f04dc803aeedd078ba4667f71d8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499539, "uuid": "7548c7b1-398d-4f40-92cd-0813088892a3", "comment": "Malware payload (Mirai)", "value": "7eaaaa9441e33b1204491cafa4f82c0fb96c1ad5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499539, "uuid": "e7f5fd32-d106-4193-9eea-dc990e9b3748", "comment": "Malware payload (Mirai)", "value": "5b4ee1cbc95c9c12f73a20821283b7808dbe7562acb61e52a25632f1f6ed154636add54f00216d09ad22fe6c06a0232f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499539, "uuid": "ed1565fb-bca2-423e-b20c-8dc7cb6aa1c2", "value": "T17B833955FD429A13C6C1217BFB1E028D7B6717A8D3EE72439E269F21738A52B0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499539, "uuid": "84177eab-73d1-490d-8058-646c0c76b2c5", "value": "1536:Yg/Q7wOhHt/JMbayDj15NjTKXQfkMwhFvqgemf:Y+Q0Or/JkRp5Nj0usR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499539, "uuid": "d188ede0-141a-4883-9711-68f454fead26", "value": 85768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499539, "uuid": "1d763331-e47f-4e93-9b31-ae14c797af4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499539, "uuid": "7b4a5bec-3819-46af-a422-9c85b1ff1a20", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a4d380-b222-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761452279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452279, "uuid": "00def690-291b-436d-8390-2d6c029a6e4e", "comment": "Malware payload (Mirai)", "value": "5eef30ad16c857fae0ba21819caeccd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452279, "uuid": "aa21142b-7300-462a-9625-56f5fb4f08e4", "comment": "Malware payload (Mirai)", "value": "31b49b7f11276d9f390bd221cac81ff7bb3c0804df440afbc811416ae14deb7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452279, "uuid": "220dd73c-3f8d-4831-a703-a3ac4c64343d", "comment": "Malware payload (Mirai)", "value": "73e54aef95c245b52fdf5794cadda70b3ce03951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452279, "uuid": "7d442e25-c48c-41d2-bde3-3622176cb2aa", "comment": "Malware payload (Mirai)", "value": "850fe4ea73eff53fd532c1e6a6b3e38c5e34e19f43b71b6f9e9a7e579e9bda7cd4b992ddc80ba35e88cd8217ed2b4f50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452279, "uuid": "18176e40-3ad0-406c-9862-9decc7a419d8", "value": "T188F3392F3581C2F0FA411B746BCBD3976C690BBF109990DF5B516729B6E0A7BA02C487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452279, "uuid": "aa7e1084-7d60-4824-8364-7fb9a52d2e84", "value": "3072:dTWeXv97lPBx21K317zdpx6LAOsNSvEuE5RNRqOrLT55UcUVz:tJDxeIzd6H+S8uijR3LT5eNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761452279, "uuid": "1c592101-feda-43ea-8e1d-82ad03e8afac", "value": 164564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761452279, "uuid": "d8bacb48-648a-4bcb-bb30-da3aef4098e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452279, "uuid": "58f63348-eea6-47cd-8a37-66142212b573", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6570d9d-b27e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761491801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491801, "uuid": "6385e339-dbed-4d06-923c-0ab43f6e69f1", "comment": "Malware payload (Mirai)", "value": "e952fdab32948a1b3d0f4d0164c5c130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491801, "uuid": "35ff2969-bf3b-4290-a09b-2214743d1f74", "comment": "Malware payload (Mirai)", "value": "3419fd40ff4565ccd6216a007bbf0218f6464aaded9741fae9cb9fbf5f1dfd27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491801, "uuid": "8da53064-20a8-4446-b58e-3a92ca259cc2", "comment": "Malware payload (Mirai)", "value": "9d81e7347909800b69a9e6f129a0297c4008635c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491801, "uuid": "2cbfd32a-df28-4d39-ae30-450b31e53004", "comment": "Malware payload (Mirai)", "value": "a9550931e4bcb94bafc6baf0a3c18786cfafc7927a0bf5ef0208d8bde633c4751c930a327a1557ff096749c907788094", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491801, "uuid": "8f01d6bf-06d7-4cd7-8773-2901bdc41dec", "value": "T180B309067FA11EB7DC4BCE3B05DE1B11188CE92B37936B26B238DD68794B24E15D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491801, "uuid": "7957ddb6-f3cd-4934-9f84-767a136befc9", "value": "3072:WR8D8ccKzWzoYzoIXGmT9kxnuQoxILiLRYB:jwmzWzNzo8axnu6LidYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761491801, "uuid": "863e6078-201f-415b-8471-5cecac7c4ef5", "value": 117219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761491801, "uuid": "35c0675e-54f4-4bad-b122-8b75a34d194a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491801, "uuid": "23137212-e881-43aa-bd45-afb7eac53774", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01cba3e-b2c3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761521506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521506, "uuid": "6879ec4b-4d54-4398-a2d4-4d86e5ab0ba2", "comment": "Malware payload (Mirai)", "value": "4abd8c88f54cfa1db75262d5879fb89d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521506, "uuid": "12c99e12-a9fc-47bb-ad53-436fc384b996", "comment": "Malware payload (Mirai)", "value": "34abc66c712d2b91a85ee87f4af87f3588f30cfe7c323171e236ae057cac443b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521506, "uuid": "98ac79d9-c47c-4aa4-bed1-4f49d976ccf6", "comment": "Malware payload (Mirai)", "value": "3a15025d2107215e31a48c9c3cb9416037cec3ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521506, "uuid": "36c577fd-8054-4635-afc7-53839f983795", "comment": "Malware payload (Mirai)", "value": "7d7974b8374cdf7d5a1011c75ff2966094d31ba44ed29d501044088bc3f0f6a07caf12476cf866ce6c2f19c385a71630", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521506, "uuid": "7894551a-0179-4b05-80c8-c932ce88195b", "value": "T157B2D030125394A0C531E03CAED892D3BA560ABDE0FD36624D55CDAC96CA44F2ABD7DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521506, "uuid": "9995ae79-f68b-47bf-8de6-0fbd233ed704", "value": "384:uBZ/sS5QPeoPgkS03tg9yxwOysbZLhHZ2WJDiQV6iQYFIfi6fFhymdGUop5hNAs:uL/aPtPgJMtgQxvZVHZR16iQYFSfFs3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761521506, "uuid": "f2fee2c6-abe2-44bd-9bdf-2f438459ec71", "value": 23424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761521506, "uuid": "24321e31-8a36-4fe3-aa88-075d02d8d0fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521506, "uuid": "5460c744-5937-4bee-a52b-fbd132e33edd", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a4cb73-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469363, "uuid": "976dcd0c-9921-4069-9350-90c36e0e7d03", "comment": "Malware payload (Mirai)", "value": "5f266a7743c23f43f5f5ca2f291cabc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469363, "uuid": "5d9c899e-6fd5-4568-9ff8-148a97943b3b", "comment": "Malware payload (Mirai)", "value": "357b9152952233865f10a8a50d9c7f0e9ea1a09be783e4eee72f36743efcaa13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469363, "uuid": "c76b3276-47d9-4ac9-aa73-69cc3fbd6e41", "comment": "Malware payload (Mirai)", "value": "1c674d2b6c5a1e8ee71a11679e10d6ce381b6d05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469363, "uuid": "0522b01e-0cee-444c-8c7c-8678cb886390", "comment": "Malware payload (Mirai)", "value": "6e22d357419c748c0a8ee8bd1cb8f1dcb8dcff9ac05c83e5910012237c21c291a5569fcc81d26abb6a6fcb9af95efb1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469363, "uuid": "a95123f4-422c-4003-bc13-f90c1dde5dee", "value": "T1D1F34A56FA414F13C0C6177ABA9F424A33239794D3EB730699187FB43F8669E0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469363, "uuid": "48ecca57-45f5-45f1-9b08-a6fac1429a5d", "value": "3072:hcloB4DnIyGGCDG2a2Awjo7DA3TA9Aw1YSwbZn5R6Bh7M/9C8rs3b:ul/JrWG2a2Awjo7DiTAxLwR5R6BNM/96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469363, "uuid": "760d949f-0e15-479d-9ec7-2285f5e9508d", "value": 168445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469363, "uuid": "a4c30c7d-6bed-4c8e-b392-955948347c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469363, "uuid": "d4716f03-f376-436b-b78b-e29f8d71abdc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa7ca4e-b277-11f0-91c6-42010a9c0006", "comment": "Malware payload (UmbralStealer)", "timestamp": 1761488855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488855, "uuid": "f6a2d15f-0ef9-4cf4-9032-16e3e3e99f07", "comment": "Malware payload (UmbralStealer)", "value": "35894a20979ce5857358f1c10fcf62d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488855, "uuid": "4e0a4bc3-f594-4197-8784-3375239a5db7", "comment": "Malware payload (UmbralStealer)", "value": "368f5be040c57be5388379a9c6ebbd15ba83ddb47ee79629b71a94463be4b724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488855, "uuid": "98dc95f7-e505-4abf-a01f-fce9118dc508", "comment": "Malware payload (UmbralStealer)", "value": "97baea29b9c3dc8869dbc133ab2e3d5fa6a847c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488855, "uuid": "8f2b1834-df25-4dcb-97a4-5559cf2ca181", "comment": "Malware payload (UmbralStealer)", "value": "a14783dd2fe58959190295a501a9619932a5a4a2cad3b235f257c7a7726e309a41ec1dc9b99b96bfe5068ecd9873699e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UmbralStealer", "colour": "#187523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488855, "uuid": "1a911595-3f94-4e88-84ab-416ad4c4049c", "value": "T1FCD622E918C162F0D0D74600B18793AE74C06AAC86FC5E197DD26D431F52EAE394EBE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488855, "uuid": "d19daa04-33f7-4232-ae3c-419066465cd7", "value": "fece19de17501dca4633029f647de136", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488855, "uuid": "cf9b295f-08b1-4997-bbcf-3c561f65d241", "value": "196608:Vc422Ym8V3DOLbn5Zn4rzw4hGS0muIz8Kzc4LHCOS2K:Vq2IV3q3Dn4g4hGSluMqCHdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761488855, "uuid": "f3873da5-168c-42f3-a19e-d34cb8cf5471", "value": 13081088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761488855, "uuid": "6e5f3c62-cddc-4167-ad17-5d0a8caa91ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488855, "uuid": "f1144a31-7e89-4bd1-a197-6a4160857171", "value": "XJPRTQWALMZCNEY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94036d8c-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761497300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497300, "uuid": "537a4554-fc8c-4653-b322-aaba199cf52f", "comment": "Malware payload (Rhadamanthys)", "value": "0a1790e950b7ac858f494f693f2fbb4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497300, "uuid": "bcee3afb-ad9d-4393-be32-ae9ac459c637", "comment": "Malware payload (Rhadamanthys)", "value": "3755a5c09b287eaddc5e81864ff2b3e9ea22c93f14707a2acd4879d53ed6b6af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497300, "uuid": "9a592212-9b2f-4f6a-b2e7-afdb1c40b8d9", "comment": "Malware payload (Rhadamanthys)", "value": "9669f8d18e7eaf7b55892925b890af8e7afab90f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497300, "uuid": "76fe2333-f9df-48a0-a63d-532a77de5d8a", "comment": "Malware payload (Rhadamanthys)", "value": "5c7983f08fc236b83649eebbadd06fd691abc17f20d2f1a0c4b889f9e4bb6d036503c33ee46ee1f2465330bd8782b624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497300, "uuid": "6f264f25-e72a-45ea-81bb-871d1fa62bbe", "value": "T16595332B0F427DDBEBE1EAB1664F84C3DF667614CC263EE91C1C41E5974B682B431862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497300, "uuid": "7858d629-26be-44b9-836a-a846f31ae97d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497300, "uuid": "f8150e35-fc96-4c20-ad69-e079b7998274", "value": "49152:7ha6kHbGDLRTBH2UROPHpfgM/w/cGoAY/SjI:NaP6DVBHIHBXecRAiSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497300, "uuid": "377585fd-dfa8-43d1-ac24-b6f9f895e8cc", "value": 2041856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497300, "uuid": "57883e99-54f1-4b66-9b35-cb2f630c9f9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497300, "uuid": "a512b5f2-b20f-4cc5-90bc-2173c6cdaea4", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fe819f-b24e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761470855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470855, "uuid": "b7456402-ea25-4166-abf2-6bf2f5658043", "comment": "Malware payload (Mirai)", "value": "152b779b54a1bc02b04f126287300f8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470855, "uuid": "1dc12cf8-5e06-45a3-b0d6-b88d03dc6939", "comment": "Malware payload (Mirai)", "value": "38231aa11511013786c891272d2d936a3ea3f1a65b9247f4298d2528bf7c0f7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470855, "uuid": "6ca4acf7-d00c-430d-b176-3d8ac698a784", "comment": "Malware payload (Mirai)", "value": "be82e4e5e94ddae9d56b77d45304301fce40391c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470855, "uuid": "f97cde76-a20e-4f85-9a91-f7922b747d63", "comment": "Malware payload (Mirai)", "value": "2f247f946bbc96faabfe0c5270e96afaffbf0d106405026ec2c33d7663501f54c94ff3029e0e2e2c6108c648c5217056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470855, "uuid": "aafe3287-8849-4449-9a1c-aca7848088e7", "value": "T19D73C64E2E618FADF26AC23107F74E2167A823D527E5C781D29DC9006FA034E645FBE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470855, "uuid": "26049dec-285d-49dd-a0f0-26dffa3303de", "value": "1536:qb6DHHNZ7Km3jQ574FdDDsguB93L00000000000000dB00000L00K0/LCQ:q27K8TPsl3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761470855, "uuid": "e1eeead7-0b9a-490d-a8a5-9500bfdc2bb2", "value": 80484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761470855, "uuid": "ca01a534-988e-40e3-baf2-1a612ccf33ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470855, "uuid": "4eed9d5d-595d-45e2-80d8-f19192404e6f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a69dd97-b278-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761489150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761489150, "uuid": "660975d0-9bd5-463a-bb94-ad52ed1c12c6", "comment": "Malware payload", "value": "b63f6b96f8d9c0bb0d08243535f614c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761489150, "uuid": "0b180690-ac31-4619-a5b2-08694b4e863b", "comment": "Malware payload", "value": "39ff4b55cd4551b83cf905b4611dce3fb9deef4a4c36588af3c93d70fe2178a8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761489150, "uuid": "f7ee6f37-7aa0-4dd1-a4b8-af0564f63a2c", "comment": "Malware payload", "value": "a48d500b015252609734f832db91973f706e283d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761489150, "uuid": "a11fc338-6680-4097-986e-288e6d906eb2", "comment": "Malware payload", "value": "8bf87eba776f17b817bb26311472a3ccc28bb63e42e06ab0e650f3a8d0ca6859be182b4856c1065b79bf54f84b86193a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761489150, "uuid": "db4d1205-da6c-4a20-8165-ae1e4eab0cd5", "value": "T122C13D8E0705D731D7098A1EB7F2B1B4900FA2C3E6EBCF46A950586C4EC5D4CF586E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761489150, "uuid": "da185d5d-121c-45d9-a65e-67d157a42291", "value": "48:rqGRU+S2JMZnbiBxQuZ44cvyalRKTqpbwzFhM3OT/TbTKTNTb:rqGRU+S2JMZnbiBxQuZylRKTqpbws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761489150, "uuid": "e863a1e7-5365-4018-a8d6-4578345d1041", "value": 5635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761489150, "uuid": "67b1cc27-586f-4423-ba8f-13571100802b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761489150, "uuid": "7f0d354f-7468-4d6b-89ec-a0d285cb4869", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b0757f-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497485, "uuid": "c0d96683-80fb-4a41-8b01-199155c7a0a5", "comment": "Malware payload", "value": "3d06d09d50ffcb84b5b647f0b93be214", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497485, "uuid": "3d0d11f3-bc7c-444e-a9e0-b5f49fb1578e", "comment": "Malware payload", "value": "3b0d228ecdec6d9c924f41ab3293c93525cbc1d97ca79afc300c7cea871f9207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497485, "uuid": "56e65572-0d86-4018-aa10-a537c06b0d61", "comment": "Malware payload", "value": "a8ec28d289db1037a1f248c16371258dbb43bee0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497485, "uuid": "0ecef407-9006-4eb2-ab27-1c2510a5e254", "comment": "Malware payload", "value": "8ed1c3ccd084b74566f02b8e6bee66513333438873552e51656c12cf70d68ad1127139d3bb7e2f7f68b5361aea24e2cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497485, "uuid": "f30a4a33-a4fd-4471-bb28-8caab839ff18", "value": "T18243011315B0E521EA0763FD0D5D0839B1E855DEF322CA49A6B08D912DDE7A7B3887E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497485, "uuid": "005452a9-85df-4255-b8bc-4e4b4a9437fd", "value": "1536:LomPsK9xkau48tAPOB5luKfxjq0XEPYHirgLkg4azH1:LZs2SamAmduKE0X0YLLGazH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497485, "uuid": "444f4c32-6249-4ef8-b9a5-36314c5d51c7", "value": 57004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497485, "uuid": "b4491604-1d1e-4fcb-908f-c3c7c8208f99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497485, "uuid": "e43996fa-3011-4d37-8ad7-5605025e4ba2", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c67db2-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761497120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497120, "uuid": "06c75d62-b4c6-4dea-b80c-3195a51acb34", "comment": "Malware payload (Mirai)", "value": "dde1658b17c0d5262f624247570b2e9c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497120, "uuid": "d178ae51-4fb9-41e2-84b2-1bdc319a60fd", "comment": "Malware payload (Mirai)", "value": "3bbc90128bd1a45394fd7a95c0fe3bb4adc345f92c22316586b16a815833aa5a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497120, "uuid": "44a61464-aaef-4cc7-a7c4-03cd793f101a", "comment": "Malware payload (Mirai)", "value": "500bc7695f7ea620c14837347020dd643eae39ee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497120, "uuid": "7045a864-57c6-4b58-aebb-c997f052fd37", "comment": "Malware payload (Mirai)", "value": "f4473783b29737876c941cc14f91c4d6a25551b5f065c0000a9855f4e6dd9a80a2bd782571cc53a81c74809aa039ec2f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497120, "uuid": "c8b5245f-c225-4119-af9f-2b7f273afa5d", "value": "T119C012DB04D1370448E4BD4A3163C40D502B828B78960787F98C7476C058408F121F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497120, "uuid": "7bd476e2-9667-4b48-a3eb-6cc1d26913ac", "value": "3:zBMXBgHrwVoyGjWL4UdQCPaGBzSCT7LVxbdvWovSXWL4UdQC8JNBzSCS2WzEH9Jn:tfLwVIjZE9NZdxbQXZEGJN7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497120, "uuid": "d005574b-0581-4cdc-be19-e4b9d351ee28", "value": 193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497120, "uuid": "6ab9f705-d04c-43f9-b65f-1a5087fbbb3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497120, "uuid": "5c8a30ba-bb4c-42fc-bdda-6d170d3413fb", "value": "sm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b68e2be-b2a5-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761508345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508345, "uuid": "c72955f7-6ba8-4128-8721-06063d79b879", "comment": "Malware payload (AsyncRAT)", "value": "016b3c9c8bd79b34583a4df7acc47ae7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508345, "uuid": "5b619b9b-b424-45cc-a73f-af6c8d313d10", "comment": "Malware payload (AsyncRAT)", "value": "3c15a897ba4c3e515c9ee0eab95bbd792da550b7e6c6801e2c524fbf63e6c732", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508345, "uuid": "ce55474d-9568-4636-ad7f-cb7b0db86109", "comment": "Malware payload (AsyncRAT)", "value": "eae3ec13607d12b1432f490ce3b3cca38b92bc5a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508345, "uuid": "49c2591e-8255-4a0a-bae7-4e4500532cc2", "comment": "Malware payload (AsyncRAT)", "value": "a06f0677260fba38f1440e908a3860dba7d82201e4fc7f1b9798e6464443374d5776496ce165c31ee8f7bdbff70e3d67", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508345, "uuid": "99a92705-0e61-419b-b0d1-2b180ab1bfb5", "value": "T16BF23A48B7A08251C9FE6FF55AB3A1060274A617D913EB5F0CD845DA6B37BC0CE013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508345, "uuid": "a30e3ae7-bf43-4e6c-99b7-7569d27566e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508345, "uuid": "827e1aac-584f-4d07-b4a2-2364fbcfaae1", "value": "768:oSEe6sVJbkDgKWvqEwTsuzfF19Dp+O/hl/GCl:afsVJAJk2TPF19Dp+O/zuCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761508345, "uuid": "225f40da-32b4-442c-afa0-e73d478bf91b", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761508345, "uuid": "868529ac-e3ff-4626-a82e-2966c7530d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508345, "uuid": "add4e448-684c-4afd-a02f-854c20590aa0", "value": "celestail crack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23824577-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497111, "uuid": "8b831f71-1e49-4256-b188-d8dbb546704a", "comment": "Malware payload", "value": "f070868370f0b009626056141e18001b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497111, "uuid": "8deeff42-12be-4fa7-8838-af1f47009ea7", "comment": "Malware payload", "value": "3c8d98551eeff56610579d07888a66f3619ca806c17db7ffcc516b564eda1f7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497111, "uuid": "97b4d32b-9b31-495d-857e-42ab71789706", "comment": "Malware payload", "value": "c54ec5e6722e7bf21de0b587d11299027f74f158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497111, "uuid": "6a8eff52-d324-43e3-905c-f70ab1a7b0e4", "comment": "Malware payload", "value": "b3dd0a267645537459fc54f6f8e111b21a0419168e2470d22e35cd080dbac6f52f5051912364620f5a9e58cc3ad6a18b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497111, "uuid": "03dad56c-7e8a-4f20-ba2f-9fbf9efc2779", "value": "T136F522B41E955BF0E02FC7306692415CB26B77B59F38156E8F85C8290EEB5E89E360CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497111, "uuid": "3b1b65db-3d2b-49a4-a3a9-3f10d1aac1a2", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497111, "uuid": "a6bda11b-564b-49f8-aa28-adadd91423a6", "value": "49152:uvr3PPjsi84SxBOTYaaYb0ajKSgXXKWiAoWv5BBSfoXmY/iCy3sn+OAHGPFFTrZ:c3XYTLxkTYatb0OxgtzzBtWI/FoOFxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497111, "uuid": "b0d9ecb0-3827-4246-8383-2d94889df3da", "value": 3600816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497111, "uuid": "b1520fdb-1cdf-4f87-9012-3944ce1fdac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497111, "uuid": "8c013b0a-746f-483f-a701-55740e2fb311", "value": "f070868370f0b009626056141e18001b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b704d886-b244-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761466864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466864, "uuid": "6b6bc910-0f39-4c7d-b7b7-f737ad615ac2", "comment": "Malware payload (Mirai)", "value": "59aa6feb4734522cee80d0a825ae82d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466864, "uuid": "d6c070c3-da7e-4628-b2a5-ce9d9bf3da71", "comment": "Malware payload (Mirai)", "value": "3e366d60db5e056fc183d985a74f8b3f371335c05afabf2f11bf428c4c41901b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466864, "uuid": "c327160a-5294-420b-82fe-3ce122b951ff", "comment": "Malware payload (Mirai)", "value": "14ef62d4996cfe4c11f7bc6d0aaac0f0b7df0717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466864, "uuid": "03ff4a95-58cc-4cf2-be39-a57fbb49a162", "comment": "Malware payload (Mirai)", "value": "b6257e56026f1788877c590be5abd484b294d3b741ee54c73ef4cb85c9d2c2467ef64aed88faba89b279232e74032f9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466864, "uuid": "ce13640b-a6de-4a17-a4a9-dbebbd5ceedc", "value": "T1B9C38DA47A4F3C91E3C7E37DCE494F62712B75F4C76152B4BE22432DC0E68AA8AE0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466864, "uuid": "6025f0c0-5863-43ab-9ab7-db8ce8b54b62", "value": "1536:j0OS9Tf5Gi0CKsHs++2EHNT1aE7/sTQSVOjYNtE/zVDzlceEh:j7SdfM+lMNT1aETk9/tCZzWeEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761466864, "uuid": "81b63fa8-dacf-4a24-9b23-39a8a2d9cfd7", "value": 120664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761466864, "uuid": "1d1d743e-0212-49da-be31-e390f0530df3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466864, "uuid": "4861298c-9a4a-4aa7-a328-cd20d76caef8", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcf2f14-b288-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761495924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495924, "uuid": "10ae7533-67a0-40b8-a397-5801bb2ade99", "comment": "Malware payload (Rhadamanthys)", "value": "2b5a2ce986b6a2315583788ad6da2a37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495924, "uuid": "8bab0c8b-2da4-492c-8859-e49280b64070", "comment": "Malware payload (Rhadamanthys)", "value": "42fff30d481ce6de68f032b45f6de0857e038cfa20c4eb2d135086cd2c540bcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495924, "uuid": "18370660-f664-447c-8b3e-481afe7d307a", "comment": "Malware payload (Rhadamanthys)", "value": "60e761acd6680250a60ea83a515f88c17f02d2d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495924, "uuid": "196c8ea6-f069-46bd-839b-8f1421919fad", "comment": "Malware payload (Rhadamanthys)", "value": "b8370072833ca3edd6b221c8a6a40754c9199c6079bfc28688e54a3930b65111f3ac59acbb905251cabf48ee856ff8d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495924, "uuid": "85de07da-8593-4d13-90eb-77e95b8cee85", "value": "T19B7523139BD5C877EC851B700AFD22FB0234BEC5067462EEAB5835E928722C59936377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495924, "uuid": "a5345a79-8209-4417-a9b6-1f8ee7aa0d72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495924, "uuid": "30114dec-ce3c-4dfa-b706-913cecaed766", "value": "49152:4P9dgHM0z1wjY+PR+JEw0HrYztNPDZFs:QdgHM0z1wjYnNQcztlDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495924, "uuid": "065fd957-506d-4327-9423-87ebe7e6ed3d", "value": 1616384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495924, "uuid": "9fe238ba-78ed-45d6-8619-8b4d1ab7e036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495924, "uuid": "e554259f-71a2-4526-b2ff-c9316a7c421d", "value": "2b5a2ce986b6a2315583788ad6da2a37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5798edd4-b2ba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761517385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517385, "uuid": "3ac47a5e-6194-488d-b59e-6d602eebd784", "comment": "Malware payload", "value": "4d5806a2b8bbe75b2895df2cacba9a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517385, "uuid": "2f368cf8-26f8-49a1-aaa5-f59abb16b6cc", "comment": "Malware payload", "value": "4301faad8919039ec5d7b251a35a7400984744c565267b4a96eaf6094cffb277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517385, "uuid": "92815b38-71bf-48e5-8035-4fc70fa05024", "comment": "Malware payload", "value": "715aae47b3312c4b9209f3493d19b6e7d53480dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517385, "uuid": "355844f7-38d0-45ab-b92f-0672eb2f0ef9", "comment": "Malware payload", "value": "da09603ca2e658d26bfa64f8f2b38fbcf0cd3861c90d02697dad33e2c9d78a2bf82954d05900c5b912a32b7fe834c20f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517385, "uuid": "6a927d41-1b24-4fe1-b6d9-16bf6bf1f9b0", "value": "T13F3733D952A006E3CCE5813696874AA4EA22FC5BDBB4C6CF4BB4455A2C93FCC5937F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517385, "uuid": "99028a70-72ba-46b3-8337-a6f51b83ba09", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517385, "uuid": "3b5e0e1b-7260-415c-be54-0a8144878ab8", "value": "393216:x85vzG1sFl7dCR1C99pm/dhwGaa5wEMiuHClxRoxhaUX47d4QTENRjGMlnsLupS:G5vzGGFlUR1O1aGziuilxRovaUI7d4A7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517385, "uuid": "09b93822-1a63-457d-a4bc-b642ca9a39ad", "value": 22384938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517385, "uuid": "578ad6b4-ba9b-4521-9593-82f6874d3db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517385, "uuid": "e1e7545b-2c67-4f0e-8e43-3dac6aa62788", "value": "2KovVqfqnGw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea74ce3-b223-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761452516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452516, "uuid": "983d0df7-a883-4a31-a3c7-2de563f00373", "comment": "Malware payload (Mirai)", "value": "a5559c2d4d2d859c5f03d5a7b419f907", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452516, "uuid": "02a70dbe-352f-4868-920e-25027ba27035", "comment": "Malware payload (Mirai)", "value": "4465d6a9dec1b274cfb1c06a8d98164905784284c0fb60194f1f314343e21a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452516, "uuid": "ab086ee6-0530-424b-a909-dcbe7dee7b36", "comment": "Malware payload (Mirai)", "value": "ceba22217d4cfa58fb3cde427005fd55cb91c4df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761452516, "uuid": "c87f963d-a8b6-43c7-9a1c-d8ec03257718", "comment": "Malware payload (Mirai)", "value": "10eee75a05800a3e94b46705827c7ee92ce49f8cedb418f2ebbee09efc2f09fc8abe10de2b2bf980e49c5310fc94daa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452516, "uuid": "1deb6092-e5a6-4035-83d4-f919363b1486", "value": "T15FC3E195F7277982D1A341FEA4801AC383616972CFE22748065CF774787CDBA0BA5ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452516, "uuid": "ade62ef2-2460-4d56-9900-af465636b1b5", "value": "3072:nomb4/pBknhkQTdlKTF6wuMSPkYoJcH3DhMMTnV:OkhvTbKruMOOK3FxTnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761452516, "uuid": "85ccba1d-0749-4bb1-80f3-248dfee717f9", "value": 119772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761452516, "uuid": "838a5f39-68f2-4650-b65e-d2a97c4629b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761452516, "uuid": "ed856307-b087-4790-a2af-5a3469b5a45a", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6656a26e-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518698, "uuid": "f8f35ef8-aba3-48c0-ad7a-29a7ff907f1f", "comment": "Malware payload (Mirai)", "value": "eda7f8df99d0e4ae631ac29d568eb7a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518698, "uuid": "6eb1f0ad-a262-4b10-96f5-8aa9c8a8cc1d", "comment": "Malware payload (Mirai)", "value": "4585e46f3819156d49d1a84457d801e462f94b33bc9136d604de0faef73288ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518698, "uuid": "4d1dc463-3be9-4fd7-9c83-5670f1bd533a", "comment": "Malware payload (Mirai)", "value": "9550ec2a0037d095d7a10da81b044674c64248e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518698, "uuid": "2e62ae24-cfcb-4ac7-9277-472fc57a3cb2", "comment": "Malware payload (Mirai)", "value": "ee624c1cb52ee620c1bd97918af7c8603f49dd4c7a5ca5941fbbbf5e51b037e60cdf080993e94597493e614578334b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518698, "uuid": "add64b7f-dd17-44a7-a38d-87e2228dd0dc", "value": "T1F4B32A87BCC14A11C5D612BEFA1E218D332357A8E3DE32129E665F2133875AB0F77649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518698, "uuid": "9af3a77d-5ba5-4e8d-9c31-e00cf733be04", "value": "1536:9RwnBPg+48lmMxbXK50F3IRFZkXlSUN1FbHCNIoR2Rx3ftXzNaahvIXmqDsRinxH:98gVYEREJh7FXzNaaLOxJhv67inILs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518698, "uuid": "52f72001-7983-4f87-be16-6fbddf359cb8", "value": 112108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518698, "uuid": "2cc850e0-ccc8-4880-8762-f25ce9448d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518698, "uuid": "2415e028-32ed-4792-8332-2aee71eb3253", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5d25af-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497505, "uuid": "f6c1299f-3c07-4eb8-b57b-d5d53ccc9b4d", "comment": "Malware payload", "value": "4fbc16d52f318f4186dfc297069a552f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497505, "uuid": "3b2930ae-57ff-4790-8dc8-24bc03df10b9", "comment": "Malware payload", "value": "458ec31a1aee6422e42442365da283d0811c6906de1c2ce4295c6b375c1d343e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497505, "uuid": "77f52bfa-b3c3-497f-8542-4cdb096f3f0f", "comment": "Malware payload", "value": "c327b2e722701eb6f1a2769f8f43d8b102928582", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497505, "uuid": "e03f6125-d417-45ef-9263-1917a4de2d94", "comment": "Malware payload", "value": "2854e068af581a9ca4efef497a85307a3574a4e47f61bd30ea9a633fec3b2aa9b4d505e31c80b064a8bb5ca2a278302f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497505, "uuid": "b6bd9756-5321-4777-b22b-4377c4798f14", "value": "T1B0445721ABEA5204F9B74F3DA97A7211886A7DA4DF3AC34C00818B198972941D859F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497505, "uuid": "e98481e0-a1ee-4820-9a47-4fd620e6302a", "value": "24:8d/i6jFfGuiHVda2eIqyxWamI4pEc9GOUb/ec:8lPpf8PreICT4H2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497505, "uuid": "6dd92094-db49-4b2a-a3a3-9ea591cf9de6", "value": 261634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497505, "uuid": "1f1b675b-58ce-4982-9d70-8200cfd26765", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497505, "uuid": "05b160b6-e580-4c3b-84b0-07f34a621fe6", "value": "Scan_zapitu_iz_verhovnoi_radi.rtf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ed94c6-b28a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761496790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496790, "uuid": "624f82e9-a2dd-445a-a7ba-dbb1a62813da", "comment": "Malware payload", "value": "e83eb5342743c209531ab518e3ab2c84", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496790, "uuid": "81fb02c3-e914-4b96-89a5-b85713df37e1", "comment": "Malware payload", "value": "45e191eef70b5e4986f04d68019793527d125c440648f7ad2ebe0a6c3ea79316", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496790, "uuid": "c4f7f99e-3fcf-4779-8e22-d9fff3eaae76", "comment": "Malware payload", "value": "73eb55716cf635f91974a7a1409486bed5b41f80", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496790, "uuid": "c37fe2f2-8ac6-40e2-b01c-9bd8c86f6fa6", "comment": "Malware payload", "value": "540c72479a1acfc53e3c306179c66b59b5218a3a2c2697cd1ea42455b0e33513459c7acc52ba574eb2a3683faa1fa94e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496790, "uuid": "1b207976-2fa7-4f25-b21e-3b76ff96ebb0", "value": "T19332A65B2E03A7749577CDA5C95FB85EE4C014A34A97CC14F88C85868FB13ACE9D02ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496790, "uuid": "67149859-a35b-49f2-9e87-22ff222ac195", "value": "192:2pNjrF1N/o/Ei/I/QsI/a9I/IucLBgfkN/Nnw/Upfwce:+NrLBL9fwce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496790, "uuid": "25bb38fc-fb12-4534-a985-710280c32b79", "value": 10967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496790, "uuid": "32e43c35-391a-49a3-9279-c14f6ff63d10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496790, "uuid": "a39747ce-e958-4726-9e35-5ee597609765", "value": "FantomPics_Portable_Installer_x64_Light.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74908f3f-b2bf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761519581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519581, "uuid": "9fea6e3e-3f88-4f3e-9ef7-cacd90074c7a", "comment": "Malware payload", "value": "b58053ebca415d9c89170abb50a8b199", "object_relation": "md5", "Tag": [ { "name": "jpginfo.oss-cn-hongkong.aliyuncs-com", "colour": "#DFABA0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519581, "uuid": "9d3a7231-12d5-4f7b-91db-a705e2af2743", "comment": "Malware payload", "value": "4674d45aaa2fe41b1ebf9f0b00a7d144a0751a5ccf24b17161a7ccadbfe33abb", "object_relation": "sha256", "Tag": [ { "name": "jpginfo.oss-cn-hongkong.aliyuncs-com", "colour": "#DFABA0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519581, "uuid": "0d939f05-cf97-41ac-b1ab-fcd2db7586e1", "comment": "Malware payload", "value": "0c78611bb333a9d06cbb876bee46a75db6f1aba7", "object_relation": "sha1", "Tag": [ { "name": "jpginfo.oss-cn-hongkong.aliyuncs-com", "colour": "#DFABA0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519581, "uuid": "551cf9be-cc87-4fd1-892f-b64f1e6d03d6", "comment": "Malware payload", "value": "d35a3fa5a30e8c9021ee6f6cb997c28a34a9aaa39303d7f7400a4567963c073da27df6ec86a19a722b76db7e9677df6a", "object_relation": "sha3-384", "Tag": [ { "name": "jpginfo.oss-cn-hongkong.aliyuncs-com", "colour": "#DFABA0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519581, "uuid": "2a8d1ffe-cc3c-4ca6-b9a4-2ba2279ed1ec", "value": "T1B3135DD26942402CA06207621CDAC42BE21303F2653A47757B4DA9D70F3BFA7FCAE759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519581, "uuid": "11eb7bcb-bff9-4d98-bf54-8be27e575dc3", "value": "768:bmc7XFvYFJtbgeQq0eQ9hkYO5Nf8AhvYNsCvALNO2wEC:T6PlONhoxO23C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761519581, "uuid": "b3b5247f-5564-4f94-8d2d-fb01b934f71a", "value": 44816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761519581, "uuid": "bbeb45b8-6a85-4c57-8feb-f466354da6b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519581, "uuid": "fae3bf65-d2ca-4950-8de2-f6a73f6ea8f2", "value": "4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4906dded-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518649, "uuid": "b4676897-9dbf-4c28-aa06-ccea3e9453f0", "comment": "Malware payload (Mirai)", "value": "3a42649cdde3c18d92d25a0b7dffff19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518649, "uuid": "2ac18c95-ff80-44b2-8d69-e3b59b03c383", "comment": "Malware payload (Mirai)", "value": "46f1f8be720dcaf1c381143037c755d84ecf9897dd15c7c86a33943a5b0b2151", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518649, "uuid": "03c647b5-0289-4ca6-ad3b-f1963ccee713", "comment": "Malware payload (Mirai)", "value": "b5b003f7f05a82b42c51e9a09bc3233e7aa9750e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518649, "uuid": "899a27f3-0cb8-4fbb-85dc-aa35f065692a", "comment": "Malware payload (Mirai)", "value": "b45f1d4610915606a21a05509c15ceeea88969071a5dc0ca6373301d5e005b11867b48dda54c0eaa133bc701b176c18d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518649, "uuid": "959e4e7a-69c8-4036-87e3-3c1c115229c3", "value": "T16D13F272D24A5074DFFDBC6E6C5AE7C23BF2029C73A985B07060FFA1051A544972ACD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518649, "uuid": "47c289e9-28bf-4c8d-a60b-3285169b1d98", "value": "768:PhZU2AvFA88sG/RJhewX51xe+V0z+Dq0yLnvLbSnfHwMQtdPkJ/7L5Df4uVcqgwl:Phjm6NDRHXXxe+i+VyTjbSfQMQrPkpPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518649, "uuid": "1cbdb5fd-e07c-4ed1-9eb7-91cd18bf220c", "value": 44188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518649, "uuid": "cfa19e83-ab2f-40dc-b6fb-cfd4d176fff2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518649, "uuid": "63c46fdd-85df-4c8f-974d-7fd13ddbd9dc", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93dd0fe9-b2c0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761520063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520063, "uuid": "dbdc5f8d-ac56-45de-81a0-75685d335bad", "comment": "Malware payload", "value": "b6c8c46e71dcac2ebcf51ccd7dba0ab0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520063, "uuid": "1f3f400c-0a45-4328-8a85-aa0a6475f678", "comment": "Malware payload", "value": "4895af9e6e412240c8853df21a5b31e3ee01e12a0aef54d7650b1e440483ce26", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520063, "uuid": "edd331ab-f161-43c6-888f-8cb1826d3ae6", "comment": "Malware payload", "value": "7304fe19615aee7ffc5ffa5c648d5a11f7668fe5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520063, "uuid": "7d51738d-424d-455c-9a30-903d3ba74956", "comment": "Malware payload", "value": "e5e47a3a2b232e7d2f20cf5e907f3dab80eee41c5c159201cb1f63b8b416bb0b449440886cd2a6fccbb44be3344432f7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520063, "uuid": "55d5b9f1-9eba-4627-b8ef-173d66e114b9", "value": "T13921BEE9E5419364985A456C72CBC22EF06783F816E51A68FC4D3E74B7CC884F831B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520063, "uuid": "8f0b2c28-0dcf-433a-9a94-dbd74ea81014", "value": "24:ToWBGhBh9Mk8QoWkp/A5VE+/I/V7RpjHXplHU8atkk0:ToGGhL8QoWlVE+wV7Rpj3ptPat/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761520063, "uuid": "b7b823e4-89f9-449f-b1f0-635d96409c55", "value": 1113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761520063, "uuid": "5e6b8821-a640-4e66-9f1a-13dd95b98ad0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520063, "uuid": "27d50bdb-e4e8-4956-af76-f6ed46ce50d4", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966d4142-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497304, "uuid": "6d2417cb-bcd1-4877-bd03-9dc657839e6b", "comment": "Malware payload", "value": "3338f63b6eaec54fb19bfe72aa5175f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497304, "uuid": "ccd4a43f-b7d6-4347-bc57-772da08c2348", "comment": "Malware payload", "value": "48ba1020312e1f0f383b075c807756f05667deca539ad60da3f724ceed02aec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497304, "uuid": "cadc538c-1431-4d46-a926-f0b09021df82", "comment": "Malware payload", "value": "1e9007d4cd9c2582ed5064ef6f68638db0a886e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497304, "uuid": "37c35f53-a689-4779-aa6e-88ec5f876a41", "comment": "Malware payload", "value": "751c54a17824a0da9a19622b45d6651490debca59697a29b2eb780c5459bd4bf477663fc8d3129d4ef0d5a4247a0bdd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497304, "uuid": "24b4073d-c471-419f-ae8f-bf9122579471", "value": "T10C0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497304, "uuid": "4b2eeabb-ee22-4546-8cc3-9bbd28744b6e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497304, "uuid": "7098ec7b-4df2-453a-8c38-6f36777bf4f2", "value": "98304:aCT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:52w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497304, "uuid": "e9f72d0d-e48c-446f-9c18-9e96fc014d7a", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497304, "uuid": "3459ecc5-5af9-4118-8a16-0585cf2332d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497304, "uuid": "2924a7e7-eada-461d-b805-24d3d24c205b", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3d541f-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518678, "uuid": "e0259dbc-c054-4e85-8e22-d0887aaab255", "comment": "Malware payload (Mirai)", "value": "1b2292b426bac3f45d30c18400f1066c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518678, "uuid": "f226b99a-6fae-4c87-a3fe-a444c1c5f622", "comment": "Malware payload (Mirai)", "value": "48f264d4fba2abd2d37fd798773fddd49d836aeb61a1d0a715c635e458b72169", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518678, "uuid": "5e2193f2-710c-4704-8d27-481e408eda42", "comment": "Malware payload (Mirai)", "value": "673dd20b5b56d841ea406391e26c7899df879cc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518678, "uuid": "c1d202cf-642f-48cc-ba45-7a2e4d277c59", "comment": "Malware payload (Mirai)", "value": "923632692b428f2db75665a236a7021d806ae9277810e4a2cb1cccd63c066e1cd5f111ed1a4e922c4391e7ffa956f680", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518678, "uuid": "c3c1861c-0ab6-425e-b7d2-366f14109b63", "value": "T1B1D3E90DBF219F7CFBA982344BB39B259758239637E1C585D19CD6012F602CE642FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518678, "uuid": "2b1c9e5b-910b-4746-a578-c09fe7640a72", "value": "3072:4NkMz5n7VA4tFFSibzMWH6ufMhegEJZd3V8:QkMz57VXtFFjbzMWH6XIpd3V8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518678, "uuid": "35820ae2-8769-43d2-8435-baa123599bc2", "value": 130324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518678, "uuid": "630844c1-bd38-4411-8537-eb922afd4be3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518678, "uuid": "5f2981ea-fb1d-44e9-8be4-6ef52e162cc3", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429d2650-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518638, "uuid": "baa5a8e0-af3d-4aa8-9b6c-3010e8f45724", "comment": "Malware payload (Mirai)", "value": "0dbeb2d24e302ac9db4f99312346af4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518638, "uuid": "bb0d8b8d-3b66-498c-aa51-b00b7f7de39c", "comment": "Malware payload (Mirai)", "value": "4bdcdfad552fffa00108f056a4940230ac3e5b8457f84fdc8d593edda264ca53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518638, "uuid": "6bc56a8e-3933-419a-9cc8-4963d5fbf68f", "comment": "Malware payload (Mirai)", "value": "d36cc93cd37fb7183c4bb0a9029d57ebfabee0cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518638, "uuid": "a3450d47-3423-4d8b-ba19-9c883fb6ed10", "comment": "Malware payload (Mirai)", "value": "4ed1b76517e271a132069cea5a8cee8fec7ea2483aae3ceb08aa5eb32c2e114bab8daaba0a0c0d755a337b826bd01165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518638, "uuid": "33db5d08-fabf-41ee-b1c8-adc699438ebd", "value": "T16723F2DDACF86823CD5C8CB7B5FD3BC1AA20994172488B551F419C98EEAC955F84D03E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518638, "uuid": "ee592897-817a-47c9-97b2-df71cff3b40d", "value": "768:Tq0TWjqAQ0bR8CcZPw2bQtZToBwkdg0fABazMpXRtfovWXM7/yn1mK21A88WW:Tq0TbAfm56tfcBw50IB6sRtfoUMjy18E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518638, "uuid": "4ae80f77-3414-455f-9315-ce1bf2bce489", "value": 48828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518638, "uuid": "d340c255-161e-4118-acb7-2410dfbd1d85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518638, "uuid": "35b403f1-aab0-492e-915a-db139fe17155", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f83cbf-b2ba-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761517412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517412, "uuid": "8be8b130-47fe-4f8f-af38-9cf69b8cc42b", "comment": "Malware payload (Mirai)", "value": "da7f4e3ce22aef09efab468fcfc168e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517412, "uuid": "96eac7a1-da60-4f17-a56c-f12da167a40e", "comment": "Malware payload (Mirai)", "value": "4c5707c1d1786991076fab3f7661c04dfbd4f6bc91ef2aa12ee2387769f29836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517412, "uuid": "e68e05f3-0e43-4959-98df-1e5e6eeef5f9", "comment": "Malware payload (Mirai)", "value": "1e5a1549e7704d39047c2ab34d72932e594ebef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517412, "uuid": "7503c434-1bab-4b9f-90ae-a9a9f7189a20", "comment": "Malware payload (Mirai)", "value": "6c6ea13dbee26567d845fb025934d2462905c56e33a480fbe423171287baa4fa673cae4c4b5e9e0e3f430c2e991bc2d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517412, "uuid": "de902a41-f34c-47f1-bba9-7509982d1de8", "value": "T130836C22B8391E27C4E4A47B22F34326F1F6538A24EC9B1E7D710E8DBF6459026476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517412, "uuid": "407260fa-86ed-47e9-a1f2-b539d3dd7aeb", "value": "1536:FcLfLrx2tEkbpcDg47af6oxutcpmYm5aw0oosftNVU:kDcqno4SpmYOatAVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517412, "uuid": "e9e2f208-dd5e-4daf-9b97-00b8d1e11158", "value": 87176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517412, "uuid": "a6f17145-7034-47a9-82fe-f2c766b9ff35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517412, "uuid": "fb96c9ab-2e4c-4422-b9fb-c333bfc76a01", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692f6241-b22b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761455996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761455996, "uuid": "99995d1e-9cd4-4e25-98f5-bd0d63e024a6", "comment": "Malware payload (Mirai)", "value": "65eec98a67d8d80b9ddbcdc38261f633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761455996, "uuid": "6985555c-c88b-4203-bcce-f3223aaa05a9", "comment": "Malware payload (Mirai)", "value": "4c6986553f9bd369c6f6f10f36bfb89b3ac2a39ec738d890c15dc3a945fdef78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761455996, "uuid": "1a5a1062-1b91-4806-b325-abdec6bbf4b5", "comment": "Malware payload (Mirai)", "value": "11e49095e5f8498eaaa356cf0b45a1d7eb5f973a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761455996, "uuid": "bf02f068-7fdc-4f46-8e7b-643dd51b55f6", "comment": "Malware payload (Mirai)", "value": "e20ad72993fd08a3f9eaf7bdd741e07f9eb5ef16650769359425eb8b10b1c0c5fb97f4462cab121013d92430b8cd7c54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761455996, "uuid": "04189170-7e2f-4d04-88ac-13aff7be3a9e", "value": "T1A9D3CF21E0046DC5DC1109B538B99ABC0710DE740BE66682EFFDE997A47BD8878EE371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761455996, "uuid": "7a919660-c072-432e-8961-3bd5f34cff7f", "value": "3072:zuSYAgge+3i1zSdGbn7eF1kl5qN9BI1Xwd:z++S1zsmeFyiN9B6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761455996, "uuid": "22b416fa-62c3-4612-8906-b98ae38b6fb6", "value": 131804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761455996, "uuid": "eb1370d8-7cf3-4a4b-b855-8443f9926000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761455996, "uuid": "22fe5dd5-d38d-40a2-9b71-9168b4c40af9", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f52ddc-b2a2-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761507097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761507097, "uuid": "e05c2c9d-3093-4b3c-994a-0e741fa0d5ee", "comment": "Malware payload (SalatStealer)", "value": "bde6e7a3118c0ed87cc4a89c19f7a014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761507097, "uuid": "b15da656-beb2-4d0d-a562-6ef79288815c", "comment": "Malware payload (SalatStealer)", "value": "4cc7bce760dadab730fe38be785381364cd6fa37deef2b77cb6dd0f679bcdb25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761507097, "uuid": "81d46ed8-53e3-4013-b5e7-417f607fafda", "comment": "Malware payload (SalatStealer)", "value": "2f38e56b881ca54981561db4f82448c1a846673a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761507097, "uuid": "b1d8704e-f201-4161-992b-834afd3e1f7a", "comment": "Malware payload (SalatStealer)", "value": "c85f5b9356ff3bbebfc596cd8c382dddf1defca89b7fd2bace3bee8a1b475b33dc5e3ad0b6c0e111af461ef6e913ea2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761507097, "uuid": "0b83520a-a569-4691-bf7e-248fcc8ec74f", "value": "T1C8F533DA339E9C44DC5663BE4B5803AF533253288F68CC86DE8621DE7D7429FE68D181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761507097, "uuid": "99fd0206-35da-44f0-8c85-a6dbc3fc5caf", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761507097, "uuid": "357387b1-dcec-4f63-8265-d41cf5ce4716", "value": "98304:2/8F/njTZmyRXkVtdRdU+4Vpns7CXNPe:2kFRVhMt1Z4V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761507097, "uuid": "593918eb-69da-45e6-af8d-59dc3d5b2bc8", "value": 3558912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761507097, "uuid": "36644e9c-eee2-4d22-a50c-e0012096022f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761507097, "uuid": "5eaa4f78-3064-47b7-a0ed-44ac6078c603", "value": "wininit.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7c0df0-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516910, "uuid": "0f19a072-062d-4706-ad17-5a1e707709c4", "comment": "Malware payload", "value": "c6768ab702e4a9873eb4f05aa52f8c7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516910, "uuid": "23cd0468-22b0-403b-8ed9-8db26c200184", "comment": "Malware payload", "value": "4cddce4904d32f0cb590cc9f7313454a87ea1ccd1a7d02b25f190313e5f9ea7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516910, "uuid": "537c121c-b2dc-4c46-ba26-f8a6aab6bed4", "comment": "Malware payload", "value": "c4add3a6eead277c17399a8f2ed5829b10eac31c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516910, "uuid": "b0f103d5-d407-4f28-8ac8-467de5f0bd52", "comment": "Malware payload", "value": "2612970dfb4b76239d97adeee339809127bdea2c5974c747850df18489ab7f6f517dd2bfb448d620191f5d5a31d8b320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516910, "uuid": "3db95e23-089c-45a9-a2e4-c8e27a6271fd", "value": "T1B2C73378D87498F2C46A1362BAD7F5064E8EC0B4C3E33E6660BE65425F735BC089F985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516910, "uuid": "b05f905e-215f-4514-8c8b-d90de4d49eee", "value": "1572864:Jcyca3t3Jlk5m3r+KqIXiFUpWHkr7dOd/NC:JvTywr+Kqu32uwHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516910, "uuid": "f6eaa48c-d2f4-4625-8db8-e727ce620a3a", "value": 55545285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516910, "uuid": "e87a5206-72f7-47bd-ab83-affdbdb1826a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516910, "uuid": "7e0ad229-30d2-405b-852b-0db5b972b059", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fb7b13-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516682, "uuid": "297fb2ef-98ad-4882-af59-ca6d6bad4f68", "comment": "Malware payload", "value": "174662a54e7bce9ee10214c22260edb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516682, "uuid": "dc2d8862-c8b0-4cbc-a1d5-6c888379fa13", "comment": "Malware payload", "value": "4f163bfa3869ae475b639f1c2caf40828331ca2e6c4a8b30750e5f4a0c164c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516682, "uuid": "3819cfec-ae41-4b6b-8363-ed8e3989ab76", "comment": "Malware payload", "value": "1dcd7ec7d67db97efbe27a67e2b4781115c66bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516682, "uuid": "73382d20-b148-4e66-855a-88294f4ff17d", "comment": "Malware payload", "value": "8d5df2d1bf0acfc24119512718313b209f1975da318ed72fc04e8289e833d2bbfc46d2e2ada072f920fb1f993d6f31dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516682, "uuid": "7ba6b982-e3e9-4c35-98ec-716392e48d24", "value": "T119F5D2467AA0C8B6D057D335CCB792413675B8B5872333C3D9576278EABEAE81B39700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516682, "uuid": "ac189a88-90ad-4bea-af67-02f49c8a1db4", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516682, "uuid": "cc326a6c-d28b-45e5-ad55-af2e1890a104", "value": "49152:kQQUzNq6bzxD3lCkytV04rPF1r93KRPec:k+Tp35ytV0mkPec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516682, "uuid": "69664420-e26f-409f-99cb-0d99b80ad2e3", "value": 3323937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516682, "uuid": "284934eb-91b7-4466-b2b9-098f92678255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516682, "uuid": "f95201eb-c969-4135-9d0e-8764ebcc3130", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758367e6-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499826, "uuid": "d0d26b30-4fc8-4703-a650-236f13829b18", "comment": "Malware payload (Mirai)", "value": "7671fdde4e9875843b5983f51caf5074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499826, "uuid": "54ffc29e-55d8-4b91-9a10-ae320ab61be5", "comment": "Malware payload (Mirai)", "value": "4f7e4a48cf58b2d7edb1b5c902acc9efebb4b90144df85c73d417fd7e6677b4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499826, "uuid": "df0f2cde-199f-40ac-b02a-e7fed080079a", "comment": "Malware payload (Mirai)", "value": "bd11676f870767a02cec6526ca833e613599a1de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499826, "uuid": "51d89def-0b71-457a-90e3-4a02ff743c90", "comment": "Malware payload (Mirai)", "value": "15e8240e9b67945f6ccdd11918156e98337f62b043dddd2f1be1ba07b7e43576bfbc2645ee107b74f771f2b4fb62a060", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499826, "uuid": "a54cae13-2536-455e-960d-e7cff8bc4a66", "value": "T14A639D62CD292E24C455AAB0F0F4DF395B63A46485470FE644B2C37A9853FECF9483B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499826, "uuid": "0f287315-1805-4756-81d1-d29ff85954da", "value": "1536:EleQ8ARnwQwjKkT9aqETRpuukDd7CzUo1Fj:Zq6Gk/ETRQF7Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499826, "uuid": "730fc941-2cdd-449f-8cbd-32d4b20ab77a", "value": 67340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499826, "uuid": "16fb2a2a-98d3-44ee-b018-d3cd7540098d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499826, "uuid": "e1646565-cec3-4e40-b170-c4bcba93ea34", "value": "kvariant.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452f8c28-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518642, "uuid": "2bdd510f-57eb-4006-8eab-638ddbe1495c", "comment": "Malware payload (Mirai)", "value": "a720504e9a89e1e278ab3fb749e50f0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518642, "uuid": "7e2176f7-adbc-440e-88d0-8f34bcce91c3", "comment": "Malware payload (Mirai)", "value": "500ae3fb9582124d5b31c9d19c72cf9dbfe3bb7ed0ce79e6c5953fe3febebfa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518642, "uuid": "83c6af6d-706e-4b66-8db6-6178f8ffc3c6", "comment": "Malware payload (Mirai)", "value": "e4bd430ba5643000e3d3dd4c893d4307520a60ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518642, "uuid": "9db83acf-d053-4f56-8556-eb5ca33f3081", "comment": "Malware payload (Mirai)", "value": "d2be8f2c5d88e08cb429df3f339b83a0213f6557c83f51908c4b37bd6986d7f60001bcd2f48399ef52e0892187c0e6ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518642, "uuid": "dde4d41f-7bed-43d4-aa71-8a8bc26bea9b", "value": "T1C3630216ED033831CF231735E8694BF4798A3D75EEF7304602AA9599F84196B4B8C78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518642, "uuid": "b8377404-e566-47ef-931d-d8c1b71cc1c3", "value": "1536:ENPU4gcIBU/xq1DrgUV2BNKqgrOjgZd/8G3swzAbaz+bHLbcZT2B+JCSZfQCJYXm:oN9Iq/2DrgUMNbvjihUbfDLMglSZY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518642, "uuid": "407282ca-0cf1-402b-8a4c-db31b3724806", "value": 71632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518642, "uuid": "bbb83e2c-b105-4940-b4d3-b31e24cd3d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518642, "uuid": "5c9ccd80-6447-4b69-84d0-9ce8eeb44f06", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2290b689-b293-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761500545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500545, "uuid": "8828d256-1439-4916-b663-3ca18b21bb4b", "comment": "Malware payload (Mirai)", "value": "1c85613a7e2f2ac48917bb6e77a88f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500545, "uuid": "eaf91389-5f7c-4bad-9f81-dcb4751c2255", "comment": "Malware payload (Mirai)", "value": "50728b13bd626ab0bbe19a91a6a60c3ab9aea987169392b8a9cc2fafe4347869", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500545, "uuid": "7f747cd2-0e13-48ac-9e31-8b7b8919fc90", "comment": "Malware payload (Mirai)", "value": "7d98cc9d6f3cf459afaf1099888e07724cb5891f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500545, "uuid": "5f7cb7b4-b261-47d1-8118-2d82177ae487", "comment": "Malware payload (Mirai)", "value": "5aa3ad4650c07e812ec0e937c360079f844590bfacf67741754ab4d7e7f2bfe59b8c78e5748caf5f29ab0cbe50d00a13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500545, "uuid": "78c02e75-4d2d-4562-8c67-53da916cbbe7", "value": "T175834A56FD829613D9C02177FB1E428D7B6753A8D2FE33039E266F60678A91B0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500545, "uuid": "17093966-f4be-4e37-9cbc-72aae0f0ecb5", "value": "1536:ASXnQE2oa4r9ksPdHum93DvwLjUY+W8NtIj9emfD:ASXQRoaykwBum93SoY3VjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761500545, "uuid": "467e34aa-efb2-41ac-8d6f-43f0b3274cf5", "value": 82240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761500545, "uuid": "298f3407-42db-48e1-9f93-bedd4b7fca14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500545, "uuid": "5a4b5ffb-19fd-434a-919e-1ab40b669f2b", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba053c9-b277-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761488749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488749, "uuid": "185d6505-3169-4502-a1bb-b5290b6e2474", "comment": "Malware payload", "value": "ae30f7ac6fc59863a2029bbb434c81c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488749, "uuid": "77ac0978-3e0c-4d96-9129-3ab5ec99d9a2", "comment": "Malware payload", "value": "50f3795fe62f657a83e1920c6ae87f94a3b06cf651c3512c5421ac7e9e823dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488749, "uuid": "2f73b0fa-7d9c-437a-8f68-661cc2eb8b10", "comment": "Malware payload", "value": "9f7ff47a7f51e1fe9162c116451a964a09f0c46e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488749, "uuid": "e6c173c5-711d-451c-9e08-65d7f4035ab1", "comment": "Malware payload", "value": "819887fc52d2ad06518b5a032f286c00c0bd46aeca9ad71e86328aefe4a31ae7e1f4801e1c7d6dd62ff8bdd6307bab4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488749, "uuid": "f8adc4b1-eef6-4cf5-bbde-cc094499fa7a", "value": "T1DAF523A0BE89DFF8E01FD370B942059CB2583B708D38256E5AD5D5199EBB8A91D334CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488749, "uuid": "1200cb02-342d-47cb-b434-c61dc49d68c0", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488749, "uuid": "3b5cb9b2-b6a5-448c-9143-646b93b56fde", "value": "98304:HnH9HWatb0OKlHuNqiF5jmRJRdRqeqp45N:Hnd2Q4Osa4RFRv4KN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761488749, "uuid": "c75367cf-2205-4a4d-b9d6-18c2a9ff3ce3", "value": 3562928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761488749, "uuid": "4b49c760-2455-4557-a242-495a8dc113eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488749, "uuid": "ffde6f3f-bad7-4d5e-9887-b7eb3f1228c1", "value": "SecuriteInfo.com.FileRepMalware.29934784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cffaac1-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497637, "uuid": "7bcc53f9-d035-4947-aeb2-7c7feef4215a", "comment": "Malware payload", "value": "77526a01cdab5dedcecfba0d134581a9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497637, "uuid": "be20e23e-1534-4340-ab96-c4daac33571e", "comment": "Malware payload", "value": "518f191b8a64afb6e05b9965a4ec51cb047ca7e5bae3a6d687c528e8855d0263", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497637, "uuid": "fb30c1d0-e391-4399-a964-f4262f3836e1", "comment": "Malware payload", "value": "ce6f51ba94367381cc199982f32bbdd45de52c39", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497637, "uuid": "91335cf8-cd03-412f-81c5-79221d13f3e3", "comment": "Malware payload", "value": "f3f42637f44d9d7dda925289d2a3407804215370f45a4b3baa368d4003a691138d6a826b197f1a3f8ae688136d49410c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497637, "uuid": "bbcd4507-f8b5-4507-8aba-dccf8be539da", "value": "T1EF36260115706DCE35DD05EF54912A5DBB1B25A698BE1CCE0C6CF2C28BBF509B902AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497637, "uuid": "a1a2db44-5ff9-4e15-92a5-4a032c4babf1", "value": "768:sG4eYeG4eG4eG4eG4eG4eG4eG4eGYeG4GeG4eYeG4eG4eG4eG4eG4eG4eG4eGYeb:K5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497637, "uuid": "3903a712-1a93-47a4-b5ad-2864515ecd32", "value": 4867904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497637, "uuid": "f984e6b8-4d20-489f-8f72-0a3beea102de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497637, "uuid": "52a8e0a1-68b0-440f-835a-a9d4c74ecfbf", "value": "envifa.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948f623b-b28a-11f0-91c6-42010a9c0006", "comment": "Malware payload (OffLoader)", "timestamp": 1761496871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496871, "uuid": "1ee89ea8-20db-4636-b5bb-862a38142a8b", "comment": "Malware payload (OffLoader)", "value": "3f09bd2cbe4b32a20c6ed9d96e6b8f28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496871, "uuid": "f81b4c94-4403-442b-9409-650b1023c026", "comment": "Malware payload (OffLoader)", "value": "53ddd2aa1a419ed06e97fb6a00f6032288cdfafc1288707a4c1cf28e95778c78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496871, "uuid": "22497908-92f2-4544-b59d-35a517d2538b", "comment": "Malware payload (OffLoader)", "value": "01c099203d7f9347a049c347d982911d03ab44e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496871, "uuid": "e84ecda1-a42f-47a4-b7a4-b6e50d5cee54", "comment": "Malware payload (OffLoader)", "value": "30430ba6a7a3d20bebb82366c83ea7b7517a076621f93fe93fd000ff7acab4030c69d430b4915e67ae283f088a52ec8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496871, "uuid": "612d9225-c564-4105-9636-6e882ea68873", "value": "T1A895CF13F24E673EE46A5A3649729A50443FBE60641A8CA3D6EC3E4CCE391601D7FE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496871, "uuid": "bf7874bb-6cb9-4b43-863a-edd16253d639", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496871, "uuid": "4b1435fa-9092-495a-9b53-f5e3181a5900", "value": "24576:pXkwiiUWhWXKaOEMrNRNf+2CyF7KDFbJnPrUXsazZ+Jsp1B34FGohdN1YL/iM7pv:pDXrZDCywnjUX9zZ0U12GIyNtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496871, "uuid": "0da00653-675e-4eb8-bc94-aaa56e71b9dd", "value": 2041982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496871, "uuid": "dfdb5ed1-825c-44cf-b66f-974d3a7adc62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496871, "uuid": "184e8fb2-d957-48d7-8cb9-56c872666ea6", "value": "FLStudio25ProducerEdition2515Build4976AllPluginsEditionAddonsWiNPluginCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2e91e5-b296-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761501823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761501823, "uuid": "b1701d8b-3b41-4f5a-bedf-e9b67f1b9660", "comment": "Malware payload (Rhadamanthys)", "value": "d392487c9fffd711de75e9ee5630128b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761501823, "uuid": "8146d225-a6e9-4ea3-9df6-764e04ea275c", "comment": "Malware payload (Rhadamanthys)", "value": "5454c752972ea61fa619b6b687597e86f54ed685b92f1e5beadf65791adbe130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761501823, "uuid": "9978a7a4-4491-4aad-8a32-1654a8d1e113", "comment": "Malware payload (Rhadamanthys)", "value": "f3793302a6bf3d1176290cf8a91f8da655394a8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761501823, "uuid": "4932c6b4-ed7d-4583-8fb7-3a495a4464fa", "comment": "Malware payload (Rhadamanthys)", "value": "5af04e563e4ebb52da1fc9716ae244c0ddd37ff746d17143b37d8f59c264490fd4a66e92c5d215cf852b507477f34370", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761501823, "uuid": "b1444012-1dc5-4d0c-a07f-5a1789a0bcb8", "value": "T167E5390E6C90296AC079AAB589E241667721FC474F3363D33A94BF3D2EF26F00A75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761501823, "uuid": "f0002c75-0892-4df5-9139-aa259f994845", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761501823, "uuid": "374014ab-62d9-4fb4-a3c4-249fe8189f55", "value": "24576:/WiOrcAcYf4fbzEaKRcngKFG8x4DQsMKRb5ctyIjfGWD4F+J0DnkIyVKXZP:/NiZcYyzEhRcnLFG8x4DtMOb5Y8KSHpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761501823, "uuid": "6cefbc8f-5c80-4677-a612-0b17feaa9a9d", "value": 3070368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761501823, "uuid": "1442c428-ddb6-4d14-9fb6-16031b66c083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761501823, "uuid": "80714168-7c6e-4785-81c5-30ead36f3948", "value": "Bloostrappper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78621787-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761496394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496394, "uuid": "9a313c4c-ff04-40b2-a06a-907c96bf5445", "comment": "Malware payload (Mirai)", "value": "b7db1c7ba5e02a8c4ac21a61cab649e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496394, "uuid": "0c6e94f3-c772-4264-8a6f-5475f418f1b1", "comment": "Malware payload (Mirai)", "value": "54f783d7276c97d4e98a97770c44c9bc5654c7a336b67c5291fba6a3553a00f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496394, "uuid": "81c6c726-4bea-42db-b80c-69d85d94d74c", "comment": "Malware payload (Mirai)", "value": "db37d598b1fea97258994b9e5c0e6fbdf15b7a3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496394, "uuid": "7a071837-41b8-4316-bcd9-15648f63fc8e", "comment": "Malware payload (Mirai)", "value": "f9c209aed9dc48b491fdf9d7cb50b69b827e4bd1ea5138c069c3d1de7d06cf814878e71ca83582b4b5ed6d383ecd599c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496394, "uuid": "46ad816e-178c-4990-88fb-65a48f8abf98", "value": "T1FAD2E1F57950EC3694130875C6AD82C28AFF0DF8D2F1B922F4966F94AAC750177B66C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496394, "uuid": "4993484d-9de1-49a2-9c8a-adab20acee55", "value": "768:z04gELzdpJsB1LhdOdc/+tkp8vSgs3UozMM:zRPLzaB1LqC/+tkp8Qzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496394, "uuid": "531df6e8-93a2-45ec-9e93-6c79139c33ea", "value": 30088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496394, "uuid": "edd97abb-5543-49ec-ac74-0e0ee948af4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496394, "uuid": "643588ab-7735-424e-a86b-3fb3595227d5", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379dcfe9-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499722, "uuid": "2f439ffd-13d3-4c85-9f8c-7f680beda1da", "comment": "Malware payload (Mirai)", "value": "bcd383b40c12553b6930263f6c06639f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499722, "uuid": "d0e05bb2-091c-48e8-b502-40138440b640", "comment": "Malware payload (Mirai)", "value": "555d326ab038bdbf052683b6a1dde8185d5903a4b4869ee11f4df99afa8714e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499722, "uuid": "f3a9c82d-fd4e-4b32-a0d7-18ab1d837359", "comment": "Malware payload (Mirai)", "value": "1a2b352eb776d7f2fa4b166059d36f809927695d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499722, "uuid": "61fd7d25-ffe2-4d93-9d9e-b7597d50e175", "comment": "Malware payload (Mirai)", "value": "f54c65adb0d1ec8622feeff48a34b56f370da874acb5f88b612693c21e9611489dfa264cc1f408be630eb26ea2ea316b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499722, "uuid": "b0412cdd-b9b2-432b-b85c-c8a5616eb23b", "value": "T1E9F31A56E6818B07C0D2277AFA9F42453333AB54D3EB33069928ABF43F8679D4E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499722, "uuid": "4a7bb7bd-7916-4ca2-97d9-36fbef88f687", "value": "3072:x97pfoRrchaseNVrBKtTE2A437cjxkp8XqjboaPobjM/9jbxZDY2mNw4fHxwd4C:BzhasiVrBKtTE/4Zp8XqvoaPgM/9j9Zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499722, "uuid": "fa80fc72-5bd7-4fdf-bcea-327ed99fa981", "value": 171175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499722, "uuid": "87f3eed0-034b-439d-a3a1-391facf3f518", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499722, "uuid": "8562fa02-fb3a-4d90-b773-ee9ca9c2a9b4", "value": "kvariant.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1e748a-b20b-11f0-91c6-42010a9c0006", "comment": "Malware payload (N-W0rm)", "timestamp": 1761442207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761442207, "uuid": "e4be7431-b8f2-4476-81ab-570aced1efc7", "comment": "Malware payload (N-W0rm)", "value": "ae1b1acc48fa134ac5d08c4a3d26fe28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761442207, "uuid": "7b5160cf-a868-4ea7-9f32-79c00fa2851d", "comment": "Malware payload (N-W0rm)", "value": "58a3d09a3441a1efaad03f681a6fb488f33f2be4b6caefefcfdfde3f6797329f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761442207, "uuid": "445d17e6-4188-4970-9d55-60f50ccd9be6", "comment": "Malware payload (N-W0rm)", "value": "ac4d55c67871eca22433a8795472db2f5bca8a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761442207, "uuid": "5953c00e-71c1-4851-b447-8c25d6ed81de", "comment": "Malware payload (N-W0rm)", "value": "6f5c81048625241a0442cb76bf29780ee85e5a8b26e9a1d1b43e899226522a466301f4c37d0bfc4a9b8e6a8b1e8ac81f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761442207, "uuid": "827a9d4d-0e53-4928-853d-3db4891dbc22", "value": "T1B265383439EA501AF173EFBA4BE479E6DA6FB7333B06645D1091038A4723A81DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761442207, "uuid": "b998f8ac-86df-4a01-a328-4e57881cfcbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761442207, "uuid": "c67f740f-48a2-4b33-b324-67eaba5fd501", "value": "12288:Fyv1Lu9pZZOZHiFXwg2+/Ni9lbO1ps3SNOHM9ozOdtUQVU9yMc1JAKFr49Cpio2F:IBubhveWTnUwoQioaJJfPS8p9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761442207, "uuid": "8087bc01-6497-4f46-98d7-cae859dfdb02", "value": 1476864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761442207, "uuid": "dee434cc-d7bb-449a-aa27-48b101987d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761442207, "uuid": "31ab60f7-1425-4146-802e-38ad5adebbc7", "value": "AE1B1ACC48FA134AC5D08C4A3D26FE28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e282595d-b2be-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761519336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519336, "uuid": "ec28eed0-a068-4b0c-9b84-0b06bb4b057e", "comment": "Malware payload (Mirai)", "value": "e3a7ba68f5183efe6024f02ade604f95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519336, "uuid": "f5d945f8-bc94-4006-829f-5686d1b8fe56", "comment": "Malware payload (Mirai)", "value": "58a54240aacc1b7a090f2a4ece023707ebc4629fac9bbf3ccff1f0fc00c0221e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519336, "uuid": "319de5d1-f72d-415f-8242-b20562fc762a", "comment": "Malware payload (Mirai)", "value": "e4f41fb04b9410c40a4e2c07ef08219799e5e1ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519336, "uuid": "3639b809-cb60-4477-af7b-d81cabe77bf0", "comment": "Malware payload (Mirai)", "value": "5c961314c9e921517e93f8f4f497fc1d6f004104a603022d0f9222dd20b554d257cadbf112ceb5d9d9c65d844eddbcd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519336, "uuid": "aafc64a8-37a9-4a51-a00c-39e4dd377349", "value": "T17603F113A5C85078DFFC403A956E25FEC240F6343660E5FDE5C0693BEC466395A2259F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519336, "uuid": "45157684-3b1f-4c8a-b32e-b23f9311a45c", "value": "768:YkSmoB8y+i4MoqexE5dZckkc1BAR+XkgMi+fvRpTUBi7N0IFAlTv5nbcuyD7UHQk:YXmoB8yR4X/m5bcvuV+fjYeN0gAhBnom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761519336, "uuid": "98d3ce06-0220-4f95-b474-94b95997cb57", "value": 40020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761519336, "uuid": "cddd8631-19ea-43c2-808d-2c13bfd5e98b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519336, "uuid": "68841b82-d410-4e4b-8ef8-4ac2300b1bc7", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3265ecb9-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761516893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516893, "uuid": "a85db15d-932c-417a-ab93-820866b56b5b", "comment": "Malware payload (Mirai)", "value": "f2abab06516e06bf3348811c86f971e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516893, "uuid": "82e1e451-9b7c-4da3-9524-9b0e3bd1aa6e", "comment": "Malware payload (Mirai)", "value": "58bcfccae6b136e1aa24abe667742f73aaaf25b60a7c669a595c3d02997d86bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516893, "uuid": "0f604a74-8993-4919-bba6-4ab1983f04bd", "comment": "Malware payload (Mirai)", "value": "985e7edd81402e31424c5b3659558ee52c69d2c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516893, "uuid": "9c23ae32-6168-4ace-a834-21ccb3a8d49a", "comment": "Malware payload (Mirai)", "value": "427aaa16b1708d2c54b5cc41ec9db1799c94c848946f8cdbc503ac135c0e4726ab96c3f08b089788c814f74cc5684321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516893, "uuid": "db84d7fb-8309-4cd9-bf41-cdfaabdc6ad3", "value": "T168C38DA47A4F7C91E3C7E37DCE454F32711B75F4C66193A4BE12432DC0EA8AA8AE0551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516893, "uuid": "a980b91e-4922-487e-b7ca-046974b20560", "value": "1536:DetGnmgwg3i8U06FCpTCtstD4VAXV+ExdrBNQgM6ZxlcenG:DkGnlh9nNmm0VAXV+Ex7NlxWenG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516893, "uuid": "5c0f66b1-8dbe-4a03-a976-ac5a9a2f4586", "value": 120664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516893, "uuid": "c412f30b-af37-4084-9e1e-95bf8be66e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516893, "uuid": "96b6c433-3284-418b-83e8-a6ecf7ce0a0f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f6b999-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518637, "uuid": "f60d0b77-5fff-4fd8-bd7b-ea7389fc8db3", "comment": "Malware payload (Mirai)", "value": "4f9d89384e1337bfa23160aff475ab6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518637, "uuid": "d07304aa-3264-4849-9e08-31dfd9a0a066", "comment": "Malware payload (Mirai)", "value": "5975354a366d40c615b06951a7df659261c67c7d9999f8355b8235d996e65f5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518637, "uuid": "4558b995-26e0-450f-8259-83f9b6fad171", "comment": "Malware payload (Mirai)", "value": "4e8e78e159c1f610272b324d1c2181211b965d1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518637, "uuid": "2ba4ebfb-f4c6-458f-89a7-aed070fd5711", "comment": "Malware payload (Mirai)", "value": "bd6bcde037f205c12bd5cf886d40a4158dcb3a7938f79837a2b6a7bfc34e7802b2a462e97c1e3299af1c78a0e932a050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518637, "uuid": "30c53329-c3b1-49da-a856-977fc6634d03", "value": "T14023E230ED59A916C1370C77D1CED7D9237907B8AAE5A0708908DBA52504EAE74B3F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518637, "uuid": "3d36a4fb-a277-455b-8f8f-609421a5dff2", "value": "768:FvfzF7YK3CL9SNMDOWv/xNsxMlplSzrxbiXdy9f0IHc/AaWs3UozE:hfzF7YAChMULvZmMXl2titPGcIa7zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518637, "uuid": "cd7b5c84-6635-45de-9420-3a36667269a4", "value": 45660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518637, "uuid": "24b9f22f-bb31-4d37-bfe2-166486822eb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518637, "uuid": "f1d36ad3-bbfd-4626-9bc5-c046777606c2", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58aa0078-b2c4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761521681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521681, "uuid": "338ddff7-1674-45cb-878e-1445c8d489e8", "comment": "Malware payload (Mirai)", "value": "77b43d0a4c6168b9c0d192d6f39491a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521681, "uuid": "0c1dede0-5035-4f84-8e09-1637dc3e1376", "comment": "Malware payload (Mirai)", "value": "59f20607bf8bb5b32d98336aebbccc79833cd4d09b6469c87d67c04752110839", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521681, "uuid": "60fbb271-d1e1-4716-b94b-3aac14c025ce", "comment": "Malware payload (Mirai)", "value": "e66e9e5f55ae8e47bc5dbdb8c510e88957374a2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521681, "uuid": "f0bff8d9-9678-40d3-87f8-9272e0613380", "comment": "Malware payload (Mirai)", "value": "8a4e25dd6146e0a22d9101ab34ebb360811afa7f6b138abae8cde543d52566982fe22a7fc6f77a3d0e2eb9cb17e1021f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521681, "uuid": "3e00a655-25ff-4e04-8917-6270df562c11", "value": "T170F34B46EB414A13C4D6277ABA9F424633239764D3EB33069928BFF43F8679E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521681, "uuid": "ca8fde49-1cbd-4d1a-ba99-657f2d4ab07e", "value": "3072:PQsX9JUnI3BFa7qqrBm5cilXV0CcV50Pk2y5NzM/9iYI4:YsA0na7qqrBmuiliCu5Ak2y5lM/9i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761521681, "uuid": "c2b046f3-17a8-477a-8186-a895fc1c109a", "value": 170548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761521681, "uuid": "1efbbed1-306e-4ece-853e-02406ac29d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521681, "uuid": "10de4ad5-b38a-48ba-8f9b-88935ab853f3", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f859ddbd-b21b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761449364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761449364, "uuid": "d8f3c60f-82d9-4fca-a325-17e73f7edaa0", "comment": "Malware payload", "value": "7482f57b6936a865c9928ae57ed10b6e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761449364, "uuid": "7141cbc0-bb27-49d2-a9d5-edbdba31aa47", "comment": "Malware payload", "value": "5aa7c571c4fc5b80a431795ad84b379b4327f63003c649c9dff1462ad0d253ed", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761449364, "uuid": "f6c3890d-fec4-4838-8805-38454349efd4", "comment": "Malware payload", "value": "36739c7246eff11a3b2aea2fa6f467f900cb2d8c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761449364, "uuid": "c71d7978-b067-459f-ac2a-b79ad7996afb", "comment": "Malware payload", "value": "54c3c803ed85820e0e415aeb56dd7b50e1424c17f5e0c0634279c4eb62bb9c19fcb9a666ac023fd19fefba6b8a2bcb87", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761449364, "uuid": "df70dad6-ca74-4dcf-807e-3edb0d946610", "value": "T1ED261267EB4AEA61E7BBC6368366062369250C994343F3531B86B13C0DF7DC05A95FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761449364, "uuid": "2094b4c1-84c2-46f9-8465-894bfe912e28", "value": "98304:ABttfMgrUAT/LxrBqrp4CF2DPv9BWko8u+4ES+iEQzwo:CtfCVcbvakQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761449364, "uuid": "66d13b4f-0820-4272-85fe-2d2d62e1a7bd", "value": 4706191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761449364, "uuid": "df993171-d796-4d8d-8e94-fe4eefe946f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761449364, "uuid": "5c4a4979-ed33-4581-bf94-19a1a3f4cd9f", "value": "tk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7d2f3c-b2bb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518092, "uuid": "03303fec-bc58-47ad-8368-e2a846732171", "comment": "Malware payload (Mirai)", "value": "7c47882f948856289100a698d3cfc849", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518092, "uuid": "01714f57-e502-409a-9620-6ca90e2e3f72", "comment": "Malware payload (Mirai)", "value": "5b3166401732f121104eb3a9b52ae6faa051378e25e6bc9a714e40c96623c6ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518092, "uuid": "4d2ed7f3-12ca-49d0-ba78-0cf0e3ff823e", "comment": "Malware payload (Mirai)", "value": "5821fb00b591f277140abba6df6f176393ab0036", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518092, "uuid": "7effc4ee-ea50-47fb-85a5-72755c9f2b97", "comment": "Malware payload (Mirai)", "value": "0fc5f19d4a8de61362b4e06185cdc6935859f466c2445a7f21b65101ccd012b07f0c1ace2d95654bba0774d2dd733e09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518092, "uuid": "6f020377-77f8-47ae-8ca4-1ed7a9a192c8", "value": "T1A7739C63CD291D98C65C85B975A48E3A4363E8105A972FF2069BCB37D047EECF50A3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518092, "uuid": "e320a144-cddb-4ec7-a0b2-48b7e7c57b5c", "value": "1536:P/wnPdzP+Tv1i5PA7KhDpR7zRf1hECe3+IG1Z:PonPdGJi5PA+hrZf1hE1piZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518092, "uuid": "9f670499-78df-47c0-9e30-b2f5083ae9d7", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518092, "uuid": "1e2a494e-2b8f-4b59-a782-1325057c7313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518092, "uuid": "22207092-256c-4d8d-b02f-e663151ec907", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca157bf9-b292-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761500397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500397, "uuid": "4a1e850b-0c16-40d1-8bd0-3b42de9e61a2", "comment": "Malware payload", "value": "4c21610392959241b0b42c186c24e9df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500397, "uuid": "4a2495be-7447-4586-8c5b-7a1c9e5a53d0", "comment": "Malware payload", "value": "5b923a5d38806fac26756da26042aba4aa6f6142a1946bdf3724a30243ca8767", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500397, "uuid": "23619446-1409-43d6-a436-e2bfb2f2e74c", "comment": "Malware payload", "value": "e199ca27fa56ad1b72760173e2d514c76fe0606b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500397, "uuid": "05067190-11b4-4b21-be44-291e399af14f", "comment": "Malware payload", "value": "ce0fc66ccf0f4a152551a25e7dba299e21dab7e8ef38515c5863ec5ebaab1bb09e6968536b7572e6aa257fc829d4853b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500397, "uuid": "7bbd5017-80c8-4fde-b8c2-87c2a381405a", "value": "T16443019EF3D86F48D89C20B013AE56075B6411EF6B25AE50D73CF7DAA5BCC82B41448E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500397, "uuid": "a716800d-2538-42d7-a101-5e5b38f5525d", "value": "1536:zCo8ud6S5uDIcI8c3TsBp0rGihAFbGiFbwLUAQp:mo8etEsXjsBpwG7lrFbwLHQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761500397, "uuid": "1e256c12-247d-4e0c-b0e3-bc111585303e", "value": 60232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761500397, "uuid": "86a93264-177d-4022-9402-7abf49437a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500397, "uuid": "9e04a1b8-c085-4e36-8ed0-65b27db42555", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.21303.22015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897647f2-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469365, "uuid": "6ec891d0-1e9f-41f1-b9df-7c8666521bf7", "comment": "Malware payload (Mirai)", "value": "b7859f32ca8316896cf90ac517c08c5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469365, "uuid": "ca885cfe-825b-4e0a-ba76-094d191414bd", "comment": "Malware payload (Mirai)", "value": "5be717db9acfcffc8c61825e8f4c6bc6e7306f6599c50637ec9f79bdf7ebe3db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469365, "uuid": "ed239207-76e1-4f81-bb24-7946f80db6d6", "comment": "Malware payload (Mirai)", "value": "793199946b6bf60fa3e92aa0e67c4c08a90cbbcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469365, "uuid": "e2a00062-8aae-42ae-8acf-a0de13fd062f", "comment": "Malware payload (Mirai)", "value": "23ad6fb3546c4ac53c495de38af43698bdd94372739b82a1715098b598d38b968032b21eaeda63c7733efbd859a9b649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469365, "uuid": "7e236930-65c9-4c89-8fbc-e488683cbda3", "value": "T136E34B067FB00FF7D85FCE3702EA0722248DE85523926B727138ED68B64B58A55D38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469365, "uuid": "1e132830-e227-488a-bccd-8738a0d098e7", "value": "3072:xXi2uwfdAaCS9TpIn8KbmGkSTPcuwbZn+ATdG:xXi21Om9TpznycuwR+ATdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469365, "uuid": "d2af6d77-f91f-4614-9ea0-a849f5e35cd4", "value": 152503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469365, "uuid": "d41e48cb-18b1-4e04-b634-5927d8e8d527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469365, "uuid": "1e30f225-628d-4596-8fcc-353b97b3f996", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0390e1d3-b230-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761457973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457973, "uuid": "e7d3decd-35f9-4494-829c-e364b6fdc36c", "comment": "Malware payload (Mirai)", "value": "aabeb6ffb5f64076798b021a1c19cae3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457973, "uuid": "32a0691f-bf2c-4e38-98b4-7df62e1363f6", "comment": "Malware payload (Mirai)", "value": "5d329b1fe391bd18f14cd599edf2a5b61a6577c6129695355233fcb1e79c815e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457973, "uuid": "471e6549-ac32-4015-8c56-b1cdc94e2a7d", "comment": "Malware payload (Mirai)", "value": "0d47ad131d3c3f797901483d3150ebc82a76be2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457973, "uuid": "4373350c-e34e-4c70-b2e8-98f4e335de2c", "comment": "Malware payload (Mirai)", "value": "fe5f7729311f27352bf213388dbc1febab4f164913200d3165725ba2f35563e0cd2be659c9db222ab355315c404a7b60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457973, "uuid": "54ce6424-39d4-4076-97c6-46152d52e72b", "value": "T134148020FA0663F1CC721A38A79A2E4A6E7B14155FEB16316D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457973, "uuid": "d62bfe2b-d681-4b23-8550-74a3fb53d984", "value": "3072:yG0G3AeCBf+hZNmdeQ+nH6JnwnKOKdrOCIU4FOUwk:yMEf+zNweLEnOUOVt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761457973, "uuid": "69a4be19-8772-4721-a0a4-2767cb1ebcef", "value": 193268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761457973, "uuid": "6d728f07-8429-45ea-9664-03e343c25f9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457973, "uuid": "49f97ca9-2e96-4fa6-8b5e-dcd4031afa26", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876a6f4a-b288-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761495990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495990, "uuid": "f739ec5d-631a-411a-8fa1-a4542cbe7ee1", "comment": "Malware payload (Mirai)", "value": "9f604e6cd282da89803ed11fb132a951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495990, "uuid": "dffa2e46-5018-4915-be18-91adef2288a3", "comment": "Malware payload (Mirai)", "value": "5dae660d25ddfbd60b7519a11f5cd1e650cddba7f4b362ce1c3a503841836784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495990, "uuid": "f44da047-d537-4491-8184-208f61a5b055", "comment": "Malware payload (Mirai)", "value": "524f779bb5c355bb322eebd42e59cc00265d4c59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495990, "uuid": "46a20aa8-0534-4501-9ee5-0e05b15455cb", "comment": "Malware payload (Mirai)", "value": "512e4cf03fe8124da1b78295d1529fef94b38b2396de69bdaa696253fd485832698bed6a2d4a9b5b3cbeb6556b322153", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495990, "uuid": "c4b894bc-0c43-4d0e-bf4e-cdc8fdf3a82a", "value": "T115B3E809AF610FF7EC6FDD3746E90B0529CC654B22A83B763574D428F64A64B0AD38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495990, "uuid": "1fe0ad02-ce8e-4ceb-b593-f2878119fcde", "value": "1536:P1PmNMPHuqxu8JcW5bU80iFfLeSj6gwsDYXc1VmvwXIRYZEOuz7cNvWiGg/M/rUY:tPUqfrU8plLeicw4RY3uXg57jOta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495990, "uuid": "a1d60e02-3081-4f3f-a271-2852dfd3098f", "value": 115492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495990, "uuid": "5b5b6ff8-e5d1-4b8c-b570-6168de57129c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495990, "uuid": "0c1cbbe7-e34a-4f74-a068-f4edc1812581", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d424c1a-b23b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761462714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462714, "uuid": "7201e76e-256b-4c41-8258-a6ab2f95b442", "comment": "Malware payload (Mirai)", "value": "ba1f4ea519d925a4f2a7686a70f1c8d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462714, "uuid": "7c937c4e-957a-4fd4-8ca1-9f8273032f1d", "comment": "Malware payload (Mirai)", "value": "5e0663a0756c64c911dd23f0cc7c165cf90d4f48ed212528596ee32ec4d57cd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462714, "uuid": "c30cd258-e500-4c21-88b9-33061c3a8617", "comment": "Malware payload (Mirai)", "value": "791e13eb251a0f5aecaf20b5b6faad12618b4465", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462714, "uuid": "ae9f7b94-56ab-4956-bef7-6844cfc02f63", "comment": "Malware payload (Mirai)", "value": "a767d78c4ee0bedc60305a89070a11dd874e363b544eed996ee8ddba7064224b9d7b4284cb1bc3d3f2254e3842bc952a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462714, "uuid": "cfe0dd94-85f7-405e-bc2f-e5de87dd1f7c", "value": "T16BA3E0947110FB46C02671BD70850944E7B17EBA2B9A660A5473BAF47DB8CE43F07EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462714, "uuid": "c277ee80-726a-4e15-9a9c-b234f734267d", "value": "3072:IN2ro9e6/oumQUX754hrrab3S8L8lhwu2H:ITEMXmQUL5vTNL6hwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761462714, "uuid": "d9632859-68a1-4020-854a-4bb4b6c13c77", "value": 99728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761462714, "uuid": "1a07ed54-df65-45b0-9a37-e4fdc1254d7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462714, "uuid": "b177ef7b-93a2-4da8-afaa-68ee004e07c1", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b2c358-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497148, "uuid": "67f3ce20-6623-404d-be79-edfb04eebb26", "comment": "Malware payload", "value": "6784b71f64f2dac2622c5d488f92f9dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497148, "uuid": "3b43d30f-c543-4de5-af80-ac950c17dcc1", "comment": "Malware payload", "value": "5e0e26fb7dc90f39def0fd79805143a77d69c3b6376432d5a0b7aedb637e0349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497148, "uuid": "1576f19e-1ad6-490e-965d-148d532f531a", "comment": "Malware payload", "value": "90948fe1eefc69ef1e41607a1f444ec910916030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497148, "uuid": "bacc02f7-41fd-4c96-947e-5ac5d891169d", "comment": "Malware payload", "value": "27c1831e1810e99464bc53856d982f5f0117139ba2ec90c29d908cb39fc07002e97a302cd33d4dd2d1f03480ba21cf2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497148, "uuid": "72bb8765-feaa-4653-abff-d21b76cdfcfa", "value": "T10CC65A57ECA145E9C0AAE1348A679217BEB17C485F3063D32B60F6242F37BD0ADB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497148, "uuid": "2b63424d-60d8-48bb-b393-d147b1e7ae80", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497148, "uuid": "049eb3ce-1b7c-44df-aed4-fe7d4817c1fc", "value": "98304:mA9yq57hgFC8THbXjyeuL4nXLiEc2Lq//Rfc:mA4SkC8zbzyeuUTDm/pfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497148, "uuid": "5c3fc01a-dff8-4140-b850-26e0381535d1", "value": 11534336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497148, "uuid": "79307ba0-0907-4639-abef-c033a0a93b01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497148, "uuid": "59b33186-072e-4d8e-9890-d3387bd12a77", "value": "6784b71f64f2dac2622c5d488f92f9dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b87f83d-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469368, "uuid": "f212ac13-b4e5-4b71-81cf-fe7c1c60e920", "comment": "Malware payload (Mirai)", "value": "f02320819624500e55b0c428b194cfa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469368, "uuid": "b432cadd-48cb-45ec-9b31-8a4912a1571e", "comment": "Malware payload (Mirai)", "value": "60abbb13769f245847636b7acdab4aeb72dd5efa608a868be2c53c170b0acb6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469368, "uuid": "c5baeccc-91c1-496a-9f97-c452eb29394a", "comment": "Malware payload (Mirai)", "value": "1b3ed34cbfcde113d06c63500c8e4fb2613dd614", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469368, "uuid": "c857d1b6-84a7-4129-a682-e039b8530e1f", "comment": "Malware payload (Mirai)", "value": "f1e5fcbc5d510eb9c7369c7e6cd06e22cc31f343ab6825bf79fd74f0d198238107bb674868754bda0e0070073fd5da3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469368, "uuid": "6668d6fb-7722-406c-bf8e-45cdba9acac0", "value": "T18124D71AEF510FBBD86FCD3701D81B0225CCA45722A57B763278D928F54A54B4AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469368, "uuid": "5cf7287c-ffae-4eaa-b77a-64bb103a5238", "value": "3072:es4wag0x68ih3V5EdgHlaiu+oICrtB/U6hh16582M:eLzgF5fa6YtB/+582", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469368, "uuid": "c1815f9b-71d4-462e-b387-579b175afabb", "value": 214908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469368, "uuid": "ae4ba43a-d814-4a37-9ea2-ee4bdccb2e53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469368, "uuid": "7e9876cb-61f7-4f15-aa75-74157322fe79", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d770c5a7-b224-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761453175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453175, "uuid": "5f1a27e0-e8ec-4b87-94dd-182a89368831", "comment": "Malware payload", "value": "f418de790bc97251d1f5e4c377c4f225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453175, "uuid": "241b090b-ad85-46b3-932d-6e474f9bf5a7", "comment": "Malware payload", "value": "636e6d69c42b6e203e9a1552373d9658ab382f2064a90b7cca8777d2ae7b993f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453175, "uuid": "f1ca5bd1-7f2f-49d7-8540-c9f14c4c2492", "comment": "Malware payload", "value": "614242b0c505d5513c7432f14e52697c0b5d2550", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453175, "uuid": "199793c1-cf8e-4612-92cb-99cfbdb3adcc", "comment": "Malware payload", "value": "8f06d1ef11098c9cbe404182ddada4f6e8ef65cdf578e5f4d74c48f1bf4bc0875fcee3878d2addfb176fdd8fa62bcba1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453175, "uuid": "2c380c68-05c4-40b6-80bd-58b400b686fa", "value": "T1FC6302E70218CA75DCA09D325E06EE5BFAA35833266C70D2B887B7D664C1601CA7DB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453175, "uuid": "4bdce060-d6a5-4a0b-aafe-6d4c406fbfae", "value": "1536:+j81gzMOTg4T2aQsaK6ypybsdKoQWX8XFIUKpoQorZ:+j81gzMOTn2kybsgJWX8XFIUKpoQSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761453175, "uuid": "200be269-59eb-4998-9b44-828cca67cb2f", "value": 69516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761453175, "uuid": "82797a90-8f9d-4f85-89d9-f47648f27385", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453175, "uuid": "e453adcd-667b-4f48-812b-cf90b20780df", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a62652-b2a2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761507119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761507119, "uuid": "4468c90b-d72a-4129-9a24-2a398bfacc4d", "comment": "Malware payload", "value": "c4ff8cf795c0a099ebed5be6dae3167e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761507119, "uuid": "cd48e990-7de3-49e9-b33a-81d0749eb299", "comment": "Malware payload", "value": "646bf45d8d0dc1648ed4f0d6d29bbc1f10f94a0ae18dba1783e8e177ccd158cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761507119, "uuid": "21b012e4-40c8-4fb9-b002-ea6d27a3293b", "comment": "Malware payload", "value": "b6521505963add407a39606c8d2fc690c0c54edc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761507119, "uuid": "5334f156-509e-4e85-b463-20f1e779fd2d", "comment": "Malware payload", "value": "b84026b5aa7549d5ea08895c50da626e218cfd2bea100fb7a743c410cb7ea5cabd343adaa7c6116e1f323e3e66afd125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761507119, "uuid": "0316f212-2384-4c6f-a7c3-79a7337ab186", "value": "T1ABF523A4BED9DEF8E02FD3703551010DB22A3B724A3C55BE9B98D4299C9663C5D329CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761507119, "uuid": "9e9115e4-099d-4b71-a542-16f1536e0f0d", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761507119, "uuid": "73b0740e-9c79-4599-af2e-e2b22f0a6478", "value": "98304:Xatb0OU25qvFpLD8TkBxae8WP66VJhvKnJ8PAe:XQ4OUbnD8YBALWPJVJhCJ8Pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761507119, "uuid": "ead6133a-c4ac-4e29-a8ea-e0a51249527e", "value": 3562928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761507119, "uuid": "3f2f072c-bd53-48bf-99c3-10c82a88e7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761507119, "uuid": "741c30bf-2c19-4b64-8de3-f9a8f376135c", "value": "SecuriteInfo.com.Win64.MalwareX-gen.56466393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264bbb40-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516443, "uuid": "25a0dabc-6621-4445-b751-11216e815ca9", "comment": "Malware payload", "value": "0be894ec97eaf57993fd3a4b219333b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516443, "uuid": "36ec30ec-d071-48a9-810d-01c3ec59c62c", "comment": "Malware payload", "value": "667042d2b9e6a7ce756504339331b15b9810dcbc22eab743fb435110669452ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516443, "uuid": "847920b7-5e9b-4d53-b661-20964ca90110", "comment": "Malware payload", "value": "130afe0976c2e2ec82105f214988d51151cc6208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516443, "uuid": "84dfdb00-d6de-4e12-875e-a9ceea783893", "comment": "Malware payload", "value": "1b8c60e871d514d1ed22c8abc568f9d417568334872923165b0c4d1e0b3918b2d3e62f10e96f0cd588b762944f921ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516443, "uuid": "0846d682-52d2-47dc-821a-994b7392235d", "value": "T17CE5591768904CA9D45953328CB652523B7FBC440B3623C32E66B2782FF2BD85A76F74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516443, "uuid": "6009f6e1-fb01-4815-bb78-d499d1b35fc3", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516443, "uuid": "3447ff38-b903-4ac2-b439-0a15050f88e5", "value": "49152:RxzO2mOZMlpkM4ihwpmFLvFiOgaCDIi5eb7m5hCyvoDfTi/PRs:ROlWMThXgaUvWm5hCQoDfURs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516443, "uuid": "15a3d9f7-0218-4a8a-87c4-44661bc4734a", "value": 3222352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516443, "uuid": "fe82eaf3-4c53-495f-a88b-8e112efb1195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516443, "uuid": "f01f6649-162b-4599-a1ca-d349391638ef", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429929b4-b248-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761468387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468387, "uuid": "145da94d-3a21-420a-a521-929498850037", "comment": "Malware payload (Mirai)", "value": "8bf2a46ab7c26551376239f7a36bc4b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468387, "uuid": "cdf76663-2b24-4c99-b9d5-fffa4dd9bed1", "comment": "Malware payload (Mirai)", "value": "68e40cd5aa9af99025c828ada99a7ffe6ef6550b6852b5586f82b48b4c642b3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468387, "uuid": "3fd8925c-bf92-4c59-aee0-3c5b5de6ca8c", "comment": "Malware payload (Mirai)", "value": "4eaef3b4ecf5154639b87cce1b4404d59d4a53f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468387, "uuid": "f18ae4bc-e98d-4e61-bb68-6f9f7816fddf", "comment": "Malware payload (Mirai)", "value": "8811e0a193248e8a1f73110c1ddf73fbcf0896e36d4f6e83e3423d3f0793081b927ba970b4d8f6a316d4953ed8c994f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468387, "uuid": "3940ac46-dd9c-47df-bda7-620546add448", "value": "T17F732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468387, "uuid": "b2126ff7-4bb9-4dee-bd61-5673acd9dd94", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftcXnA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFOXA5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761468387, "uuid": "9aefeed1-a18d-4491-87ea-ce5471ae9772", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761468387, "uuid": "1ad776bf-82a0-4c1f-affa-a6017b35ae66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468387, "uuid": "41212915-16e5-4b11-95c8-687e5c500d84", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301a6f03-b244-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1761466638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466638, "uuid": "48e32f33-2677-4c57-afb5-d1c4ed2faaf0", "comment": "Malware payload (Stealc)", "value": "9ffcb4bd7ce043a758c4a09a298065c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466638, "uuid": "ed4e0dd5-0700-4409-a2e4-2cffa2195686", "comment": "Malware payload (Stealc)", "value": "69c8d607554e50efea2112b0f06cbb3e1c168e911a986c7f1d84fee3aa39f02c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466638, "uuid": "a773f2a0-bf38-4fed-a8ea-a956e396985b", "comment": "Malware payload (Stealc)", "value": "bcaa4ad9f04d82178a6fbefcda2b033884eb3d6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761466638, "uuid": "46ea12e4-7a1c-498b-bb18-cbc5369622ee", "comment": "Malware payload (Stealc)", "value": "4facda0ecb5d866902dea79b9351d25ed8223d30af14e8fb10e9ed52df9bbbc2d96fc0bfa66fa325b352b96e6994df2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466638, "uuid": "ae543995-49ec-4ade-b74c-7e9a8b0fba8d", "value": "T1A6F5220E51C9F846F7DE3EB1094173F987332D5E18A2C6CE6D24B6391E7E29BA936104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466638, "uuid": "4e904b0f-78ab-4244-a10a-ccdd2729694d", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466638, "uuid": "0ccf228d-10b9-4d57-b10f-524cd0843fec", "value": "98304:fmxXFRwMWCPVnPEDHUclEUxQc8J0MXPUYwP:OJTrxVPErU/OQx/YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761466638, "uuid": "c131b5e6-1964-4aee-a51e-adf0f497436f", "value": 3607488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761466638, "uuid": "31ffe388-37ff-4d64-ae7d-d528036eccdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761466638, "uuid": "cf899f2d-b270-4195-a366-301161890973", "value": "SecuriteInfo.com.Win64.MalwareX-gen.31997411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d328c462-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761516733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516733, "uuid": "a5a2778f-c8fc-4b2e-b7b8-1e7905a8236d", "comment": "Malware payload (AsyncRAT)", "value": "2a58d36747b57fa2e55ab971a0adbd19", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516733, "uuid": "f37995f1-cc7e-4708-8271-a3e6cfe25146", "comment": "Malware payload (AsyncRAT)", "value": "69f1da7651fca3c4a3f8f64ee887cf35a658e06feb6af3bac04b8bf1e6965876", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516733, "uuid": "5c3e0910-485e-4665-aabe-57e68bb0b9db", "comment": "Malware payload (AsyncRAT)", "value": "2f443bdb5597b6f203003364f656cfd875e97c39", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516733, "uuid": "65dc0f17-53ec-46be-ae88-195868a095fb", "comment": "Malware payload (AsyncRAT)", "value": "6a0f45b30a66ffef86ebec4b72cbace50cca33fea09f8ac5a66ce045471670fec2f022ff719473ebe80c1d8d85151256", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516733, "uuid": "21666a02-60d3-4b1d-8925-29390c691e55", "value": "T176A3FA077AAAC1A0D2659F36C4E76B0003F8F657B743D61E7D8A134E0A237F6C941A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516733, "uuid": "c80893ff-4f84-41a7-8dae-7df8a5848783", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516733, "uuid": "0f17c275-2dfe-4c6e-bd39-e9454901d0ee", "value": "3072:RPmw4AWuorWqX400QtwzbKfStuJAXNP/x:RP4AWuhLbKf+uJy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516733, "uuid": "814477db-d43c-45d3-a156-50ad1a51af6a", "value": 105984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516733, "uuid": "380a5e43-fb5c-4abb-9f6f-a53593330048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516733, "uuid": "337f6a9b-aa50-4079-99e9-69c5483953bd", "value": "Markegot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9434e8c1-b282-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761493435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493435, "uuid": "b5f4b7cf-da5e-47a6-bac3-a9f5d7893cf6", "comment": "Malware payload (QuasarRAT)", "value": "c90abb378b9b3f91fc28a71a175cd08e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493435, "uuid": "62e42981-d153-4204-ad20-20a06a9f78f6", "comment": "Malware payload (QuasarRAT)", "value": "6a95f54230338584556d3dc370e1da5d4e326aab83c20413d446ab71a8f43d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493435, "uuid": "315ff1f6-0cf1-4619-b9e9-597750e9501a", "comment": "Malware payload (QuasarRAT)", "value": "a68fe7fc77b5eaa4b38ae2a430ec2649c57ef916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493435, "uuid": "98748365-4223-499b-a8cb-6661498454ab", "comment": "Malware payload (QuasarRAT)", "value": "bf9f8737c676f7ca9f55ccbec10c4ef88b20a79886833258538fb8765e48a6bb5fac3d4c4b630235615e3e74dc43e257", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493435, "uuid": "7101656c-a255-4b46-80b2-ac38ff947d3a", "value": "T18615CF5473F48207E1FF1BB9E4B259041B73F442A936D78E19CCA0AD0EA7B808E517A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493435, "uuid": "d99a3df0-46f9-4731-84ee-918c96bf6e07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493435, "uuid": "f85138dd-6bb5-494a-a77b-b3bb8ff58084", "value": "12288:WMen0tWfOzABQyg7oZisqtksOtgg+WLyDrQ9/7Wxdtbiyt/pzduhFsgAuk:PDtWfOZyclOoWLuyWfV8FTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761493435, "uuid": "bfdaf928-6715-4a5f-96ae-af049ff87854", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761493435, "uuid": "8bac7a25-4e29-4382-a550-030103f3d3cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493435, "uuid": "5e7af704-6b7f-418b-87ad-ecd9ed67fb9e", "value": "maple.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7651e1-b298-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761502738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502738, "uuid": "74f5f6a5-a9f9-4daf-a074-1d71e3902dd6", "comment": "Malware payload", "value": "cf5f193179cadd2caabb5af075ed5f3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502738, "uuid": "ec842a60-e948-41af-b1db-935f9ae9148e", "comment": "Malware payload", "value": "6b39cadaae34694f73e752a4f2bbf1e72d869a8699e790543249fb5508c4cc61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502738, "uuid": "94f0426e-c0ce-4560-90a0-b3ccfc6b0e01", "comment": "Malware payload", "value": "a4157556cad31571bfcaf9caa0a73b9b62681333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502738, "uuid": "61c81b56-2ec8-48ca-b354-a8c1bc3ec294", "comment": "Malware payload", "value": "15913625cedd23d1f7e3a9341fed7c617959b5e000069f38faa888ba35e04eb8e46cef234b643b25f4b14473b435c032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502738, "uuid": "8104fe0a-7e7b-4e07-ab45-d0faa3c2da53", "value": "T123188C42A3EA05D5F9FB9A3489E65213D673BC063F3086DB324C176A1F736E08976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502738, "uuid": "2c0d3cd2-5bc4-4b7f-bb11-a2ce538efb11", "value": "138c97d53edd7fa7b543fbfa8d066a31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502738, "uuid": "2618178a-3c8d-448a-9485-81d1fa2b4f58", "value": "393216:XSea8PK65sXgpOdyuM0amG4hAzrZmHHBeTBXxEsiYy8gOVtZBwi4N/Jjs3PS8+dC:XYR0Z6UbyXO51pLhbouqid6btgPdBsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761502738, "uuid": "01a0d0d6-5099-4b89-bc64-57ded8579bb9", "value": 85473849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761502738, "uuid": "2799d96e-e481-41fe-8eaa-5ecabdf259cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502738, "uuid": "5822b1e7-c091-4067-9233-eea38927d731", "value": "AppSetup_1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a82542b-b2a2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761506947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506947, "uuid": "51b07ec3-1332-49b9-9a4a-31872285a092", "comment": "Malware payload", "value": "d62b80f2de3d5d16b3675ada84f2fea2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506947, "uuid": "bfaae531-d5cc-474c-825f-eccb7b4a2890", "comment": "Malware payload", "value": "6b5d0257a8a849f6b7c4a572570a8769d15e2f6eefe3b2d035a1a176c37462e6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506947, "uuid": "493a57a5-d417-4391-9aed-41717b692c94", "comment": "Malware payload", "value": "b82d6bd4acc771bc65191522fe6c4d0babce1c26", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506947, "uuid": "2fad2663-ff64-4e16-a54a-d965ad6376a8", "comment": "Malware payload", "value": "b5977182739fd2dda52d64de4eb5b2fb3ce6502f89cac5b31675a40688344c9a36ea0d85e02edce6edcd4ecaf8c86c3b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506947, "uuid": "2877aebe-6cc5-4c78-abae-778a443b22cd", "value": "T11D1622A13B9A8DFAE042CB319192451FB3117F70E8BA78C61FC165981FA65D53EBB4C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506947, "uuid": "38720cab-7274-4072-97c1-908c7b9f3570", "value": "cbf264ccdd82419f7945d1a6ac4f3a03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506947, "uuid": "a79f57c3-bede-49a2-bd77-887af9a412f3", "value": "98304:dnAfehPO9gJH5NUCJ45PRZUCc0onpyAAvij5xftgK3rrhAG:iehPgSZyuOsCc0UyAJj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761506947, "uuid": "0faf693f-cfa0-4203-86fc-9aee77177559", "value": 4195328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761506947, "uuid": "fd0d77ac-a737-41c8-90aa-3f71229d9b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506947, "uuid": "b22de625-38d6-41a9-95db-66828df7ee8b", "value": "6b5d0257a8a849f6b7c4a572570a8769d15e2f6eefe3b2d035a1a176c37462e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20119c9-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497323, "uuid": "df03986e-bd1e-408f-bb4d-5c4fc32aa93a", "comment": "Malware payload", "value": "26a4e58ea1e9b3f339b62612fd89c399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497323, "uuid": "34aa417c-c51b-488a-b139-877e10d8b5bc", "comment": "Malware payload", "value": "6dd2f839795ade1f3f1d13484946fb466b317b412bfd3dfe01ec58d35db23562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497323, "uuid": "04da1866-eb65-48db-9ec7-fbee4256535e", "comment": "Malware payload", "value": "4eba6bd7a9514e21b57be1bf488101d0a6fb0c6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497323, "uuid": "85a65729-a815-4bf6-88de-e5d705e9a5b6", "comment": "Malware payload", "value": "fa35b736059c3f395ab8d46bad2c5d4861e29cb0e9289736a3b369c94963995413d2056a8a80b436211a764923b826cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497323, "uuid": "a68a8861-77bf-414e-b947-45f142fa9f36", "value": "T16E0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497323, "uuid": "47d3cbce-5c2e-48a2-a363-6e206969f4d3", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497323, "uuid": "8d5c892e-55a8-4bab-9169-f284eb198818", "value": "98304:aWT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:p2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497323, "uuid": "f01570fe-c676-42c4-a2fe-392640d36804", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497323, "uuid": "4ee87aaf-ffa7-4841-b25b-fd577906ddda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497323, "uuid": "3f19fce8-03fe-47c6-bdb4-5f530acb8f5d", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ae4ee9-b28a-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1761496896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496896, "uuid": "b2d26c68-7c62-4ab4-920d-701278e7a3dc", "comment": "Malware payload (njrat)", "value": "496e614ee33a8b2c184dabe650687879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496896, "uuid": "0e0967b8-efc5-4ab6-b1f4-757b1b449e3f", "comment": "Malware payload (njrat)", "value": "6e6f89821d980d1305a0f7a333e529fdb212b10ffcd8e11c32d9a36f3326458e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496896, "uuid": "976dd8c7-a824-4ace-961b-07541b299a4f", "comment": "Malware payload (njrat)", "value": "d2db2d01bd7a084242bcafd2f571e4b3d369d6e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496896, "uuid": "3215c237-c3d2-4d23-9189-061cba35c2aa", "comment": "Malware payload (njrat)", "value": "5c442bda7ff0edbeb97b670bf12512d616fff24f5ceb73a99365986e972c54afeb92234dc32eb5590e42f1aed99ac968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496896, "uuid": "b1c436c0-9ed7-4f14-b4ec-8a6ade668a43", "value": "T1A9432844BFEA4A01E2BD8F3469F655150A34BA63E932EB1F48D168DB53327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496896, "uuid": "1b533932-4ae4-449c-9fd6-7e9162ea86c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496896, "uuid": "a7ecacc5-c182-4a56-a650-5ee919d15885", "value": "1536:5Wv4Dnpe/NoTcwiDESPDJwsNMDkXExI3pmPm:04Dn8ymDRPDJwsNMDkXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496896, "uuid": "4008f1f0-561a-4787-8691-1a6f3b42feef", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496896, "uuid": "863ac177-b57e-44fa-bb71-4e1d577b0521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496896, "uuid": "9574db83-31bf-4331-a0cc-06bb05a38fbb", "value": "Payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baf157e-b259-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761475704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761475704, "uuid": "af6c9f79-bc4c-429c-a497-8ccdfc2c3346", "comment": "Malware payload (Mirai)", "value": "f73ac8bcbbad58f035bec0ed002f5221", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761475704, "uuid": "458d6270-c324-497c-ac44-563110537f29", "comment": "Malware payload (Mirai)", "value": "6efbe1f9b2b5d2c4f5f030824cf9eb276cb68485b222a4cfc6d40b564904ee85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761475704, "uuid": "11fdc6fd-d53a-4225-96ff-9c54ad142015", "comment": "Malware payload (Mirai)", "value": "6de5957150483172fd9bd25132e15baca6c0962a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761475704, "uuid": "36fd541d-8806-4c7a-b2d6-a48c5a2fa116", "comment": "Malware payload (Mirai)", "value": "ef53200bb1f4d33acd702f90f9babdbf787f1eb1f5bb95ebafb250f8ec074741f567d7e878c8a1bc97ac8bbd812d9dcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761475704, "uuid": "3faaf694-bb94-4120-8f05-6c04e9e9bea9", "value": "T17323F992FC4285ABC2D002B67A6E6B8D375257FAD2CBF353F52407502A8A50F4D32F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761475704, "uuid": "bda4b364-d925-4667-a1b3-568514ff7689", "value": "768:Rc36pGk3dQF0a0S+iBn7KZPBED7shyeuwz5V8+ttb+fj3OWmWqxxza4neJ22Iymz:RvQk3dQPnUenuyAK+ttb+7+WmWqxVV2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761475704, "uuid": "7e100842-41d1-4979-986e-949ff27d31d7", "value": 46516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761475704, "uuid": "a79ac494-4c01-4a59-9161-c08efcb98037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761475704, "uuid": "77f4e3c7-577e-40c9-97f6-f698e553dd8f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87eb339b-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469362, "uuid": "eca73db6-21f5-4d7a-8d78-c40164dd7754", "comment": "Malware payload (Mirai)", "value": "da9aaabf04acdf744e44836cb7736571", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469362, "uuid": "efc853b3-2af0-4a94-a41f-3edd49e74ef2", "comment": "Malware payload (Mirai)", "value": "6f8e8de87dcd59938367f3e7f0c451bad251493723a33fb7b11f2517779400fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469362, "uuid": "c2048f38-483f-44b9-b58f-66ccd1bdc108", "comment": "Malware payload (Mirai)", "value": "a108c194475bb890a048aba180b7cecdd29244cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469362, "uuid": "638ab24c-5820-49d0-8f78-23ea310a1ab3", "comment": "Malware payload (Mirai)", "value": "d0e3331f4bf34e318cd0afd54744c604d0f6be43a68f85fce072a07846bba219e03a58ea8764c7f83c27b3b169633d35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469362, "uuid": "8d1deac1-2288-47de-9fd1-189ebfceff72", "value": "T16EF33A56FA414F13C0D61776BA9F424A33239794D3EB730699287FB43F8269E0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469362, "uuid": "b5a513f0-4e13-401f-bbeb-932b2cb8a546", "value": "3072:hcloB4DnIyGGCDG2a2Awjo7DA3TA9Aw1YSwbZn5R64k1V7C8rs3b:ul/JrWG2a2Awjo7DiTAxLwR5R64k1V76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469362, "uuid": "e75de021-957e-46ab-b6b5-81aed53ced7c", "value": 168445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469362, "uuid": "022e0884-5d3e-4b20-9a0e-c2fe5edd4180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469362, "uuid": "14befd35-b269-465f-864e-14dc37038881", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d08dc9-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518670, "uuid": "b31e4177-390b-428a-9bd7-0b7c441d33fe", "comment": "Malware payload (Mirai)", "value": "188f20c88f8ca0285c5d07b02cf880d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518670, "uuid": "656905b6-6237-42ac-b062-0ae078881509", "comment": "Malware payload (Mirai)", "value": "70a35f2deb520210b0354bd0e0249b9585127f3372eb044e78a52c5ad98b5ebe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518670, "uuid": "4072ac4f-b31b-40a9-a58b-adfe82d510c0", "comment": "Malware payload (Mirai)", "value": "6ddde6fd2a7dc29e7cf7928c329f66b10ec51862", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518670, "uuid": "d6bf00f4-a80c-440d-ba44-ca1610eb59ae", "comment": "Malware payload (Mirai)", "value": "d006abe6d7ba0b08de06071306bea1c1b50042c136261c95bb3c5e5b9c9ae294d60172ffd56a199744ba48d310f344d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518670, "uuid": "3f99416f-b215-4a55-9b9b-16c7a5df858f", "value": "T14AA32A86FCC29A12C5D1627FF62E618D332293D4D2DA32039DA75F2133875AA0F77685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518670, "uuid": "ce5cb030-3ab5-48ff-90fd-543fce3d2b8e", "value": "1536:iq+EAvn+f99QFZkHwX1PKngw2P9Yj1l5OmO14PiXPvul:i3EAM9eV4i9Yj1KxDul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518670, "uuid": "b4630937-3326-45f6-97a0-163f1f969f08", "value": 104728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518670, "uuid": "ffecad53-e574-456d-a7f1-a6d21e7cf891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518670, "uuid": "c2c56724-3ca6-4722-9388-244b6e30e441", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac1743f-b2a6-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761509068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761509068, "uuid": "17f266e1-ede9-4df9-8997-6ce4bd176536", "comment": "Malware payload (SalatStealer)", "value": "3598878426c0116d20562bf48e797cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761509068, "uuid": "cc7ba8cc-3708-4f3c-bae2-a4c8404be4e7", "comment": "Malware payload (SalatStealer)", "value": "7174edf44993ecb25ba3f7db1ed8c750e9a873096ba8d40c80129230f9ccc6c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761509068, "uuid": "0fd0d9a3-350f-43b5-a016-07802333dcfb", "comment": "Malware payload (SalatStealer)", "value": "762b15c0b3517023cdf350648e234766c6693761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761509068, "uuid": "70612561-4e83-4358-86c8-5ee37865ccff", "comment": "Malware payload (SalatStealer)", "value": "6f84e8e8dabd2c0ec16497d7a8de1ad8ef8da6b1651ad5c1cc50a748dd7b290279dd38c149214f3e33cd52fc79b5e48a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761509068, "uuid": "cd469113-6acf-4556-88e6-9dcf2b79641c", "value": "T11DF533D359AFC8A2CDA53338DBF708DD222347503EBA0A11F567F8165062A5736DB6C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761509068, "uuid": "8df1a7d0-fb24-498d-aa7d-5028036cf58f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761509068, "uuid": "7eb0e83d-3cac-4aa8-b584-12b86d8f3f90", "value": "98304:vXZxh7+6AuLlXcIpp3W++QeNppusUvPz9cvFY:v1+6A8dbLetsavFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761509068, "uuid": "5cc306bb-4823-4864-b2be-1325d9bc7175", "value": 3560960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761509068, "uuid": "89e4a562-c061-4efe-a364-b368e1322191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761509068, "uuid": "9e42c973-5555-42ae-979c-bafac37f33a6", "value": "linware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343a15fb-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499716, "uuid": "1a58eb01-a782-4c23-a873-27b32d8bf8f8", "comment": "Malware payload (Mirai)", "value": "e81ecc75ff04f080154d049a5576ce63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499716, "uuid": "6dbf07fe-9773-4289-a4a2-ae121c03338c", "comment": "Malware payload (Mirai)", "value": "71fe2f61733db16bbc533fe0aa94b708575fc7323b0668de752cecb5b1df6662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499716, "uuid": "36bf43e0-4507-4b0b-a603-523ffea5a6f1", "comment": "Malware payload (Mirai)", "value": "878cc63d2ff36ca7ec5181208bfe83c322021af9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499716, "uuid": "2f4b429e-b77c-4e30-bf43-c2daa48386bb", "comment": "Malware payload (Mirai)", "value": "b549fbfad1db3682b605d69d488af378f8713ba73328a5c9d1743ee4584b5ad4041b3c2e79c58488c5b29f7b5ec91081", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499716, "uuid": "d8a3986b-6d20-440e-9e30-480c7d6b7b2b", "value": "T1EF734A13549080FDC5AAC2745FAFE5269A33F07E1235F25D23E46E266E49E302F2F685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499716, "uuid": "d2f69d6c-81a0-4d9d-9355-deea16e8256f", "value": "1536:mksTwL8i+tHXUPTAkFHGplnJ+qQvpx+Dvl7OP3WYyBu:0wYikHXUPMkFH6JdMx+DtS/WJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499716, "uuid": "a1d8ecdd-6866-4465-a4b5-f46f0d8b3306", "value": 75688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499716, "uuid": "64a1361b-8491-43e9-b0f8-6afe7cf18b4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499716, "uuid": "93fd9560-7e21-4c48-9145-a5c6512ce0c8", "value": "kvariant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a85ec3d-b2c4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761521550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521550, "uuid": "439ba266-6482-4eb7-b272-48054838d68a", "comment": "Malware payload (Mirai)", "value": "0da07b2781b6ce23bdac70b588e3329e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521550, "uuid": "68d4865a-9c6b-46fe-b688-632b61c61e81", "comment": "Malware payload (Mirai)", "value": "721f4717af17d50eea38284c7e486895eb7199dee6f2290731b95cda538af794", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521550, "uuid": "479630c1-2255-4ad9-929a-06814bb5df4b", "comment": "Malware payload (Mirai)", "value": "3933e917334a41dcb5be0c8a4636e663b0d07385", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521550, "uuid": "ea633640-994f-4def-abd6-9285b85b1223", "comment": "Malware payload (Mirai)", "value": "46911f8dadb193ed547d580b8e87b305be129e5758d44953b2a7a8f2b3d189c00b9c94428a6aa9bd9e0b68c8cccf17d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521550, "uuid": "aec32b0b-fc87-4670-960f-56ecef118d96", "value": "T1ED331881FCD2996EC6C4237AA73E618E3311B3E4D1CF3617CD186B2576C661F4DAAA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521550, "uuid": "6890ddfa-3b9b-4521-86a0-53d72397450a", "value": "768:BZygNmGoTO1qwR0iFVfP++Nrc5xwMCms8vgJ7PRxott1ORqiykBNknZKmz:BzmDTIZqxwMCmA7PRYORqiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761521550, "uuid": "8684cfd8-1339-4a0c-b162-bb6a3761b143", "value": 50616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761521550, "uuid": "3b4a2065-583a-497d-8ab0-00cd3303d7cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521550, "uuid": "415c4e02-0e41-4103-9087-a880002c0c07", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31a3bcd-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761517109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517109, "uuid": "d866ea0f-adcc-4f35-993e-1e2475cd162e", "comment": "Malware payload (Mirai)", "value": "e9f5481f07dcfda77f144f8d80ad02a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517109, "uuid": "efe7ee8f-ed0f-4a1f-8125-a0f15a7ce9ca", "comment": "Malware payload (Mirai)", "value": "733a1052dfe331356cbb2a897dea8620bd61aa9d488bd8978fa1989fbfab8968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517109, "uuid": "9e06bb3d-7a87-41ba-9580-c871bf35f9f5", "comment": "Malware payload (Mirai)", "value": "fdf46948ed3a8611fee6d42d3ba0715e4dd5df7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517109, "uuid": "b8bd8bf0-69dd-4780-b033-c812bd98ff6c", "comment": "Malware payload (Mirai)", "value": "9240ee6f2bf8e7a476d7b80085d62c00c5b939e95d7afb1ea7cd83a1a345191c7101adc138a1c65a0a9bb0433bedf547", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517109, "uuid": "4ab60f69-5a1d-4fca-9a57-9c2bac174aed", "value": "T1CB13F1AE85185D48C48E5939E44877D1AE917082B2A70945F73CBDC8FF32649F08F678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517109, "uuid": "108e7c78-b3cd-4c16-83f0-d5cdb14d0900", "value": "768:hBu6hwxn2zYztusFc4Ac7LHjcXzXHjYG4sDsabVcJbF6WsOv+BmfKWj:7haxn2WtWUjI0G4sga5KwGv+Bmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517109, "uuid": "a1437a57-6264-4782-8eec-a47209b7d4c8", "value": 42236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517109, "uuid": "bc136705-5200-461b-8941-5eb36724cb8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517109, "uuid": "c525e9db-e31c-4058-a24d-e80726c4e4dc", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e7eec0-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518640, "uuid": "74639ef5-8d39-472b-9ab1-84083265af40", "comment": "Malware payload (Mirai)", "value": "f0933b71cd643782692e2d7d8315c6db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518640, "uuid": "beaa6169-8709-47f5-a809-88be3186fbe3", "comment": "Malware payload (Mirai)", "value": "74317e2234442fe77c683c97902cb94a78f89061d18c67cc93573794d30acf9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518640, "uuid": "6b97ea61-bc40-475d-8033-544b6c5f7b34", "comment": "Malware payload (Mirai)", "value": "8ab56d80af9cf76f8cec1df650381034e89a11c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518640, "uuid": "bd557ed7-82b8-4c77-b912-476dc81e1660", "comment": "Malware payload (Mirai)", "value": "9ab3153e21a68b30f199c929350e2dab3591202990dbaea0a8f0be964c4536a49f433740a33545ad09ea97cad1e8116d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518640, "uuid": "1a9490c4-2d32-4edf-b904-17acaf79801c", "value": "T1A723F1B0220134E3FC25E8B46FDE07535A660919B050299B3D6EFEC6D9059B2FCC6BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518640, "uuid": "4c0e869f-e9f9-4a1b-b52f-34cc1b397bea", "value": "768:4SEv+43zx4hoGmxMzhToMKiD5o1vm1KtvdR+iHNErOn8f5bcJgGlzDpbuR1Jjn:4S5qzPCZD31KvdUMSK81UVJuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518640, "uuid": "a6aa169e-be34-4d82-8e52-7c206bc6bb01", "value": 47392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518640, "uuid": "513e5487-680f-4cfc-973f-c4162f1bf16c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518640, "uuid": "f4aa66f2-b152-45e4-9bb0-17356f271033", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c062cab2-b27e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761491791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491791, "uuid": "ec611601-1154-4dce-8f40-8a77b87186f4", "comment": "Malware payload (Mirai)", "value": "3259b14edad1d0376ce5ea6bef569884", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491791, "uuid": "9d3fc54b-2e60-48c2-9ba5-3de930eb144b", "comment": "Malware payload (Mirai)", "value": "752514153491f876b945f65ad1a5781e1811874122f88e58ee317c6f9a76c5e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491791, "uuid": "687583a4-3e65-450e-8e7d-88f2a1db8061", "comment": "Malware payload (Mirai)", "value": "42c6ca463ef26608857eedd3e289388320c6f9cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491791, "uuid": "e5c6bd94-915e-453c-8948-adb5eff4a6a1", "comment": "Malware payload (Mirai)", "value": "d6d2277db34763e12f9fa8362d3482e1bcfbab345dd9e72428045a8d6aec80ae23d7aaf2e8ce6107395ab03239a63739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491791, "uuid": "d0330e94-7bd7-4e14-a6e8-e69f77bf524a", "value": "T14103E1EFED44D9EECDAC9C7F52518B882D90A1A430EE4A45936284CC6E8D317B40A0DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491791, "uuid": "a6b54133-2053-4a05-bd26-af4b9ee434e4", "value": "768:2tB5dgXnbH/WEEWxTOsoQkIVs8WQys375Rn1pEQpW3F/fl:2RdGbHiQ48KO7Dn8NF/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761491791, "uuid": "303f6b1b-983c-4550-b0f3-ac001f759560", "value": 38640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761491791, "uuid": "040b766d-327d-4179-83b2-7348226553dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491791, "uuid": "a85218be-3f35-4b00-aa47-66f782fae16b", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986d5837-b24b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469819, "uuid": "ddfedc40-8e82-45e4-8efa-89dfbccb8652", "comment": "Malware payload (Mirai)", "value": "c1ab8314a8bc1e06f76147e4b5f13667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469819, "uuid": "bd39fc3d-5215-48b6-996a-94f74f7bf042", "comment": "Malware payload (Mirai)", "value": "76d06ad904dd834cb6e20240c88237dc2f61e6aa190634a5f58d768a6b7d45ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469819, "uuid": "382431af-e401-437d-b21d-9e65f2d82ef1", "comment": "Malware payload (Mirai)", "value": "22dac42342f2e40c9da46897aa5a49e83fb67145", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469819, "uuid": "cb8bb702-d98f-4e74-9f1f-55ba2ba4eace", "comment": "Malware payload (Mirai)", "value": "035e0b8714132bf27369a4a9a989ee54f34487276adccdde93e68964fceaba2b065df787dcf7335a3f36c86b7052653d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469819, "uuid": "0c2277d4-16a0-4b6d-af22-6f21d0ecb4fd", "value": "T1CDF32846F8404F53C6C612B7FB5E428C772A07A9D3EAB103AD216F21379B96B0E3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469819, "uuid": "c1612021-e92f-4ee9-9ae4-bd1f5b691908", "value": "3072:2bk3/AF9Q9FExVv6fP6a8vFAwUF6VfFmBdk1j0tvla6hh1wo:qCAXQ9Kv6LwUFgfFGCal2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469819, "uuid": "1897f25d-514b-4c95-9772-8f37136c60b4", "value": 157736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469819, "uuid": "258b36d0-3802-4f16-8590-6ddf6f5e1c39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469819, "uuid": "82c98149-11f4-4a34-aec3-bf94d2fbc30c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e9cbfe-b249-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761468746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468746, "uuid": "2d3d256b-aa09-42cb-bb5e-31d5fc4da535", "comment": "Malware payload (Mirai)", "value": "e281a1e329ac4f6171dec9e5f3204ed7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468746, "uuid": "2c095b86-1fa0-4cc4-b740-27601c315e94", "comment": "Malware payload (Mirai)", "value": "7709d54a50df45500a97ca2818e8e85ffbac82f8289a1bfadf972bde5797a657", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468746, "uuid": "ecb6f051-1c67-4f0b-80e4-51dc1271efa9", "comment": "Malware payload (Mirai)", "value": "8616d7c56e3f7d332cfe850551b15dd9f1fc8a32", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468746, "uuid": "8b261769-d98f-4f49-abb9-32016249c3fa", "comment": "Malware payload (Mirai)", "value": "873abbc2f10479c8097431404ca86012a18ec38c14f0909693def4e5f57e1d8e8520b8d8859e1d8e561f2df6b198782e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468746, "uuid": "949bbbbc-fe26-4d18-96c1-c924d44f70e4", "value": "T10231A2E4725302752D939DF7B3AC440D32E255E7D8D0EE2164E8BCAD418FE187453E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468746, "uuid": "346c1dc0-5c3f-4992-b309-5e55a813e6b5", "value": "24:vYeanqWeatTceaPyeafea7YeaReanea+eaN/ZU:v/aIatfaPpaWaragaeaVaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761468746, "uuid": "55a61e78-a154-4b62-a405-f3a130ad824c", "value": 1793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761468746, "uuid": "8800f5ad-9f68-4494-99d8-313c8320a03a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468746, "uuid": "b48985ae-f229-429f-988c-1fd80709e219", "value": "pay", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c5805c-b2c1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761520303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520303, "uuid": "2764498a-e17d-4fa8-aa9d-d6f45693835e", "comment": "Malware payload (Mirai)", "value": "2f5acc3aee7d02ed93da0a452fc892d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520303, "uuid": "3564ca01-9709-49c4-9056-cb060f22e199", "comment": "Malware payload (Mirai)", "value": "78ed4647abda65322e583ac1e52f82972fe7dda38afe47f0b7666f4949a8ab98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520303, "uuid": "fc1bf8e3-871a-48e3-830e-95b710100ea4", "comment": "Malware payload (Mirai)", "value": "be494d674ee9f896d7eaca4c1f642a4f7d58c785", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520303, "uuid": "f6ac89d4-0284-487b-a8f9-f5ed47470247", "comment": "Malware payload (Mirai)", "value": "229b2105bcb8c144dc8ce8cbfeb16e2786a4cfa3a2bbb533a530549c828a9e6d9d29cb15616dee01fd1828a526d65c16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520303, "uuid": "add9aa99-cd92-4d08-b74e-3ccd1b12e01d", "value": "T177B31985B8929B11C6C256BBFF0F428D3316539CE3EE3213CD285F6536CB56A0E3A156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520303, "uuid": "d289c402-6c18-47fe-9a27-9cffeb751309", "value": "3072:kfXh7hF1Pv1audn0PMRT5Y3pFNd8yPwtbD49BBFliQ8bv7B5OQ5Hdnz2:kfXdfR9audn0PMRTq3Pn8yPwmvphOvl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761520303, "uuid": "4b60f913-8ccc-485e-82d1-bf3c4199ba37", "value": 115964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761520303, "uuid": "4765b1d9-0fbe-484a-9294-02ee9bc191d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520303, "uuid": "a5bed72e-d5f4-465a-8bd8-8ec450ae801d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b967fc2-b22f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761457557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457557, "uuid": "0ccbed6e-97cb-475c-b9b7-3b283973d515", "comment": "Malware payload", "value": "4e619bfcf6f1122f7b93b093240ffb31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457557, "uuid": "1f4b9f50-3210-4793-b205-f2deab7abc4f", "comment": "Malware payload", "value": "79238f706ea3a13cdb84352474b7d93334d42b096d0d95ccf2cbfde64f3de626", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457557, "uuid": "9e6ef632-0b99-4597-bc7c-9ca6bde20af9", "comment": "Malware payload", "value": "fc1fa49629331b9d2cd7f622da86d1fda4c1a8cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457557, "uuid": "d393b912-4e85-44ae-bb3c-5b9ec15db2c7", "comment": "Malware payload", "value": "b373a14a3e6f4e989980ba485f8002cafbe06d7fa1c0d71a09be929c9efbe21091f7b25fcd85a5c4ca906fcb56f0f80a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457557, "uuid": "7d90df3f-0b54-4a9a-b455-285c2b971ba5", "value": "T1A05302597368356BD3256C90836D02E1B74B2A174386C3A47DAF7AAC11BA8EF8D44CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457557, "uuid": "08d95074-90be-466c-a247-f63cb7f6243a", "value": "1536:WrF/CH8/gSkk5/b+Srzg3EG+f5cTZ48b9haRhGkPCErPc:WrFi84u/Cb3qf5cTZ4Ga3GoPrPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761457557, "uuid": "c39b4fda-3738-43aa-9ded-3aaeef89fc84", "value": 65092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761457557, "uuid": "1ff6606a-c712-461a-8530-ff3afdd064c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457557, "uuid": "fc12743e-aef2-410a-8002-8c362c22b9bc", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143cbe69-b2c6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761522426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761522426, "uuid": "dd962231-65e7-4aa7-9595-aa95c3d05061", "comment": "Malware payload", "value": "18b972c80406e3a59cdb99d0b8a112b6", "object_relation": "md5", "Tag": [ { "name": "c-fi3-me", "colour": "#077872", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761522426, "uuid": "d5906e6b-c78a-4f2d-abfc-b77b41c13364", "comment": "Malware payload", "value": "79b618fd3c2854575ec271401efc579f7f15ec6044531c7cca31129b2317d1a4", "object_relation": "sha256", "Tag": [ { "name": "c-fi3-me", "colour": "#077872", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761522426, "uuid": "3759a982-2605-4b53-ae39-f7fc10e27d83", "comment": "Malware payload", "value": "a24ee4b83d32267e853f18330484021c583324b1", "object_relation": "sha1", "Tag": [ { "name": "c-fi3-me", "colour": "#077872", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761522426, "uuid": "4fee1623-2462-4f9f-a416-f1a5cbe781da", "comment": "Malware payload", "value": "e0b6a288b20b78472f70fd5fbce505549a9d7953f7a9c01ee80c90af3a330a967a718bec2277efadac2bb021531011d3", "object_relation": "sha3-384", "Tag": [ { "name": "c-fi3-me", "colour": "#077872", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761522426, "uuid": "0326ac0f-99f4-44b8-8a2b-16adb4d60130", "value": "T178C20D42DD8C7AD0A90AB541D0C8617ADA358C1736DCFEEFF998A69B4D28441FF2740B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761522426, "uuid": "c26ec7cd-6790-475d-a8c9-983fdd128742", "value": "192:W3RHskc3nBr15wTQG5RsEPGsMDuAQFuhwAUDxCxxOO+XN8W10HH8/t/Pdwgxekjd:sRHskWBrlCsEPdeuA0ufeoV+d2M1XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761522426, "uuid": "6ccfd5d4-ec15-4a9a-a0ee-06123c74e890", "value": 26128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761522426, "uuid": "78237223-6db3-477d-9ff5-c487b81bf964", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761522426, "uuid": "40272128-a523-4346-bb44-89329fb948a2", "value": "88.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb601d2-b245-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761467038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467038, "uuid": "0a6d1b52-8fc5-4d27-9475-56cf35afd048", "comment": "Malware payload (Mirai)", "value": "f86d4f004ef924989cc130e7f69ab930", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467038, "uuid": "f8d3b52b-7ae5-4162-a6f7-20a2a53edc5a", "comment": "Malware payload (Mirai)", "value": "7a0b998477b82bb9610e9379f36e555efda3676eea5357b8b671e4e757ae8471", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467038, "uuid": "1d193d10-16da-447f-b6d9-d5749efc1944", "comment": "Malware payload (Mirai)", "value": "71a105f7d8afea871e0de415993cf6fa613a327f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467038, "uuid": "814ee390-3777-4dad-8574-ada4995307ac", "comment": "Malware payload (Mirai)", "value": "fde9afce59c426554a61f6989ca28aad1b4b322f43d14304b4026ff4be4bdd140d26c4b27a08e965877904cdcd9a8508", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467038, "uuid": "de2e4a1d-331c-4da4-9180-bbd7db14d29e", "value": "T14FD3BEEB734B5A11C42206F01BD39FCE3F6372128D0BC9F62E1C663A28766DB5846781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467038, "uuid": "38b95ce4-be2b-4667-a0c5-4fe4fc5e68ba", "value": "1536:h/gcz9rw61/HTXMB3QuO02NwvE90wrxZlqlLThIkNhjxKxS9gAns/LW6:SKw61/k3QLzL90wr0JhIkNhtgAnsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761467038, "uuid": "a558293b-e2e4-41af-b1c6-0a07e862d479", "value": 132476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761467038, "uuid": "93fad1a1-a76e-44df-aa9d-0d8d7fc3ea02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467038, "uuid": "f55f3caf-d370-4072-b8bd-8841bbded818", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d3b999-b29c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761504410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761504410, "uuid": "b0fab54e-8ccd-459b-acf9-7692cab86c2b", "comment": "Malware payload (CoinMiner)", "value": "ed02f04375645f10382d591723f40af0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "miner.dropper", "colour": "#BE1A9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761504410, "uuid": "b554cc20-7eda-4c96-8678-2e48f253a539", "comment": "Malware payload (CoinMiner)", "value": "7a0da8cd91959b6ca4f433a9a334d4d6f3b397f31ff340d8eab6ccd2e8d2dcd6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "miner.dropper", "colour": "#BE1A9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761504410, "uuid": "c409526a-ff5e-4533-8775-f0e0fb77018d", "comment": "Malware payload (CoinMiner)", "value": "98285c9396212e99666348ee033f8c30ac42c4fa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "miner.dropper", "colour": "#BE1A9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761504410, "uuid": "93f70126-684e-42d0-842d-e32e091aae95", "comment": "Malware payload (CoinMiner)", "value": "08c0753020bbbf333e21f9bb6c7285b01eedd11ba004c56c10878e92d99f04c84a89874871c9982b0a43b1e8e3e8dbef", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "miner.dropper", "colour": "#BE1A9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761504410, "uuid": "1bf95e42-9c9c-4135-a661-b13671fb9765", "value": "T11786C0F319E6AD9EC51E80FCE105F86E4B5FBC351A09B1D3A36326DB97538007219B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761504410, "uuid": "46bf0a65-2b9b-4dfc-b43e-54d6f2270d2e", "value": "d400a6a867a8623e410a8599e61fe849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761504410, "uuid": "b30876ac-ba29-4e3d-8297-c64f264349e2", "value": "98304:UQ3PLEuts92HkeVcTePmllwJX5iiO/wTTEsDQnZx7PiIgBVbNwUKL8/ziPcyiesd:UQ3DO2ESFXCoTDDQnrmVVmUKaNenM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761504410, "uuid": "edda8705-c885-4150-a61b-962bf0ba013d", "value": 7976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761504410, "uuid": "1cd79e4d-a53f-4f5f-94ae-9a2bd89dd8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761504410, "uuid": "7fa8422c-1383-4d61-b899-d3a8c4010f08", "value": "1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce207d57-b292-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761500404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500404, "uuid": "f31fd2b6-38a0-4f46-a056-928af687d4b1", "comment": "Malware payload", "value": "12fd4b0b31d3bc5d6b0ab1719505c358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500404, "uuid": "cca2d0c9-17f4-49d3-9b1f-f8e863de8ef4", "comment": "Malware payload", "value": "7a6ac12ce65f8b0e81913e3fbd732dee95e3610383372564a4df1896675e345b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500404, "uuid": "11f4d3bf-7682-4143-a737-4c2b2f457f88", "comment": "Malware payload", "value": "31ba7c585de88a2b08805212da4e9e0262569682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761500404, "uuid": "bf34fc82-11c8-4d94-a6c5-8a4b370ac965", "comment": "Malware payload", "value": "2bef284a189692bb3ff89460008dc552a1f71f4401ebea04ace96d0b80ca1c32ba5e8af392497755c4d58461355d8c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500404, "uuid": "dc46e73c-f53c-45ad-8554-b0961d4b3dcf", "value": "T1C9F523A4AEDADEF1E02FC3303081021DB16EB7716F38996F6BA9C9455D961661E370CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500404, "uuid": "87dd3cbc-d839-42e7-beef-f049252ae833", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500404, "uuid": "bf72d0c6-305c-41b1-8db3-eea23511e068", "value": "49152:U1/w6lsC0U+xjWFdAU5LRACQIAi49+5nwJvPg0T5Edl3haaYb0aj35ZHJS5:8LlB0sNW0nwJv8dhatb0OJbS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761500404, "uuid": "e580fca1-2ae7-4400-b472-4d3031bdb418", "value": 3573168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761500404, "uuid": "80243c82-bf6c-4921-90a6-a8adc62208b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761500404, "uuid": "a8b40242-de12-4325-85e7-3f9c82ad5a3f", "value": "SecuriteInfo.com.Win64.MalwareX-gen.77856976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ddd62b-b225-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761453358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453358, "uuid": "6828bfdd-447d-4026-be63-8ccfef7f9a58", "comment": "Malware payload", "value": "1f601cda5fffe74cbbb26485b79b27b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453358, "uuid": "e1a4ed8e-76e5-4131-a2bd-353aa9edf245", "comment": "Malware payload", "value": "7c3431040e6118fb398d033ee6e37899c8f9ad9a0f9c104802aee252ca897246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453358, "uuid": "c92af366-81a4-4ea4-8b92-9a7bac7a5aaf", "comment": "Malware payload", "value": "afb05f0d5337327100b2f3f75c96976d17792d41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453358, "uuid": "64867d2a-fa0a-4d3a-b19b-134bf95c14ea", "comment": "Malware payload", "value": "4fc06f7e92199753d883bb1ab6b87aaf2031133069b15ce20386ec592e2874ad683cccf7afcedaf06452d7447ba73b34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453358, "uuid": "96e79786-d8be-486b-bb38-37589e572945", "value": "T1E1530207790857D7C1E42EBA5D595390DEAA91F3EE0EC22F318B2B194BA21CD8D2F580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453358, "uuid": "9d99e009-9bfa-4dd4-9f74-1da18acb30b5", "value": "1536:yx1rGlqhEyRsHg6MPVKqVgkX4wW1LVaO6xF6YK6ubC4bNU:yx0YTOA6KN4wSMb3K6ubC4bNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761453358, "uuid": "1ea4f7f0-f304-4397-8a6e-ad1d65c9a087", "value": 61300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761453358, "uuid": "ab27f36b-ed8b-45c7-abeb-fa77493b5f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453358, "uuid": "54507cf0-8367-4f6b-8b90-9f53c8865b02", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a9e414-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516729, "uuid": "9145df9e-2502-4888-bb9b-ed7eb43c3577", "comment": "Malware payload", "value": "be636e988f0687e1def396deef5490fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516729, "uuid": "72b7db8e-5cdb-495a-aa25-39485dee0bfd", "comment": "Malware payload", "value": "7d0b0878de9eac7e6c23a2847a82fc53f05e6753511d209f6d760ae36cffdc6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516729, "uuid": "5af28988-4fc8-4a26-a28f-35361d809a2c", "comment": "Malware payload", "value": "43485df931b5f12c7dac5935309d8b605816e3fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516729, "uuid": "e29e7f6a-63f4-4a15-bac1-e6be8f56ce65", "comment": "Malware payload", "value": "92e847bab8529b28b0e8c1649fe77c838c31392e2f8488c22dfd4848d81bf291ac2fcd6559e8984d1828b85fb1d34331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516729, "uuid": "d0d01e43-4f76-498f-ba5d-843196606461", "value": "T16A967C43EC9545E9C1A9A23189A79253BB71BC484B3263D32B90F3387F76BD06E79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516729, "uuid": "fc658b00-6fbc-46df-bd9e-48311c9f17b3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516729, "uuid": "18b55330-4618-43c5-819f-ea045ea660be", "value": "98304:Q7Nvz4kiv/Z348xzKMvpP4VHUfzyEdnwmJUkHbBX+yIUJ04jonDMhC:QFGv/Zo8xz1FOadwoX+y3J0Q0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516729, "uuid": "52d9c665-8363-42a5-bee9-d190fadfb9a6", "value": 9327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516729, "uuid": "16feed00-bd3f-4ee9-a575-792ff2757b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516729, "uuid": "b972971c-b982-4696-b4bc-7704ff8126aa", "value": "f10t2v6qz1smdr3kp7e4bxd3kygwh5ju.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c46125b-b22e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761457290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457290, "uuid": "b3fb956d-9449-4ae0-a52a-456c169b0f05", "comment": "Malware payload", "value": "8a56f58704b037b2a05c94e9c40a20ed", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457290, "uuid": "f90618bc-da40-4a07-8474-935b7ed4c7f3", "comment": "Malware payload", "value": "7d177a47d4d377ae97d8eb84fe61067d349b587262ba0c75485c2882675a82c4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457290, "uuid": "b26986e9-31d7-417d-ad9e-fefa06133945", "comment": "Malware payload", "value": "e9c972968d126ddcfd223545f240e0216b38c748", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457290, "uuid": "c78f2f99-a019-4da7-af83-3705d4eb3761", "comment": "Malware payload", "value": "7b3ccd71af3344f4db5f45da9f1d2ce14547398341c0694699ec193480583de36e197980624affb9292ce931a8288fdf", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457290, "uuid": "7863c09e-891b-4e19-b39b-91b69b5cb956", "value": "T1C30823E7F3305C3EDA771536856D6072E9284E249A63B30F2409B63DBDB32D24A857E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457290, "uuid": "ac560ac9-d842-4f86-a467-a58bbbf46559", "value": "1572864:zh86LCIhqCsgM7N6QSwV5zl93NA9YVzmxnhMZIsfoZlDlsw45O4eCj0w:zO6+jCsgAPV5NA9SzEnhMZIsmlDlswuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761457290, "uuid": "a6f55841-2074-4d3d-b496-933907f753ff", "value": 82891859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761457290, "uuid": "04f9677d-3480-4c58-8159-fef411262f4d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457290, "uuid": "903743a9-0423-47dc-868e-e30c9b253bc6", "value": "Telegram.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278eacaa-b23a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761462328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462328, "uuid": "ea4c48d8-9310-4ae5-a828-4d9573289641", "comment": "Malware payload (Rhadamanthys)", "value": "55c6f21bb32f7c272daaa1927fabf36b", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462328, "uuid": "67c90297-04a1-45b0-aad6-8783330c4da6", "comment": "Malware payload (Rhadamanthys)", "value": "7da7fca4991859194ef9d012e578477a643aa4d0f8fdfedecb858b57bbd26734", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462328, "uuid": "a02ccea7-ba6a-4e79-82ef-68e808591fb4", "comment": "Malware payload (Rhadamanthys)", "value": "bcde963cdee4af8e809f17ad15ba38861d8013e0", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462328, "uuid": "a1a773d2-e003-4d57-91f3-f65815c825eb", "comment": "Malware payload (Rhadamanthys)", "value": "c9cd9546ae09e5f6055c473d395c96d3d28fd390fe3832484a3699a9a05c98a180903744987ddef326748394425c6d95", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462328, "uuid": "42bf7673-eff6-468f-ab4b-eaf39620a271", "value": "T1DC852349B9E4E125F0BE13B0D4F1A5D24274BCB2D72C12FB25A6BEAC1F736909938741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462328, "uuid": "8d81015d-3d13-4b3c-a90e-ebe9889fe53c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462328, "uuid": "a36955a7-a436-429a-a145-073f644a75dd", "value": "49152:OjKTdOwCgY3UPzaxW/Nkjqj10kX70QiP:KwreUPzaENGbkL0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761462328, "uuid": "e764ee26-504d-4f8f-9ddb-864e0b14a3aa", "value": 1716224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761462328, "uuid": "a6e02011-db97-4b72-911b-527d3311e926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462328, "uuid": "a2c5f697-beef-4bf7-9200-998eb4874d02", "value": "sketchup_pro_2026_v26.0.429_(x64)_ _fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49aee51a-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518650, "uuid": "ddf16f11-8766-4a5e-b2ef-4fb2d32475ef", "comment": "Malware payload (Mirai)", "value": "38f42e37ac6622375f73dc702d9f03f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518650, "uuid": "5d3e0fdd-d613-4458-b5ab-0a2424fa6179", "comment": "Malware payload (Mirai)", "value": "7e2b843cac6055c3d5767e5df9401dfe36379708b565643fa13d11aec76f193c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518650, "uuid": "7d3b132e-5448-46b5-9de0-0224d863a20a", "comment": "Malware payload (Mirai)", "value": "e613ae7b2e4a6a3b83ffb8ffe81f9fe3e264f6df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518650, "uuid": "91439fc0-9aab-48ff-aaff-e02c75b44cc5", "comment": "Malware payload (Mirai)", "value": "4b46e75583a86f9448bf5b11e08b53b882daddbf86b76b479ac827f7fd0f81c34df0ee2825aaaf60fb08b610b1da709f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518650, "uuid": "40020c05-c3dd-47cf-813e-1a72105ad69d", "value": "T1B3A36C11B6B9192FC4E0547612B35722B6F2429E18B8AA2F3EB10DCEFF115D027277B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518650, "uuid": "ff53d708-f001-4fa7-b106-7d1e389e4b0c", "value": "1536:iXg879VLqTyLQDAC3FeK7y9FtlR6mABU9RKt/XHYm5Mn07VcHtrtRab:6hBnC3FYiDawVXHYOM0xUab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518650, "uuid": "83bfe780-9404-4dbd-afbb-9b4f6355893d", "value": 103800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518650, "uuid": "c5f967d3-847a-4033-ae25-f94e98b5250f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518650, "uuid": "adda54e5-b783-4216-a133-0e27e60d43ba", "value": "executor.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ec7826-b280-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761492436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492436, "uuid": "fbcdd900-f29c-4025-9b03-08978c8319bd", "comment": "Malware payload", "value": "90bebce861880a6b60ca7addf27fa94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492436, "uuid": "2ba131a8-3b78-4c07-a826-89ca4361f9f5", "comment": "Malware payload", "value": "7f7e96b634554eb9f6b656118abbd8be7658db1bed83f1e298f7afc064aa49b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492436, "uuid": "ca536288-b172-43c5-a1ac-8b29ff4ee02c", "comment": "Malware payload", "value": "24b90f426b23b6a64259aaf68f4fdfba46230ba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761492436, "uuid": "2602be36-458d-4930-9cbb-b45f5d9c1cee", "comment": "Malware payload", "value": "105268ec8471e77ae1114a05ca93b5925c255365b67cfbc70cf27d90ae679517ea254a3460f9982def52251ef6c89a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492436, "uuid": "8dec8c2d-947b-4ef6-8091-4ee340ee4174", "value": "T132F522B03ECCDFF8E42FC3307542159E72A97B326D385A6AAB40D19A6D565350E331AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492436, "uuid": "abd2dcd0-5857-4cb8-b495-f8e662c54d33", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492436, "uuid": "a654d674-f0f1-4bb7-9569-4fc4fd916640", "value": "98304:Fed1mjatb0Onk0XyoqyeFHps3ebTF1eq636t7Yg:oMQ4OnkucHps3STd63IEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761492436, "uuid": "c6e66736-f83c-4176-b1c5-d42302ea3f0d", "value": 3544496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761492436, "uuid": "39a832d1-ba5a-43c9-b8cf-6344eaa5920e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761492436, "uuid": "426dc3a1-f19b-47c2-8ff5-e8014694f4d6", "value": "SecuriteInfo.com.FileRepMalware.76743278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb82e6f-b2b7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516190, "uuid": "0e9c7af0-5568-4652-8918-0d85267ab9a7", "comment": "Malware payload", "value": "690faa0652530ebf2830b4bc8cf640fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516190, "uuid": "0c7a9c48-0966-4596-a263-2d9f95dc3534", "comment": "Malware payload", "value": "80963a35376a1a74e1c99ebe07a7f085d2069bfab72073b6131e2b324c4ff513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516190, "uuid": "04813067-d6a7-40c8-9073-edc92583ba69", "comment": "Malware payload", "value": "0d87867ba7ef0243d48b59c4ee0634e360114411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516190, "uuid": "869ad050-e5a0-4692-b7d4-14fff388b237", "comment": "Malware payload", "value": "ca7bd8bc193aaa716191de33dd0266336ab8243e6d23d511f59c76db771f4c5e2d3c3622ef0311b7fdd1464dc65cf25d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516190, "uuid": "a0f2e1d8-0167-4d9a-95d0-78c2e4ea4bf8", "value": "T12D5423584BC38376E1ED5834C4237661463C82E7969727EBCEC1632DAFC66C782E3652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516190, "uuid": "f59e2216-42a5-4842-a2ef-6eb33f21e369", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516190, "uuid": "7b1161b7-443e-4aad-9a58-c8ec4a2fb6d9", "value": "6144:BvwxRE2OnRMfxeneI4B0zX50Lon0XjgLdVxaB87ayJkWVK:MEP0xUR4B6XoedWMk0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516190, "uuid": "56b1d9ef-32f1-4123-9042-1071d726f035", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516190, "uuid": "e109eced-6c23-4d89-b0bf-95c38aa2e315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516190, "uuid": "5a0e9eb9-8443-4b34-b90e-fd0d2ad73bff", "value": "Superioty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc60975-b2a1-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1761506819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506819, "uuid": "7d035e93-6bbc-4234-a1ba-496ec9a295c0", "comment": "Malware payload (CoinMiner)", "value": "33bcf1665deef9412e66faa2eceabdc3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506819, "uuid": "5ce3e5f5-f65a-4a36-9a8c-20f6f92231bd", "comment": "Malware payload (CoinMiner)", "value": "815eecc59c84e656b56c930df18bb73dabf2f4465f6dcab84fc0dcba7d673b69", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506819, "uuid": "bec5fdac-6241-40ca-9d23-1ca97e9f550a", "comment": "Malware payload (CoinMiner)", "value": "91f3a4de6e2db87d90401237f218ced94f570798", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506819, "uuid": "5edfcd2b-86fa-4611-91c8-6d696eb9a561", "comment": "Malware payload (CoinMiner)", "value": "14fb4d7a047ce8cfca115a829150b22b9745377fb6dc2c93c57aed32bc3380ca06591dc9307617f564be530749cf05e9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506819, "uuid": "ebd01a11-cb76-4198-a5cb-82fe728eab17", "value": "T15286CFA205E0D96AC5A9C4B8C5B0B86E9F7BB7FF370574874462726DCB3B800F166706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506819, "uuid": "8d06e3bb-2e19-4dae-8b96-d19e23f8a1ab", "value": "d400a6a867a8623e410a8599e61fe849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506819, "uuid": "9b8dbff4-44d3-4306-b890-7f9485006dc2", "value": "196608:QKB+iVTx+/IX1yanVuLEkxqg5ICOzYx/drExfb:/BlTxVXvk4Tg5BOzYx/dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761506819, "uuid": "0991cdfa-3245-4ddd-b465-52dd71d53194", "value": 8386496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761506819, "uuid": "7a093eac-515f-4894-844e-c25a14ac3161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506819, "uuid": "4f56d446-04fa-493e-8d27-19ba178a8c3a", "value": "815eecc59c84e656b56c930df18bb73dabf2f4465f6dcab84fc0dcba7d673b69.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830fe430-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469354, "uuid": "58ba25d9-7ac4-434b-b489-741ef7a2cc96", "comment": "Malware payload (Mirai)", "value": "97e133945641deee98fdc8093f65a6ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469354, "uuid": "b5bde016-6fd6-4735-bcf8-3cb699fb754a", "comment": "Malware payload (Mirai)", "value": "8261bdfdf64515708a95a86cfed151d08d928818b29283d297dd890ea9a43754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469354, "uuid": "57a7aace-9f6b-41f3-a4ab-913383895ba6", "comment": "Malware payload (Mirai)", "value": "c82c681f27ff8075da6857c0456b22173d730780", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469354, "uuid": "53125841-7e13-450a-bfdf-7b119d884b61", "comment": "Malware payload (Mirai)", "value": "927bf21492c1baa0941b826198def925a89ba6fc5432a16185f801c45bcf524a1d8f4eaa67bcff530a7a06c9281d7f46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469354, "uuid": "d9dffe4f-5c67-4ac3-8625-31f33a1d79b5", "value": "T137C30895B881AF20C6C625BAFE4F118A33135BACE3EE7213DD141F2427CB55B0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469354, "uuid": "d7e5be67-72db-4fa0-a6f9-9ec33e963035", "value": "3072:3eDM4mhIqtlka2Osa2frVd1frIALRajy9FKF92UYfTV4FZVlnnTP:3eDM4mCqtlka2Os9fT1frIMRajy9FKFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469354, "uuid": "299a1df5-2a99-4c11-b488-191c244043bd", "value": 128844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469354, "uuid": "7c9fe4df-5b78-41ee-8697-8d572cb14995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469354, "uuid": "98a465a5-cb44-408b-b850-81905f8d713c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7645103f-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499827, "uuid": "ab2c9602-240c-4295-aa89-5f0ae8258099", "comment": "Malware payload (Mirai)", "value": "4eb6896fe6f042b1ac7a7eaebc164790", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499827, "uuid": "2514912a-0d11-4f8b-a209-79c8fa568be4", "comment": "Malware payload (Mirai)", "value": "82b67c2439dd69a4eba5a7fb2cc583d87b73a769c42d36fc9adfeaed7b1639b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499827, "uuid": "5d04b962-cf7e-4b90-bfa3-3142e28554aa", "comment": "Malware payload (Mirai)", "value": "f95cb704a817b7ed52f731a58f2f382890d293b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499827, "uuid": "b2767f78-4c46-4789-b2a4-b0a72f405f7a", "comment": "Malware payload (Mirai)", "value": "37c4eb2a1624043b6499c094e0fcdb60f534e8492891ee1138582712887c1d651a6eb25d87c3b7c7f804c932450bd407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499827, "uuid": "79330235-1039-4cad-bb50-02f40bc9e63b", "value": "T1AD631A62B3BC172BD0B4A57480777B13BEE95A9E0960E68FBD750D8AD9132D006277F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499827, "uuid": "df406916-3c8f-403f-83e4-110793febcdd", "value": "1536:CHKYGr7s55wMcd9dZA9N6FuW+R13MMUc8DSkeOvSQTt1rxstLqtxP7ik8g:CHGrYgFd9dDuW+R13MMUc8DLvFvstCR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499827, "uuid": "9e1de067-9270-458b-b5b1-cff60478121f", "value": 70716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499827, "uuid": "ec14116e-31a5-4d63-a975-1f96eac3d5cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499827, "uuid": "1ec4af4b-d70e-4968-b801-3ae22ec3a354", "value": "Orbt.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d52c15-b22f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761457796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457796, "uuid": "fad35ceb-7cb3-40dc-83c8-0bef9229acfe", "comment": "Malware payload (Mirai)", "value": "26922a54493406c88d4c28e3616f2cfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457796, "uuid": "bbe10688-7d8f-4c52-9f44-fd36afd8dbc2", "comment": "Malware payload (Mirai)", "value": "834f4003c8d047d623383985b918f4b3d2d4e87fe8d225bf487ca65345578afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457796, "uuid": "820e844c-a188-495d-8f8d-de97fd5806fa", "comment": "Malware payload (Mirai)", "value": "ecf330a755b51b87cc0bfa200d0d0e574d459e88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761457796, "uuid": "040cf20c-e629-4d0d-9810-1f2affef6114", "comment": "Malware payload (Mirai)", "value": "98addfc0683d075fc2ea995c54ff722820bba471c1f8183a7a7dc2a2cad386c81643ff5c6fec55f8e1b140967eaa4f14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457796, "uuid": "12cbaa2a-bc17-4f53-afd4-3e2b60b4bb33", "value": "T136D3C031F0056CE0DC0116B8387A857C0345EDB409E94293EFFEE5AA28BBD55B9EDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457796, "uuid": "93340f01-9e0e-4240-bf45-29cab4a2891f", "value": "3072:JOz9hyFAc+noiH2hu7TiGJeQHGxtvFdGzTiVpUZ9:JOn2CTTcSGxJaTiPu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761457796, "uuid": "49578f94-a048-4463-9647-4da649ceb4a8", "value": 131796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761457796, "uuid": "207827d6-6cdd-4ed8-8a52-e3ceda6d1a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761457796, "uuid": "35e178fa-e83b-4def-9dc5-4cf36f7b32a1", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9bfa39-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518653, "uuid": "c7a3f075-94f8-4de4-aae7-849711198825", "comment": "Malware payload (Mirai)", "value": "c37003de06a8f6c46d7ceb20845a5f7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518653, "uuid": "6160a8f1-9900-47b0-bacf-4385f9e051e2", "comment": "Malware payload (Mirai)", "value": "83bee95b5bb2d4b9dcf3daa658b263a9f12e97a39ef640151ec895678e9d4c6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518653, "uuid": "694a43da-190e-457b-b20a-ff1dfadd3e4d", "comment": "Malware payload (Mirai)", "value": "579536117ab6a86df8f5d3d842d66d59924b6e26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518653, "uuid": "52de9858-6c8a-4d47-acf4-e39304cd61d4", "comment": "Malware payload (Mirai)", "value": "03c33597e9871ce0d2697017fe37b981d2aae6b719d48ec2376988e59bcfe2f101cde920aea9bfa180fff5f60630ca41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518653, "uuid": "57ff1cfa-0605-400b-bf08-5f1f93ec23b3", "value": "T108D3BF93F64B2691C8A202F007CB7BDD2A5371219EAB9EE32C2F613B49751DB45073D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518653, "uuid": "5add51cc-a805-4aeb-b56d-c0cd2f802acd", "value": "3072:atj7YzlLowHstDitmou0kvIQVWf4gTtq:a1ew7ouZktq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518653, "uuid": "cfe62b50-627f-40f6-90d7-6dbdc6d552cd", "value": 132560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518653, "uuid": "61b09fb6-8c70-46ff-8745-0e242fa11487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518653, "uuid": "71f88a8e-fa52-458e-815b-5919bff3852d", "value": "executor.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ad4cbb-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497294, "uuid": "621bdcbd-7aa1-4f61-a9bd-674c7f92c6b7", "comment": "Malware payload", "value": "1e2b800cda9a133f51ad40ea5a836d29", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497294, "uuid": "4784429a-5f09-411a-aa0e-f91891decbc4", "comment": "Malware payload", "value": "8469be9fa98fd562e21d9bd606ebd54b4918516bd310f0c1dbb9cd79394eef1e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497294, "uuid": "92edc47e-abab-4a8b-b81f-8ac03d9ea87b", "comment": "Malware payload", "value": "0c3d800b65e3276509652aea7f80eaa14384190a", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497294, "uuid": "3049b924-77b0-4d1c-bad8-73824d8c86ea", "comment": "Malware payload", "value": "2fa572f00f09d462d785b17a12bab52400b15a7f812fcccebda0e0291bf6feca3b70c76dfadb8e5a715025157038b0d5", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497294, "uuid": "2908d409-408b-4876-a8c5-800bb9b09268", "value": "T15E412329F5A0B269EB1E133CCD4291AEBC2D446B41326D2CF4ED01546F9673FCBA52C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497294, "uuid": "efcb96be-b780-49bd-807a-3e7b95559fb8", "value": "48:g2hj4JJkxuP3e4yXycv/vqIJGA3Wz/BvCrXa/U9qjsnGpoRUR3+tBNy9IBjaT:TVysuPKXyc3iI4A3U/B6d0pr0NyOmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497294, "uuid": "cfbbdc73-aef4-4b56-9dbd-8807ffe88bd6", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497294, "uuid": "081d7896-9917-461f-84e7-60672ce2da96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497294, "uuid": "8ea5511f-b16c-4a2c-8cdf-117fc3d3e7ce", "value": "lnksdfoifwe.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6bbc3b-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497342, "uuid": "e62e20f1-78c4-4640-a6f8-0d9c2fd6c04b", "comment": "Malware payload", "value": "299e83540122739ce8ff95db51b05264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497342, "uuid": "b87266b5-1bd1-40a0-bd81-364f44250886", "comment": "Malware payload", "value": "85bc590a47758d196334e68c57094e2f8842ab952960046efdba22ae839e091b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497342, "uuid": "fcc9875b-dfb5-4069-87f8-a9fd843598e7", "comment": "Malware payload", "value": "9d502392336a843fef1008f9654fd22b33434a22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497342, "uuid": "6f3f60c9-b81d-4ce6-aafd-cbe926e71b74", "comment": "Malware payload", "value": "b5ccbe372d2b8c42b43396bac6e4986e2fa4b92aad8ba1787e71d554041c9079a523d0d2cf897217ef08e17bb6f51870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497342, "uuid": "3e16d26b-891a-4742-a485-0e50f64cc059", "value": "T1020633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497342, "uuid": "0dc31a2a-9df4-42bb-b7f9-9e707716d2e3", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497342, "uuid": "cc2f0bb3-a2d1-46b8-9409-0d398929c94c", "value": "98304:aST3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:Z2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497342, "uuid": "d4840ba2-2f9a-4199-a207-0d923a92d58d", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497342, "uuid": "1fe40344-4e9c-4e23-8dd5-57bc09f10b64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497342, "uuid": "df0cab84-4e6f-4ba9-961f-096962882cda", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16491219-b255-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761473896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761473896, "uuid": "999c7c5e-0e1a-4280-9dc9-8f03039873a4", "comment": "Malware payload (Mirai)", "value": "8528cbaad8e368e56bc45ca7a58ab822", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761473896, "uuid": "ee9d3ec4-92ad-4008-8c86-ef0547f3c4ee", "comment": "Malware payload (Mirai)", "value": "85ea068c75b2d9c163fe41d6105db15d885456a56d38cae3ddf1d6f2220cae7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761473896, "uuid": "3925f138-1feb-4e14-a1b0-38b7913ce80d", "comment": "Malware payload (Mirai)", "value": "ecca9b01d425cebba19bd46b063c91ec70fdfa35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761473896, "uuid": "d6e0c7dd-5be9-4b21-956e-11da9b78109e", "comment": "Malware payload (Mirai)", "value": "4610d9c58f7d9ea63d302ccffc42dd683eb691bd16c585790a6d7c9dc80cfc565d31ea596b6473ae1856b13f404614eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761473896, "uuid": "cf7af39e-1f13-45e3-873f-a80da68f1790", "value": "T126F32B06B31C0947D1672EF03A3F2BE1E3EF9A9121E0F641751FAA8991B1D360686DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761473896, "uuid": "c0c28599-c164-46d0-aa59-dffcef856197", "value": "1536:vkDs4zhsuXVK+vlSbxObC3kXUQseGGvonUknVHE/Zq0LqXwRRAdAWfCIgkqPqHnd:8D5AdxRUXUQsVmy7+L6hh1pi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761473896, "uuid": "ef799279-2883-479b-aa6c-2eb1553ce423", "value": 161988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761473896, "uuid": "dc53f061-9c05-46f1-86d5-823abea33525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761473896, "uuid": "ae8318e3-0943-47e0-9043-23b4d7e4451a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7957ecbb-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761496396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496396, "uuid": "3e00dde8-4a6c-4da3-8a8d-5a3439a6ea79", "comment": "Malware payload (Mirai)", "value": "e2108a5e3f90100bef5cbc0f67fae2d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496396, "uuid": "7f5bca8b-c202-4d3f-a235-ccb1442eae6d", "comment": "Malware payload (Mirai)", "value": "8617c27ba94a9fee657d5a60c6359552018bf77063d577e50f89232d36a74706", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496396, "uuid": "9215b7f3-9d65-4b58-9d5b-92b1a9b26ce3", "comment": "Malware payload (Mirai)", "value": "01dee23aacb47fa7168a855211b1b12bec855f7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496396, "uuid": "54365c6f-2b71-4a1e-ae90-790fea8032ec", "comment": "Malware payload (Mirai)", "value": "855e808a2dfcbd1745df6be366d128a7df8a9f8465b49c19bc7aeb4b1c24ab4e0fb40de7968e001da4d137e7a492831a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496396, "uuid": "81917244-4d0b-4c37-ad7b-7dafcc05bb61", "value": "T12F6302DC47A4F9668A2923341AC81BEF72052285F3FC6355772CCD98F9B5A3476054DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496396, "uuid": "3c27ec32-1dc3-4186-8189-a83fdca4be5f", "value": "1536:3rZQbQy4j1n6jma66ukheOUk6hSXBp7yE0dTnjqFn:KHc1ng3AOU5hSRpmEueFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496396, "uuid": "4749e7fe-55a6-46ed-be32-647c8e8f1639", "value": 71452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496396, "uuid": "6b094720-1812-4b18-8c11-8cd98a178310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496396, "uuid": "68650252-4fc6-4608-a3aa-ec67fa633fa8", "value": "Orbt.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d38a9c-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469359, "uuid": "90289303-6a34-450a-aba2-6091d29dc30a", "comment": "Malware payload (Mirai)", "value": "6cef8af7a157bbc4005744e3f8112d99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469359, "uuid": "289544b5-911c-44b6-a94e-7641081c19a4", "comment": "Malware payload (Mirai)", "value": "89080476fc70848c9d62a9eaae812887d968b333a34b1a216d99207179731a0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469359, "uuid": "ca24d700-b48f-4a3f-9327-b1949ae38957", "comment": "Malware payload (Mirai)", "value": "61c0cdba4b181dccc0dad47b64557d2922a82631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469359, "uuid": "b86cfa9b-0703-45d7-a147-c7f5da0f2801", "comment": "Malware payload (Mirai)", "value": "244b64a554f0c7e6e936b964e472b8d763ebd22b66e756d960b323cf3e2890d17ddb6d2357ad007c2a1c80b62465a107", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469359, "uuid": "fcaf7860-4ee1-4282-b07d-3983fa6eb8b6", "value": "T1DAA34BD6F501DE7DF84AE63748530D0DF5B2A2E00FA30A2363A7BD67E976195280ED81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469359, "uuid": "9ccb9289-9e79-440a-99d0-f92b9b438aab", "value": "3072:jEis6Jo0+An1IPtqqycQeuacWjcW0JcWcBgkTkIzfHTQZieTBnhe:jEd6Jn+An1OecQeuacWjcW0JcWcBHTkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469359, "uuid": "9ef8e453-6e89-4629-92dc-3ef579760e59", "value": 100928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469359, "uuid": "be6492ef-2691-46e0-8b06-d082e8944684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469359, "uuid": "4441742b-d012-464f-91f8-87f3ae1f9a2c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c434fe-b2c7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761523146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523146, "uuid": "a85e39a2-c310-4ead-ad2e-05477bc5ae79", "comment": "Malware payload", "value": "900fe076ad6ef606a5af5678d8c77c22", "object_relation": "md5", "Tag": [ { "name": "c-fi3-me", "colour": "#077872", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523146, "uuid": "4070bc64-cc80-4001-9741-f0dc7ea9890c", "comment": "Malware payload", "value": "8915a84eb48662acfbac5a67c78dd51897a4e984941f4068c0f4e6ff98b22318", "object_relation": "sha256", "Tag": [ { "name": "c-fi3-me", "colour": "#077872", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523146, "uuid": "3d5626ce-c1f4-4b79-af0b-f9fe4a6fdcc0", "comment": "Malware payload", "value": "691c5aed9261bdefaf947341dd59101b35e309f5", "object_relation": "sha1", "Tag": [ { "name": "c-fi3-me", "colour": "#077872", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761523146, "uuid": "6a6d9f07-7bbf-49a0-a141-6de5c6675f01", "comment": "Malware payload", "value": "28a68516de0056876f439e384db2e90794cd18c79f86ba2cd0bc5a60196866386d8150ba7b31a94a4f82136c9381576b", "object_relation": "sha3-384", "Tag": [ { "name": "c-fi3-me", "colour": "#077872", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523146, "uuid": "f1d688ad-031f-4b54-b9ce-10975d84877d", "value": "T1B4F20D02AF13D06C702E596388DB5F39EB75009729DFAA743BCCFD910FA1718A8B6459", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523146, "uuid": "f00c0bad-0c73-4280-a7d9-52f9b6b15827", "value": "768:bmc7XFvYFJtbglQq0eQ9hkYO5NEehvYNsCvALNO2wEC:T6PcONhoxO23C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761523146, "uuid": "16bfbb14-eeb7-464d-b890-40aaee95c8d4", "value": 37279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761523146, "uuid": "84ff4435-2975-4fe7-a4a9-e070f967ab35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761523146, "uuid": "33042bb8-eeb3-469c-bcd3-5a49c9c9af8c", "value": "9.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55a70f4-b2ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1761512415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512415, "uuid": "e7f64dc0-4d26-4640-a79b-6ac021c8a46d", "comment": "Malware payload (Amadey)", "value": "17ad06ba951981e14ea6d9b4c996c0df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512415, "uuid": "5cd8e2d6-bacd-4bae-9e5a-ebd2538568a8", "comment": "Malware payload (Amadey)", "value": "89433011caa7461dc8ccafad852cc1667c45225776693673a61290fc1f75b370", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512415, "uuid": "be1c5457-bd4d-48c3-ab30-930ea35611ac", "comment": "Malware payload (Amadey)", "value": "78ee071db4f9e5571f4ec4c6dafa6ccdb93eea1e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512415, "uuid": "a49552d0-2fbf-4224-af8e-f71ab49b6adf", "comment": "Malware payload (Amadey)", "value": "81cb837e2c42b2848b440c9713eabbc8a4cbcac43ee9a13d51e67452ebb4c29e52401ab72702e2e08f11d3531539605e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512415, "uuid": "9bc2dc77-5257-4159-9c51-0138a1a42c9e", "value": "T1D9930900E510C539F4A600FEC2B607BEBD389F21235621C3D7D1BDB59B6A9D26931A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512415, "uuid": "f2fafa38-a65e-4a09-9b1a-8f75cdaef8d5", "value": "4973bec7202333b028469086f72a17f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512415, "uuid": "d8c6baec-27ad-49f9-9025-3bdac4d71aba", "value": "1536:gogE64qaYZFfcFjcQfpulhigC1yO7Uo6g8JZTgPA0W:m545YvfcFo5VuUoF85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761512415, "uuid": "3f99ef8c-e6f2-4e0a-82c4-0b63d4024a5e", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761512415, "uuid": "a807676a-5150-4d74-96d7-514012abed62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512415, "uuid": "1ab6820b-9e8a-4551-aae4-9a42c22098e5", "value": "17ad06ba951981e14ea6d9b4c996c0df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ea449d-b2b2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761513810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513810, "uuid": "ba45433a-6989-4df2-b9e4-6fed513a91ee", "comment": "Malware payload (Rhadamanthys)", "value": "e448752dcbe07c8f4a84881162050041", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513810, "uuid": "c618cc74-0d59-4647-96be-27943c24ea1f", "comment": "Malware payload (Rhadamanthys)", "value": "8a525879b80a05f4c8a9a13095efb2d5cca86e48babb2860017548d2450e7148", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513810, "uuid": "25fa05e5-f741-4cb9-9619-391e62bb85fa", "comment": "Malware payload (Rhadamanthys)", "value": "84f962d161a4dd5e85b76b9481c5bfa87132d0c2", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513810, "uuid": "ecc9d043-ac06-4574-bb73-cfeb5da3afbd", "comment": "Malware payload (Rhadamanthys)", "value": "82c40bea3e1c11923afbf2dcee23dff0310fdb4571ee561d6c7b1fa90b2692fb8fdacb27e656c218570762d3b14d589f", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513810, "uuid": "14d9ca55-bee7-4f06-8389-9ae8910100d6", "value": "T11E446D4676951CF9EDBBC53DC9424905EB727C5647A0EACF03E00A960F27AE09E3E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513810, "uuid": "3428a383-bd54-4c03-a848-d5d605330530", "value": "7a30bacfd7c73383390074276a42a91f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513810, "uuid": "65776655-6102-48e1-b0de-f5e185e0583f", "value": "6144:YRVj/uk8lP+8EBs8qUvULYPggufqECLpDe+dYs:im0rTvJPgguSEuUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761513810, "uuid": "a3b9e4a6-80c0-4277-9b59-0405ada57587", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761513810, "uuid": "5923971e-07ad-4a34-ac11-44f06102f3fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513810, "uuid": "1181002f-bf5c-4da8-b97d-48f61327aa2b", "value": "Aura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10f62bf-b27e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761491792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491792, "uuid": "a6b0e105-7981-4b59-b214-1ec3a354ade3", "comment": "Malware payload (Mirai)", "value": "fd08b8d1043da3748b70b45e85c9f713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491792, "uuid": "3d6524f9-b82b-460f-a0e3-544084f86b01", "comment": "Malware payload (Mirai)", "value": "8d6044c215aae584c19f38986e31230db790ea5d21e190acf694270ad9ad84f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491792, "uuid": "f2dc32a5-582b-49a5-8449-e19cc3eaa28d", "comment": "Malware payload (Mirai)", "value": "d9fc51bab93d5b811217e0fa3823d3dd109f43d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491792, "uuid": "1c79a330-3dd9-4796-b988-9fa2054ed7bd", "comment": "Malware payload (Mirai)", "value": "759f64ff0374569c49fd3ffc9af83a8ed6a65790506eeca62fb5a0085c3739672302ca120a0f53058a30ed1670e991aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491792, "uuid": "9a19a311-b580-4b3c-8bf5-1539f6e7a33b", "value": "T1E882CF21F732DD31C6616F31EE47458F664E7FB9E0FA70634228851CE5D008F6AA5647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491792, "uuid": "92b86cf3-d958-48bb-a459-f529fbe1dda0", "value": "384:2mKsm9ovaLX7ZA0xNj9HYURlJTIE/ww2G3FMh7qmdGUEpiaNl:2x9ov2xJFRB/wDEC9q3UEL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761491792, "uuid": "78bb72e3-3d61-440e-908f-f3edbe022177", "value": 18000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761491792, "uuid": "34a9cedc-ace1-4c09-93d9-f3f69a42b7db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491792, "uuid": "56b6ffaa-e16c-4736-a3f8-b3f15e026f98", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17aa4bd-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761496544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496544, "uuid": "2a6e3077-b50a-4323-b7b0-cd27b0622b09", "comment": "Malware payload (Mirai)", "value": "935873ec3a6a867470f65611e2e53079", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496544, "uuid": "38a51c18-7be8-444b-9573-f6ec45cce9cb", "comment": "Malware payload (Mirai)", "value": "8d93deb51d6c2d91b6bac9cf65b60e4ad89bb082ddb4d15f9d9a3b14df3ea478", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496544, "uuid": "768782cd-dd57-4e26-b70e-8e113c2ff3b7", "comment": "Malware payload (Mirai)", "value": "bc2ea00b9a6531bbc9cde3dd36dd807b1146de7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496544, "uuid": "f379fd49-2154-4544-b9ab-700d26fa7e71", "comment": "Malware payload (Mirai)", "value": "fffae07705d0117a135d795f2de73d887fbf90a5edbc5504cd5a878e2999d38735934ac4bde02bfe23f574817677783e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496544, "uuid": "05741dec-723c-4595-be15-251a77863367", "value": "T19DD3CF21E0106DC0DC2109BA387D96BC0354EE7417E662C6EFFDE95B6537D8439AE3A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496544, "uuid": "6bbca062-0df2-496d-9235-d9a6a274b0b6", "value": "3072:rJifVM4Agc7AeTGZevVAzkoAyPs+0HKsP:rYtaAeT4eNAwQPs+tu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496544, "uuid": "d6f6903c-41b1-409b-bfba-40e80e4a886f", "value": 131804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496544, "uuid": "b0949cc6-517b-464e-94ed-b1dc0f889615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496544, "uuid": "a3cecfe2-2c24-47a4-b3ee-cfbd735eaeaf", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bd2507-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518647, "uuid": "4f26f0e0-71df-4e68-a4f5-04e35d40dc37", "comment": "Malware payload (Mirai)", "value": "e546914779b9c44e098af1f7115ad6fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518647, "uuid": "a1ffb95a-d8e3-483b-8f2e-c52491c677e5", "comment": "Malware payload (Mirai)", "value": "8e0d1f78f9ab563a51efcb1a066cffd84913bb6c8782e2788314f68768da19a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518647, "uuid": "d215580b-efcb-4bc1-9667-4b34dd9687a8", "comment": "Malware payload (Mirai)", "value": "7ce6a7181ccbf4e0b6f2c65cdbeedef563556540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518647, "uuid": "8e7cf3d1-45d0-4dea-86ba-a04c485d2e1a", "comment": "Malware payload (Mirai)", "value": "d24b5fe1f1b2505478e36ecae660af4d95493ae8767531abc3a575e217e720e461d850ef0c63a1880bef7056d5258751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518647, "uuid": "0c8f7bd7-02c0-491e-b8df-574d55d86dda", "value": "T19FD2F190B145BD65C2300C71393DC1822E860379B2FB71512AE5C7A4A76BDEC91BF99F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518647, "uuid": "f0c40db9-6a18-43ef-9829-544fb9e301af", "value": "768:YBxmikoL3lJ8L9qg0musImq1xaK6RbVe17s3Uozws:+xRkyM0eImej6+1mzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518647, "uuid": "d617c897-1b6e-4257-8de5-ddb87771c22f", "value": 29220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518647, "uuid": "9f9997f5-fefc-4327-83ea-9fa7e4cc368b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518647, "uuid": "f4934101-5da6-464a-a775-48df7e68eb41", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7025e0-b2ac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761511626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761511626, "uuid": "d6fad2cb-68fc-42ce-8b48-03a0dda36dbd", "comment": "Malware payload", "value": "748c35680385bc6e24b1c6f34cd4bddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761511626, "uuid": "e43bc9c9-cb44-42f6-9935-b3c5ff29065d", "comment": "Malware payload", "value": "8f61bcc5a5896e0e861d78a7bd9dbb4fdacbce2c5d071428062207c51bc9f5cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761511626, "uuid": "4753d064-51c7-4d2e-ba58-ef1189829bcf", "comment": "Malware payload", "value": "7319bfc6465d3e280fb529b42be8a8ac71b1b54b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761511626, "uuid": "572b12e8-a1c0-4dfd-b6fd-6ab3feb69bed", "comment": "Malware payload", "value": "6f7a306a2f6304f39a965f5fb36aba0dad066f23c9ee44b6c1905e200bf42c7b844445256cd4d83153b5d453f89a03d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761511626, "uuid": "e3c7eba2-659e-4ab2-84c7-c901a37d57bf", "value": "T198154BB588C151C8F853EF78909A80F47CD44EA46913833FEE972B558B27E68918379F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761511626, "uuid": "2c1ddb94-ba7e-45d3-982d-8dbe72a331e7", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761511626, "uuid": "e8ade044-b455-46c3-9814-bacce9e97264", "value": "24576:t330eRj7Y8HNkG//Ca3PHe2oDG7cOXgXIEysAqBdZ1:bCa3PHe2oDG7cOXmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761511626, "uuid": "3a3ab7f7-14c0-4367-91a4-983e1384ce77", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761511626, "uuid": "7afb4519-d72b-4424-83e9-fde84080afac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761511626, "uuid": "94710419-c815-4124-9624-3da2d0e2ec36", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cc891a-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499824, "uuid": "d457a417-671f-480c-9cfd-f5e256647ca9", "comment": "Malware payload (Mirai)", "value": "39a2a743eefc24c8cb8aa38e6a720e9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499824, "uuid": "f3886a0d-d451-4170-bf10-50dfec352217", "comment": "Malware payload (Mirai)", "value": "904395198b26ea3d883ebb75bad66022c286bfdff3b19c54b8d745d3c35bc50f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499824, "uuid": "7d35b331-6b2e-4c3b-8add-6661766fa8b9", "comment": "Malware payload (Mirai)", "value": "f8bbb20ad302330b093cfeeb307bdcf317f3ff72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499824, "uuid": "ed062d77-2563-4551-beb6-53d132751448", "comment": "Malware payload (Mirai)", "value": "29c08b582b99e4658d4234a80cd3d65a37bfa9f8a7e789219e2a3076f2bc2b9361d7dfb650b54cc55de9911dfe1dcf5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499824, "uuid": "ed961a2a-5b15-4696-9b8c-7f0d613d2384", "value": "T1D5831A85BD829A17C6C1527BFF5E42C8372A6398E3EE3203C9165F2537DB56B0D2B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499824, "uuid": "1a98ae2e-9de3-431a-8200-e90e32ff08a3", "value": "1536:+siLepxlJP7KPkiKbCiQob4X9ZyObXK0pjkLA7JqmFvKNM:+siipxfTLiKWi5O9/zwU9dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499824, "uuid": "5e9ab29b-9341-4632-ab4a-053c19721a7e", "value": 83908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499824, "uuid": "0b0708e5-406e-440c-9081-0bfcc402613c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499824, "uuid": "d702d70b-6221-43ea-863a-b89525e290d3", "value": "kvariant.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eba7252-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761497613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497613, "uuid": "50337ad9-52cb-43cb-8208-d1714547c445", "comment": "Malware payload (AsyncRAT)", "value": "d5650cd362427530ce7d65af822d761e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497613, "uuid": "8a5b8dec-7896-48c9-9b82-b925dd6d081a", "comment": "Malware payload (AsyncRAT)", "value": "90a1361bfab586aee6a963adfada99cc97b39e8500b7a5f0e797c15c951a6aee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497613, "uuid": "6b0832c3-5652-44b0-a812-137e1ec41016", "comment": "Malware payload (AsyncRAT)", "value": "6167224a7e243086d2f0f1c0170b9ed8206a7de4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497613, "uuid": "6c4f84be-0d6b-4739-995e-3dd31393ee32", "comment": "Malware payload (AsyncRAT)", "value": "fdcc6e370a3813f9b87feba150c1262bc82348730fcffb922fb6d90b396d05768d72ec0dee376edf8df16ebe687f1f24", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497613, "uuid": "401070f3-4103-4036-b136-955243a1e9d6", "value": "T16E02B01A61468BE712BC48722435ACB863CEDDBF6DDD5EC744576C3C21AB86CF63A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497613, "uuid": "6201572b-faf5-4dd1-9ad0-0856cb63d4c1", "value": "48:bZp17EWydZpodz0sPNRodRFodLPEqXodRJNRTWPfz0sPNRJ4pkvfk95zfk9ZSpSw:2dhuTbRV7aG45EsnhH6ZKIA5YIysfaJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497613, "uuid": "15660346-c700-4fc7-a452-d3a227511bb5", "value": 8313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497613, "uuid": "f800e369-9715-4062-97a3-14c6d2c391d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497613, "uuid": "546e702c-6621-43fe-92c7-de5295585174", "value": "ORDER-90102509-776452.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a2c2af-b2c4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761521621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521621, "uuid": "03ab1551-4665-4eb0-9843-caf4e86782e4", "comment": "Malware payload (Mirai)", "value": "022ff5c8ac86c115d46aeda093d03ceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521621, "uuid": "4f93ee15-a5cf-4490-a68b-c87d46ef9351", "comment": "Malware payload (Mirai)", "value": "90bb242e09b895700982b08f26ff7c8a1d269232890e669d35e9a8ae3455df88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521621, "uuid": "4f5ad84b-e666-48c0-be4d-fa001a6cf7cf", "comment": "Malware payload (Mirai)", "value": "eddb94f8dfb81265c0abbb4558cff0aef196afca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521621, "uuid": "1a1cd7b9-8c70-4a55-bbcf-22df4431fc85", "comment": "Malware payload (Mirai)", "value": "7084314835341404a214e7f66f07236713e4d361e696eaaebb7037554749febd6984f364e6855fd53cbc8d709b9e2db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521621, "uuid": "cc3c29a8-f244-4686-a910-5e5a61fdb837", "value": "T1E8530190F453293742388631DCBED94762654BFDA3FEA9720114816D93C4B9386BF693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521621, "uuid": "ac760952-611a-4974-b8e9-4623fd458d15", "value": "1536:7FyZILL1DFfjeW+ie8IRI4pYLy37YBPdp/I:7FyOLLrf/+F8uqLXBPdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761521621, "uuid": "65baafa0-14d2-42cb-b7ee-e50ca132ab41", "value": 65400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761521621, "uuid": "5da7004b-050f-43b7-ae2c-b24a141d9616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521621, "uuid": "5ac0f5ce-f3ed-4873-9ba8-7375b6f35246", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11a301c-b281-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761493161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493161, "uuid": "5ce25d92-cbac-4cd9-be12-45e939257f1b", "comment": "Malware payload", "value": "da3f0be70893b4e55586cb5933fdd148", "object_relation": "md5", "Tag": [ { "name": "pw-VanishTools", "colour": "#490F6D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493161, "uuid": "b8b815e5-7bde-41ce-8e68-3625893d067f", "comment": "Malware payload", "value": "92c9ef703bea7a83fc146917a0183d194acf6df87802df3e1d11a3a04883f6c2", "object_relation": "sha256", "Tag": [ { "name": "pw-VanishTools", "colour": "#490F6D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493161, "uuid": "7c326a06-2487-4158-a354-a29b02b81929", "comment": "Malware payload", "value": "ebd34c3b6eaac7f2def2d0fdb29c0c273814aad0", "object_relation": "sha1", "Tag": [ { "name": "pw-VanishTools", "colour": "#490F6D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493161, "uuid": "407b3186-da9c-4a70-af2e-5776b0b8389a", "comment": "Malware payload", "value": "b67d2df67204c55d9343e1be005a2f8dc5700898aac6f95f81512d1a5a0cdb7b37e2e3419eb568eeced18b9a94254126", "object_relation": "sha3-384", "Tag": [ { "name": "pw-VanishTools", "colour": "#490F6D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493161, "uuid": "623e79da-1b0d-42b4-acd2-95eb3751a829", "value": "T16C26332CC284BCA2CF1DED634DAB6C0E0DF5DB572716CAD9F9473548EA92D2B09820D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493161, "uuid": "ec54c383-142b-4df5-b92d-c5408c4a8a65", "value": "98304:ZPE79OEoZq15DrRVz/mi1Pbz4JqyN8KEwEOlAIZP+Cvn2XLY:ZPE79Br1Tjmi1PWqyNnEwVBZ2Wn2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761493161, "uuid": "b4d68633-5f65-456a-b096-a03e32251808", "value": 4834893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761493161, "uuid": "b84fe6cd-c807-4bb7-9f32-244dbeaeae6f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493161, "uuid": "187e1a3c-d823-403e-8dac-3c1a505b79af", "value": "Undetected Spoofer Arc.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee9b92d-b2ba-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761517397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517397, "uuid": "cdb77182-009b-4357-a280-6449fdee29ec", "comment": "Malware payload (Mirai)", "value": "37c52d327593325414b92871b528a81b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517397, "uuid": "549f78d1-a02d-407e-bc17-1961e48abafa", "comment": "Malware payload (Mirai)", "value": "9351d79c23cfbb2f9d85e77cb7103f4fabe5b7ba24833e2c9f7247f0e8ca9615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517397, "uuid": "c44d1195-7637-4677-a702-f00f837140f4", "comment": "Malware payload (Mirai)", "value": "8138cf6a96bf2078b93efad1cadc570ffb4b1273", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517397, "uuid": "eaded83b-fa04-4084-83d5-a1487f98d36d", "comment": "Malware payload (Mirai)", "value": "cff62abe6edb951125428a47b4117b90c62cb97f4b6325defd91155a36aef0f25b52dd1dd78a0027f1e0389dd1ca3b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517397, "uuid": "92f963ba-d8fe-4954-9a72-4b0c9d12ad5f", "value": "T117B3C609BFA11EF7E86FCC3709E91B0128CC692A21B97B757534D518F24A64F1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517397, "uuid": "b01cb8e5-06f6-4b3e-bffb-05f784c5e963", "value": "1536:AFHGTVO/dXfCAbQ71MhlAswt1jUj92lAN9Z5PTDuANFLOeJ2Yggukx:AFiedXfCAb0MF4lAN9Lv7EKukx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517397, "uuid": "a893cc7d-472e-4dd4-ae53-f48011bfd6da", "value": 113856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517397, "uuid": "4caa93d4-942f-44d9-96c1-9357b85b0a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517397, "uuid": "e06df03d-0195-4f32-884f-d06eeeb370b3", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee18add-b288-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761495815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495815, "uuid": "f066ff35-4d13-4827-b569-d02b5ae6e6c4", "comment": "Malware payload (Mirai)", "value": "805110a3e42f187cfecfc56063120b54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495815, "uuid": "4ac39b3d-6bc7-448b-951d-67764263de2c", "comment": "Malware payload (Mirai)", "value": "93a6d9d4b6cd50bbb5ed7769c05303e635916bdb086b4facb653ecd924ee4044", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495815, "uuid": "023bc3f3-7822-4773-9ea5-ab420d7fc059", "comment": "Malware payload (Mirai)", "value": "0d3eaf05e502111a02983c8ee460a7a9661da1f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495815, "uuid": "93e9df71-568e-48ab-b785-d639b3ea68d4", "comment": "Malware payload (Mirai)", "value": "997290fd7af619f3993ff4d05c6215041bfb2177e607714331e06c898eb741af2914fd8ce7cac161def97e8cbd98be5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495815, "uuid": "3dad8171-99e4-4231-b811-61bad9bcda39", "value": "T1F633021BD0ADDA0DF7B3803A290B179E9A50C11D5E36C1DFD7D4766A04A0798B428FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495815, "uuid": "3ee69a02-a0a7-4a10-acfe-e4caed1f1289", "value": "1536:CJ0l83dpqFwArWgEaQlLjPNNkokuPcmk5+b8jCZxgzxYnouy8tyA:SV3dG+aQlfnnk6cm+U8WZxMKoutF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495815, "uuid": "c43bf3a9-aa03-4521-9a9a-9108b39bb19e", "value": 54840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495815, "uuid": "b9e929a6-0eb8-4751-a1ea-3c425187017b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495815, "uuid": "3e50e67a-e343-4ac2-991c-6b8c9c700010", "value": "Orbt.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a51fda8-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518651, "uuid": "e7a14e87-2fa2-4150-855f-edbc8bcd75a5", "comment": "Malware payload (Mirai)", "value": "d944b19376e0132dcb6d4711973bb799", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518651, "uuid": "81b8afd2-7ce8-41c3-8492-0244622753dc", "comment": "Malware payload (Mirai)", "value": "96cb26a2cf6b7b9c23b5590a816dd566e6e6bfb81aa5c77ef31f0573de248b21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518651, "uuid": "8fbab55f-18f5-4ce5-9fc2-1815f2ef9cdb", "comment": "Malware payload (Mirai)", "value": "238a55ae5e5414bcf31aa050e3c9205018f527b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518651, "uuid": "a305ffea-94e8-43da-b474-52f4727d7723", "comment": "Malware payload (Mirai)", "value": "73ac29a5c45b14db8fb211af8389e16a21478d1986a8293be1b4ac58b75d835c3057e96b1d0c0cdef104ac5b733dd728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518651, "uuid": "894d7097-2f9e-4356-84f4-e8719f077ff0", "value": "T1B6939E13CA9498D9C12A0975E0A5FE399B53DE4656871EF60F97CF239003DC8BD053BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518651, "uuid": "64cfcae8-fc15-4664-a953-5286aec3d8b4", "value": "1536:Q/OHtdw7NdiOLDmxnee0P343eQcw8K0xJf7QJ9NECxWGqpVPO:Q2NdkeRnee0PI3eQcwj0Lo9NEtnfPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518651, "uuid": "d1736e71-f6bf-45df-a517-dc822be6575f", "value": 91696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518651, "uuid": "58a6bb9a-f673-4c14-b68a-dfe76408fa25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518651, "uuid": "ea030e15-331e-4604-91c0-c7f26b878c36", "value": "executor.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf83d1a-b268-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761482229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761482229, "uuid": "e33cd02a-3fd2-4397-a386-6fe2e0e94e9d", "comment": "Malware payload", "value": "f94f68be0e66e1bb2d567153cf85d4a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761482229, "uuid": "8070d7bc-3919-44c7-9fef-c63c34088c79", "comment": "Malware payload", "value": "974d88ded32ff400932e7b63e436c4b487ab6f20dee2a13b87226085d2e0978d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761482229, "uuid": "a2dde22e-ceb0-49d7-b27b-27773c777842", "comment": "Malware payload", "value": "fdbabaa76453a827ad7f2c3a3ef1e73a25f67630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761482229, "uuid": "8356c2b4-0796-4844-8aa8-62ffc3a4857e", "comment": "Malware payload", "value": "3ec6d279cd98bf1d6326554468d33d193255f5829b7ed18a097f7e8caaf7b56518084360140038d8f807beba6319ff5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761482229, "uuid": "7d6255c9-0963-479a-ba9f-0b680de18dad", "value": "T1F453F107B3F49C34FDDA2437124E9B61B12C25BA4720C44EED14AB99F54BD422AE6D2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761482229, "uuid": "45cfd9ad-d506-493e-a8dd-b699f6bdd3eb", "value": "1536:M9TrI1OrGHlNZeSCeSq7R3Zz5z1kDWYQAQI:UUQRCRV5xkDWYrQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761482229, "uuid": "9af18dd0-e9d1-46ad-bce1-2470eff3bbca", "value": 61836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761482229, "uuid": "a8b6bc1d-909a-4784-9133-6f805d8efaf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761482229, "uuid": "4d90fb9e-afb1-4c18-b11f-ca3bae866987", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708311c3-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516997, "uuid": "d9013a8b-2803-4eba-8c81-752923b49c71", "comment": "Malware payload", "value": "d1d158bc90cd710f7e0e42c349dc0cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516997, "uuid": "aba7f868-9340-4829-9b93-d478896d2418", "comment": "Malware payload", "value": "9891a02155c223e786cf35237b9d8251a8f46998ecd27d31ba26f17d75a76657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516997, "uuid": "d663720a-082e-48ed-931c-98f1f4cf53fb", "comment": "Malware payload", "value": "4e60a98f25c9e06d61fac4d5467368c9add883d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516997, "uuid": "fdfe66e3-9a1a-454d-a758-d919c87f0292", "comment": "Malware payload", "value": "f346dd2fdf29474e734f00e51f7bf024c03942230688a9982d4375bf5661ec14e6bf9dfbf9a7bd3a046fd5897c4737c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516997, "uuid": "fba6710f-0e16-4df8-a03a-5c84718fe1c8", "value": "T1A25310DD0B3746F8E40DD860979E1C89F5F66DA9F81430A5BEB8694B1F3C1B080B9B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516997, "uuid": "ef3f1d28-f96e-403c-ad72-987b8101a4f1", "value": "384:iRh0o8dIeM05ihn1+QAKgjTFIzTCSsnBjwjm0PZJRyHMuB/Sod7d3wmSMBapR7A+:Sxlq+u9B/TTsX9uVIFlG44+E6DhgjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516997, "uuid": "a20edf09-1945-4dfc-8a95-d1147a6bf7dd", "value": 62576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516997, "uuid": "05ab6d51-a82c-4a03-a0d6-83fa2443fb9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516997, "uuid": "57074d30-d6eb-46a2-9e9e-84d1031c4079", "value": "f1l_f8t2v6qz1smdr8kp7e4bad3kygwh5jz-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500c4a82-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516943, "uuid": "472ba798-0d1e-4807-9e2b-d10d793f1986", "comment": "Malware payload", "value": "63efcfceca3f18c0b4ff319b4ed6c1f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516943, "uuid": "f32a07cb-af6b-4776-a867-ace03c811d58", "comment": "Malware payload", "value": "9998a308a82ec657a764f47bf255abf1de302d93fbe926299e3858261d0492e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516943, "uuid": "d0eb8656-c248-4d60-86f5-48433c40337b", "comment": "Malware payload", "value": "b40b38598a26dcd0aff38bc536e40fb808893534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516943, "uuid": "7fbce5ad-890e-48f7-bf4b-168c42d5462d", "comment": "Malware payload", "value": "7d5a61d1f9f8dd4644bff0ceb4b7738ac800cb43ff4bb2db67d3c8d70f0b338654e36d93e2e4712daa863282221075d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516943, "uuid": "b09e11dd-7e8e-4029-ab04-b9f3ab6553f3", "value": "T145D3AA4230702026D657BD2274B9EA7AC1347D4DAB97D88F36FCBB531B41625FAEC209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516943, "uuid": "da88cc39-0727-41cd-b60f-6d798081ad6d", "value": "3072:+oY9RfkgTaf17ki1faD9PbPKCvnSrL1yMDJclfzsszHKG1MeDad87z2SzHEG1cwZ:+99RfkgTaf17ki1faD9PbPKCvnSrL1y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516943, "uuid": "c65b69c2-a949-457c-8dca-4805038aedec", "value": 136814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516943, "uuid": "1c1b85e4-e6c4-4206-9136-be0061762a46", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516943, "uuid": "db2b0dbe-5ab8-45f0-a804-f6cff20c9327", "value": "156jvt_f8t2v6qz1smdr8kp7e4bad3kygwh5jz-obf.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93338916-b2c0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761520062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520062, "uuid": "0dbaa616-f635-4879-a7a2-52875099b776", "comment": "Malware payload (Mirai)", "value": "636b57f325ba56c3164613224f68be50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520062, "uuid": "5f224299-4056-4889-952f-ca3655952b25", "comment": "Malware payload (Mirai)", "value": "9ab7141febf0e0089c2b3acccad670d32a6107799b46b39bf6fb165e8bb53156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520062, "uuid": "e92b194f-6611-4b03-82ad-efb208fbb40d", "comment": "Malware payload (Mirai)", "value": "a6e9e40b4a4c34f97a2a9a8a7a56e4fb48a17038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520062, "uuid": "bf129beb-1322-4ec3-90f1-b2f751ea54c4", "comment": "Malware payload (Mirai)", "value": "54a4dca0998593c49b936e10b5d041702407c952ea207f1cae8ee78d54ce6840b7c4806b86f7112fb1544e5e266f79dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520062, "uuid": "79def282-cdfe-4440-9c25-d259f4496beb", "value": "T1F5D3B70E6E218F7EF368C33487F74A31935923D623E1C685D26CE5151E6438E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520062, "uuid": "5c812966-fc30-4dce-9da3-83ffa251c210", "value": "3072:opk2kFxPVScPO/r8ODBEr8dDOkIuPijemtsnzOXC:ikPVSye/DB2kjintIOXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761520062, "uuid": "414670da-066c-4024-8089-d01a9e4d85fa", "value": 140608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761520062, "uuid": "a40eeb9d-a62d-41a7-81cd-3e6267df59b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520062, "uuid": "e7920d49-3f00-4670-b192-469bf97de83e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd98b6a-b257-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761474737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761474737, "uuid": "2d079543-555e-4854-98e1-7a0101173f40", "comment": "Malware payload (Mirai)", "value": "54964b3c4125e47db290d3747e237eda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761474737, "uuid": "a0ef8606-21dd-4b69-bb94-eadbada51018", "comment": "Malware payload (Mirai)", "value": "9b1fd205049182245232d7991a1c2a8bea919007f68431f023ac932f1c6a9875", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761474737, "uuid": "042344bf-cc07-4ba3-852f-e207ce7d78d6", "comment": "Malware payload (Mirai)", "value": "5f350a95cef9a4b4be453991a0c22158994c8795", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761474737, "uuid": "f7d24043-13f2-4e54-a5a1-25b5d1f12db0", "comment": "Malware payload (Mirai)", "value": "e03de726c5d2ef44011184b4763ca1ee088725b0d89cf7e3f2585966d9d359d1f11ac39e4c7fc8c13fe01cc96a109d98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761474737, "uuid": "7a525c72-f77d-4eab-a413-f7cc43d16120", "value": "T1AA337D62D90C7FECD060ADB4A07B0FBEE373BA5881474E78296382644097D19F6657F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761474737, "uuid": "20a546b3-8652-42f5-a33e-a8f4668e229d", "value": "1536:bzNzDVzf9z58dTFopxwtk9PHBInSR7R23:bBPV79F84psmPd23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761474737, "uuid": "07746217-2d4f-4f35-8fad-65a889f672f8", "value": 51880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761474737, "uuid": "825deb86-ce64-4670-9f13-efe735750b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761474737, "uuid": "92e338c0-1cc3-4a21-8903-07644ef314e0", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a491afa2-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497327, "uuid": "5082a926-5f90-4067-ae45-cf22501791d4", "comment": "Malware payload", "value": "8c07a1608f95c8ade79d0098d7bf8f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497327, "uuid": "1e1fb0a1-7a6a-454d-b8b7-1ac48352b8aa", "comment": "Malware payload", "value": "9b4841e4cb69c3145736e25ace51cc424e6cc1644f5fdba3928779e0a926514a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497327, "uuid": "00dd1381-2cc1-4873-be85-1c81119ca40a", "comment": "Malware payload", "value": "0f05dbb6d31bcc7bbb7642e7bcd2dfda64add7f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497327, "uuid": "d3ba0eaf-7aca-4e35-be90-713b2cb545df", "comment": "Malware payload", "value": "18dfc01eb8c5e8e34de0f29031825dd3102c24ce7a3498060e7e625995e9ffb1a89dd4af3b5e54c3556b824796f44ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497327, "uuid": "dba47646-5578-4f51-abbc-7e9f65299ebc", "value": "T1E70633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497327, "uuid": "059801d5-a41d-4e99-8c90-364010bfd843", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497327, "uuid": "edea9937-5eb8-40d8-8cbf-fe583e988b7e", "value": "98304:aCT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:V2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497327, "uuid": "0b1929bc-c56c-4d64-9055-306c1ee1e6ab", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497327, "uuid": "246f7300-71f7-4018-83f1-7f38a132c592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497327, "uuid": "92c65a47-4bb4-42c4-ab07-1763521b0eff", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c4574e-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497351, "uuid": "ee324e58-0354-4a93-9d0a-8f04bb97894b", "comment": "Malware payload", "value": "4bc33c10eca94bdb50688327e5eb08ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497351, "uuid": "57dbb56c-0446-4639-989e-aac3a0a0f374", "comment": "Malware payload", "value": "9b6751aef6b25a63810fbec360da20351b559850f49c70d53c9c9adfbedc54e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497351, "uuid": "842daa0f-9238-4f0e-970c-b4ba34020430", "comment": "Malware payload", "value": "10e1fd17ab51884390115bae0ce12ce9b9cd009b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497351, "uuid": "67a43dd6-997b-4961-9166-d0cf30bfc30f", "comment": "Malware payload", "value": "bf70395fd61a1f81b43299904df11713dec6e845ab1ae242127cd53729bb88c210f5ff1b9b3c97b5c397db06b826bca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497351, "uuid": "cd233258-ed1e-4022-9561-b1805b670617", "value": "T16A0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497351, "uuid": "4cea6401-8edd-4e82-8339-4bafd542a712", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497351, "uuid": "e391d5aa-82a2-4562-9134-ee1448e56e87", "value": "98304:agT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:D2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497351, "uuid": "ee106004-1594-4c6d-b42a-5facc0307bda", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497351, "uuid": "143b3026-f8a5-4e3d-92c5-630ca83b8435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497351, "uuid": "3d255608-11cb-41ac-adb3-6fa155974f0a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97504a0-b246-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761467835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467835, "uuid": "ba27ed32-9c81-4760-bd23-04fb26bfc179", "comment": "Malware payload (Mirai)", "value": "b55498ebfc2e65408e53731bce08d374", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467835, "uuid": "89710499-9238-4deb-a6fa-16e29e5fe32f", "comment": "Malware payload (Mirai)", "value": "9b815172d9cb3bdafd9253c2cb0f084b6d009a0ff28e245680ffb6cfc346bd4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467835, "uuid": "95681aa4-8e23-4b1e-a028-aa21a262c189", "comment": "Malware payload (Mirai)", "value": "2ddd7e1d8c12cb332159431f53c8f3c4b8abf150", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467835, "uuid": "e7bc348e-1b69-4f24-be89-9fe83660b571", "comment": "Malware payload (Mirai)", "value": "02da8a5ff4bc5a39285d526c062d3272af013b5d430f3c0c5288a87507a11e870dd355b93e7d35ddb0b1c68a273b5a8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467835, "uuid": "d92ee316-92a4-4a3e-9583-76b0c878729c", "value": "T151F31A56F8818B15C5C211BAFE1E124E37131B7CE3DE7212AD246F707B8A96F0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467835, "uuid": "99269b34-d5dc-4087-bd43-c89e76a84700", "value": "3072:o2YqSctIqCPmQyl0ZXvxFrEUaTrcyEKRLkdOdlS+xWgP6hh1ho:o2YVULCu5sXJNRa3cfwkdOu+xdoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761467835, "uuid": "8c1e1877-975f-499d-a10b-12e95d8a8f06", "value": 164604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761467835, "uuid": "2f402489-0226-4be2-a00c-2b24c396c411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467835, "uuid": "df473bdc-d7c8-47b8-bbb9-088492350319", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed24f808-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469532, "uuid": "d6fdb23c-bf1b-4173-b025-ce81531af135", "comment": "Malware payload (Mirai)", "value": "0c013a2241df48aa635427e6ddf2461f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469532, "uuid": "b84984b0-44bf-4fd7-8442-8212c6d52aa9", "comment": "Malware payload (Mirai)", "value": "9b8454ab273c6a5a6560fcabeff7fb5da58b889c3ecf9a24c0b3fea448ea26bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469532, "uuid": "81b39045-c604-47cc-930d-e4e77fa11b30", "comment": "Malware payload (Mirai)", "value": "32c689e53f723dbd9544e0aec12f17f6ff58440f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469532, "uuid": "fe87cb46-3ed5-4e70-8b3f-71f8e23b0b63", "comment": "Malware payload (Mirai)", "value": "b704fbcb36190de9e3320b697688e98cb8a23ec26f759602fe01a9fbd8b59efb1263b3a9615d0f16a97ab07d4bbbe42e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469532, "uuid": "5100926a-45ec-4fa9-a3b5-846e835ae5d8", "value": "T18D24B71E6A128F7DF668873147F74E20976D23D616E1D680E6ACC6105E7038E681FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469532, "uuid": "a181403c-2737-439a-9fe8-ac72fa96069f", "value": "3072:fJ/Hc53dBIlcZW8wdcs/N8XJxjUSa6hh16An9:fJ/Hc53kilsN8brcAn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469532, "uuid": "04441b70-3bd4-4e72-bfcb-bea39573475f", "value": 212988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469532, "uuid": "cf9ed347-1cd7-40f8-aab5-4127c517f714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469532, "uuid": "0740858f-e972-4918-999d-b42927bfa77a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e1fdbd-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518749, "uuid": "24984693-d209-4b2f-92af-4be4443dd10a", "comment": "Malware payload (Mirai)", "value": "73d3d4651f09b52f837380b0b6906d25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518749, "uuid": "501591b4-1ede-441d-861b-adf62ca1aefd", "comment": "Malware payload (Mirai)", "value": "9ca020907ccb5ba6968fe2ed91b8f3a7684328b44c0c98f37933e506d58da7ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518749, "uuid": "348578e0-63d8-4333-92c0-a7ac5bc6f18c", "comment": "Malware payload (Mirai)", "value": "0b0af066271be5050e3b6062de5b994af6192a36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518749, "uuid": "be9efa0f-d83b-4f9f-aee9-cfb21e6210c8", "comment": "Malware payload (Mirai)", "value": "3bb341c2e905e19b7e319d3d5e277c800beed1772e11563bdfc99b556af08d62602f739ff086ba26b1d7b944869d4dd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518749, "uuid": "9c3e799b-0f38-4770-82fe-80a79926d811", "value": "T115933ACAB400DC7DF41FDABB4463490AB931A3621A931F277767FD53AC361A44867E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518749, "uuid": "d91a1e4e-033f-4d79-9b92-ca5beb329a68", "value": "1536:jAtoloJ7TK7iPcEYG//irglcUDYGsqcifItHa8Y6QP9ePI8IgfyGPLEaAYb5vP3L:jAfc1GSIvo68hQP9+BKDafbNFlcX4Yi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518749, "uuid": "9d127cb4-aec7-4e09-a4aa-681a0bbe44b3", "value": 91732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518749, "uuid": "59d58f3b-740c-4b98-a206-cfd8ea57c399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518749, "uuid": "0c9a7487-d8d2-4efd-b330-40ef27987d26", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98181c5f-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload (MetaStealer)", "timestamp": 1761497307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497307, "uuid": "c9b3236a-658e-47e1-8fca-52fd1c9ae39b", "comment": "Malware payload (MetaStealer)", "value": "e1d8d49b758ea004c6334abe393c05e2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497307, "uuid": "0737dcb6-eaaa-438b-bc6a-1665c9ac3e59", "comment": "Malware payload (MetaStealer)", "value": "9d962e680a0afdaf3d9de48735a6c3040d919acec9e4ad74c3f619c3666dc93b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497307, "uuid": "a746cfb4-19a1-43ed-aa09-f5262197c8b2", "comment": "Malware payload (MetaStealer)", "value": "e94bbec0f83f6e0059271fe8875a8fe510c54615", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497307, "uuid": "4af7d8cd-f6a2-4fc0-bcc1-f0282f9710dd", "comment": "Malware payload (MetaStealer)", "value": "3c4cc08753f7569072f201dc0c6c63c94c41d793e4e9a39dec81eed0d0a2fa098a14811b7bb20761a07a89165dc3efbd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497307, "uuid": "7382a058-8187-4d79-8fc4-98b7928724ed", "value": "T12751ED1136D803B8E3B35E3A84B69705897AF887CE658E5C0396594C2866701EC34FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497307, "uuid": "36e886d4-cf37-44b0-9bc5-204e138f0a6c", "value": "24:8mKJfY5IhsAyx+/5+HyOxA2yn6RG2Ym/hZZG1LZG7lqdd+5Cww9dsquWgncWgssn:8BYyNeyOxAdndpmZ2OMdyRw9ducBBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497307, "uuid": "bb04e8f1-8b51-44a5-bc5b-82259af1a358", "value": 3015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497307, "uuid": "4215dfea-66dc-43dd-9dfb-0f3f9d9aed49", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497307, "uuid": "2b10e30f-b972-4a60-875d-5932302764be", "value": "manual.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f231b8-b2a7-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761509455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761509455, "uuid": "766d676a-b2b4-40f6-98c6-3861ef7a7f58", "comment": "Malware payload (QuasarRAT)", "value": "abe24592430501dda149a9600f689e73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761509455, "uuid": "1a337509-dc89-4554-ad42-0ef1b8b43f89", "comment": "Malware payload (QuasarRAT)", "value": "9e823b01a935308ce447dfe3a435260635fdd66d6934d6dd789966c6bf036cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761509455, "uuid": "200a66c5-b850-46d3-8992-6dd906f4b9fc", "comment": "Malware payload (QuasarRAT)", "value": "5d925b8d166f4d0b6f003cf4fe6887846090a718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761509455, "uuid": "f2e4c8a1-24d1-41b5-bc36-71527da3649e", "comment": "Malware payload (QuasarRAT)", "value": "5be6dae74d1f06c2af0a46d465e109b50600803e41f06740ed49679636c354a82068b0e7c432daeb7bed70ee53c1150a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761509455, "uuid": "be6cfd1e-8109-4ee1-9195-617bb9d7f504", "value": "T1F015CF50B3F44507F1BF1BBAA5B605050B76F942A636C78F19C9A09D0EA3B80DE613B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761509455, "uuid": "3dc586a9-4315-4b09-84ce-44e990b5fe28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761509455, "uuid": "893b862e-764a-490f-a5fb-4a5b7889b566", "value": "24576:es3njBxJzck+uGW/yFoBkkACRT4CKJagl:esXjBTYjqqan/4RJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761509455, "uuid": "53842823-88e9-4c8e-a2c0-195259acce4a", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761509455, "uuid": "764688c6-1289-416f-a7f1-f72fd9e4ff5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761509455, "uuid": "0b6951aa-7848-4369-807b-98555032706d", "value": "start.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e9d3a7-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499717, "uuid": "f23edd87-5a1a-4bc7-8885-499327d3bdfa", "comment": "Malware payload (Mirai)", "value": "1e141b335d5f0d94be37382674d4822e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499717, "uuid": "9954da03-5aed-4cc0-92a5-48b6fc501b4c", "comment": "Malware payload (Mirai)", "value": "9ebf9623f146fad336d0499560490fed696dc446928107c663838e94ebfa7c85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499717, "uuid": "373ecaf0-e37d-4893-a8af-3cf95aafeb79", "comment": "Malware payload (Mirai)", "value": "f5fd1bcbaad24c6888dbdc3801e22d0cca8909cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499717, "uuid": "f403316a-3ae3-41f1-a803-bed399b2d6a5", "comment": "Malware payload (Mirai)", "value": "9e285f94478d8dd80f98acaac44aa82939617a980fa2f7fa7609e47e7321c9bce6b50b062328c3ca63ff39d6f2fe4178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499717, "uuid": "b88a1a8b-fb5c-4847-b170-8200e314560f", "value": "T13DB3D806EB510FFBD86FCD3706A91B0635CC680A12B57F357274C928BA5A64B4AF3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499717, "uuid": "7c39d76f-f537-41af-8c56-3997c983a222", "value": "1536:hEdsisRMfCnZUEMlCgUh9+jhaT4OAvsZ5ndsM9uPBaO4gFz3Jt0cdliO:hEdcRwcUE59+cT0vszcYIz5icCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499717, "uuid": "adaf9b74-f45a-4769-8560-90e0af6ff574", "value": 109636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499717, "uuid": "476bfa1f-37ed-4971-ac0b-87de5dfbce14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499717, "uuid": "e479b284-e42b-44f0-b29a-16824900fd45", "value": "kvariant.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e224d9-b2a5-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761508527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508527, "uuid": "2a5165f9-4f36-4a88-bbf8-1983239a9efb", "comment": "Malware payload (SalatStealer)", "value": "aa0af5aeb5ceaf94596164e6f0cb60d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508527, "uuid": "8cd730d3-43c4-408b-b31a-8f9cbd206c7d", "comment": "Malware payload (SalatStealer)", "value": "a0fccaae0b502fa8cccd1b557c0dd94da5f7f2b321629edf404f87f80d9ab698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508527, "uuid": "78d63054-bace-41bc-b005-02905e855100", "comment": "Malware payload (SalatStealer)", "value": "3c2ae67949525f330f837f0ea64d1499e18376e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508527, "uuid": "bcd9ba15-3334-4b67-a3b5-177e77b98cf9", "comment": "Malware payload (SalatStealer)", "value": "89d48835905b4d8a2097ce6120ff961517da859a4c5263abc16f809ae6c966c06d7ce7b2902bffbab45401ac65bbe593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508527, "uuid": "b0612b74-968f-4fa9-a2bb-6ba03151cd76", "value": "T145F5335792F9E134F532FCB362136EDC036AD32199D4251DEA99A8087883F3F52A5C8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508527, "uuid": "9247ff98-5183-4979-bb21-e87d469db476", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508527, "uuid": "60603b5f-5d20-484b-9bd4-a99415bc3698", "value": "49152:o0VjeNcApjekqJRFHbFxHsZqhSa03ecQl78yeqevccgxxU6pHniePkHaTKw8:RVjee8je7RxHrVNce75Yc1UKTPk6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761508527, "uuid": "8f8f39e5-bf7f-4645-bef6-053d678ea5dd", "value": 3560960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761508527, "uuid": "bcaccd1f-b39a-4d61-ae4c-e1e752c83143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508527, "uuid": "e6c07b39-bbbd-41d6-be99-4d8e63822a5a", "value": "INTERIUM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eae148-b24c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761470048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470048, "uuid": "15627f6a-c1be-438b-a03a-bc0ee57e51e1", "comment": "Malware payload (Mirai)", "value": "21afe987ea25195a4da851c9218a783b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470048, "uuid": "ce021825-892a-4f24-af62-97bd0081252b", "comment": "Malware payload (Mirai)", "value": "a118f0717c849f10b0c5d9fffdc1e599d76416243862e3948091c2e13db9afe8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470048, "uuid": "9ae27fd8-97ce-45cd-8999-36d429300c84", "comment": "Malware payload (Mirai)", "value": "568ba2eb215d97d87b96191c988aff0de40ca56e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470048, "uuid": "e25ad15c-4611-4a35-926c-fd76311c81ad", "comment": "Malware payload (Mirai)", "value": "0e6fe088de93aad03e026d1a4ab0271022e4ca4052fc44fcc3e446a01f8aead5d8a2bceb4b48ac111048fce513ae5eca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470048, "uuid": "b7f92568-313c-4d88-85a4-2e3071da9a7a", "value": "T14A434A42A35C0B43C1A71EB03A3F13D2939BBE6221F0D144694EFB4ED675D72458AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470048, "uuid": "2ff1a6b0-64f3-4f9a-89ad-4c78cdf95486", "value": "768:27eFd44H6CYGt1Cfg0qAcqVq0SHwAMvyEtItiVkRo3C3XMTRfOwEypO6IlWW0pNo:qeFd9BsTx0ypjIERrN02yLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761470048, "uuid": "1265311c-a07e-4d8d-a19c-2a758664bad2", "value": 58564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761470048, "uuid": "871f0dff-f528-4697-8bbf-ce97bcbbd027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470048, "uuid": "ce011a99-967f-4c93-8207-bca7065b1372", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c2dbc2-b2c6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761522703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761522703, "uuid": "18c5f604-51ee-4cbe-b4d5-a547faf3fe32", "comment": "Malware payload", "value": "00d78556205262828a798f2df5822052", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761522703, "uuid": "37ebb77a-1821-4db7-8016-8dfadd715399", "comment": "Malware payload", "value": "a29a13e972d06577532b6407196fa599f74374da3720905157e85adc4d98491d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761522703, "uuid": "b045c1dd-d34f-4a5c-9096-25e017daf345", "comment": "Malware payload", "value": "03574521863d7a525370ef0d320c872cd05d45fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761522703, "uuid": "9364ca89-15d7-4873-bd52-7c8d5171bea1", "comment": "Malware payload", "value": "6893fff9b00983c546b2d3bc525b8f6a205a188b8cb7148d2ba30db23b6f5359ad45fc4a4da8cdf59706f6274e95263b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761522703, "uuid": "8cc38cec-721c-4bcb-9c8e-4560e5bab040", "value": "T1C8C30796B881AF21C6D156BBFE1F418E33131BA8E2DE32039D181F6477CB95A0E3E515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761522703, "uuid": "4cf097f5-92ad-410c-aea0-e12f4542bb4d", "value": "3072:6vdFhWm5GtOPxjXNUAEvA38olAjaPqI+A6IVms154nz5:6vdFUztYxjXNUJA38opPqRA6U1O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761522703, "uuid": "f87f0244-863c-4838-8600-67e3503d71d3", "value": 128664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761522703, "uuid": "a9753d4e-b435-4c3b-a445-3dc13da07761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761522703, "uuid": "f23d9868-a32f-4bc0-ad75-01d0b216a075", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52414be-b208-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761441064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761441064, "uuid": "3b7e3498-6483-4881-b292-c1af21917b10", "comment": "Malware payload (Mirai)", "value": "36dc3f1d510a964f70ddebb2864417b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761441064, "uuid": "190cd396-e0c5-48bb-963c-ae3e12d53d8a", "comment": "Malware payload (Mirai)", "value": "a76849d911822c6588d6cb5781a5ee1d118db89aaee744b7a2d7ab58d01b4617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761441064, "uuid": "3fb9cc21-5d1a-46ef-8242-e343f0e739a0", "comment": "Malware payload (Mirai)", "value": "1f77201b57ace0709fe423fa0bc788918f22e95e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761441064, "uuid": "0aae95ac-01df-48f4-95b7-d35eeb50b6fa", "comment": "Malware payload (Mirai)", "value": "0d4dcb6950f2214a099c3d9bcead3bc03646ed491fbcbc85f6d18c65433f90a5913c449279b6fce443cd9dcd6ba629ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761441064, "uuid": "28b2bc1c-84d3-4635-bce6-3cf06dfe8c54", "value": "T15304961E6E128F7DF668873447B78E25976833D627E1D680E1ACC2105E6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761441064, "uuid": "b54d2adc-868b-49af-8584-53eaf1514d70", "value": "3072:CFeN/eLxp8kxrPWkcP4hk7ZOVxOZi5Hq/qNG6HoIVVeTbm+:CFeN2Lxp8kx7W5whKTw0qpHmTq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761441064, "uuid": "1935fc75-5d4b-4f2b-89fe-134b08cadbe1", "value": 190168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761441064, "uuid": "97e6fedb-c194-4166-9752-273c14440d73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761441064, "uuid": "20c3095f-a007-4f29-a295-ee7f1de9d27e", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a80e1a-b287-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761495690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495690, "uuid": "54cbff9e-a934-4499-9173-70af694ed122", "comment": "Malware payload (Mirai)", "value": "b6d87ed0b29e4e08c21210595d09d8f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495690, "uuid": "894d07d9-1f5b-43b0-988c-01cc24c97b13", "comment": "Malware payload (Mirai)", "value": "a7982ee1085ed85465c733d7bdabab74dab338ba6d2f22fc0c4acece18cf8398", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495690, "uuid": "b19a9142-3d98-4c32-91bd-f0bb76f7740b", "comment": "Malware payload (Mirai)", "value": "2e3aa471381bc414b06698905318fa73e7f15dd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495690, "uuid": "f613f054-5273-42f3-b2dc-39f19ce0512c", "comment": "Malware payload (Mirai)", "value": "d75cd17e411feabacdfdff706f7cab6a03d445a4ae971df45b42557fe5ee4ccaf3c89d4572fe57e569ca52aaa063a347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495690, "uuid": "8ead9136-0d03-4da4-8932-deb97b9412ec", "value": "T108F32B85F8D18E12C6C612BFFB5E428D372657A8D2EA31039D265F20378B56B0F3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495690, "uuid": "6b69f6d0-f14a-4136-94d6-8b0b2f0a9c14", "value": "3072:e2kE54TUogLCC4siHbOCrdSM4ZZzMSsVz6zUDU:e2F54TUogqsiS28M4bzvsV2zUDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495690, "uuid": "098f94b5-ef50-49d1-bea3-1a28e0df0e66", "value": 170720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495690, "uuid": "9855ab68-1c73-4f8a-9902-35d5ca021bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495690, "uuid": "dd764b10-e17f-41f1-9dfb-62ed454801f2", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cba48d-b228-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761454789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761454789, "uuid": "d1f187e5-a290-4c69-b2e9-2501083f2442", "comment": "Malware payload", "value": "442b339d7d902e2fcfcaa94aab76844e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761454789, "uuid": "410c6369-1be9-462a-ae02-a5b1d130f267", "comment": "Malware payload", "value": "a7bb534fdd57b72a3a3e2f5e7b0cf36752855419eff8a735a9ebec28d3289c82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761454789, "uuid": "a7b271b2-bcef-42e1-a286-cef638f3c9d1", "comment": "Malware payload", "value": "3bab1d4fc3b40cb18015a4b6d1631e0bbed2ecd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761454789, "uuid": "b37b7c34-2ee1-4ef4-bab5-27cb542711b6", "comment": "Malware payload", "value": "a56bab6c5ce3db8fd2b40e4643b2481946326895e7480d88f9f8197c86597953c610775023714c54933699dc8e70fc60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761454789, "uuid": "34cb9a66-127b-4324-8603-3efb10608ab6", "value": "T15343017960D7A18CDCB8EE3B5830823AE64BFD83E58200EE73C2D9D096595877F06E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761454789, "uuid": "e5e2372d-f233-42fb-b73d-81f54163a839", "value": "1536:4aTmLQ40bQ5+SQmbRav1bfayJwd9qMkGMbV5:B6LQRs5iwRw1bNJwd9UJbV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761454789, "uuid": "518d8bbf-84db-4f4b-9caa-cf39ea252ed9", "value": 58320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761454789, "uuid": "3d92dd41-96f2-4f48-bf80-f0875c2ee29e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761454789, "uuid": "8417feb6-7507-4891-81af-b2fb4c3e8387", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044820d9-b252-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761472577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472577, "uuid": "e0bd9b5f-fbd4-407e-81a1-19bcfe411d45", "comment": "Malware payload (Mirai)", "value": "15c7ee3a48b762f3131857c33bc5fe25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472577, "uuid": "f6b36f25-bccb-4bed-a50b-b96651348158", "comment": "Malware payload (Mirai)", "value": "a8743eea6322a00a499773f9faacedd214fe2829e4701d71a76c58dbfcb16a0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472577, "uuid": "f6454b6a-ef49-4a84-9266-017001b6fd52", "comment": "Malware payload (Mirai)", "value": "483259294e0baeacaacda6171f0b0bc2dd9481ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472577, "uuid": "3101f31c-9974-4e83-b353-9c1aa68ff0e9", "comment": "Malware payload (Mirai)", "value": "a8e3fac4c875062747aafd643e35c6c22c99a6e89e61006b0b811f0b8a51851ae5eae4b8aa8feb3da7e861941233ac11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472577, "uuid": "5daa69bb-3a79-4af5-bab7-1facde6deb95", "value": "T1CC3329A7B404ED7CF82DE77F4467040EB131B36054C20A6573A6A997AD7B2990C6EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472577, "uuid": "f280339c-31ea-4b2f-bd5b-aa6d6aaa0461", "value": "1536:30t3EAtEw0EwsEAqEAeJEwsiWCKd5j8S+wZNsoTtnfaarso75Z:Et3EAtEw0EwsEAqEAeJEwsi+5n+loRfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761472577, "uuid": "24c7ef4f-47c6-4e5a-8527-6376a49476cf", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761472577, "uuid": "f0cbcef1-1882-4636-912d-0b6aeb7c2b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472577, "uuid": "162c7952-1b99-4b33-b8c4-4d76034dd21e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bab01c5-b28a-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1761496668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496668, "uuid": "259eb832-852f-4f37-acb2-2024720d0ab5", "comment": "Malware payload (HijackLoader)", "value": "a6eb4cb025391918f5ace6a886b783da", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496668, "uuid": "352713eb-f301-49cd-84af-8895cbb8f158", "comment": "Malware payload (HijackLoader)", "value": "a8a4d5359e832c8d0c8068f84e94d373ada45e8f3590ba02931000bcf37d3b11", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496668, "uuid": "7eff2ce9-a3ca-4603-ae53-0ad296a93618", "comment": "Malware payload (HijackLoader)", "value": "3eb9e6cbc4d496696feda61e8998b895c0bed90f", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496668, "uuid": "21f5aa35-71d3-49a3-9e19-4dc7f66716f1", "comment": "Malware payload (HijackLoader)", "value": "5678c11e4bb71a64a4e8b26d2fb0bbfb674276369f68b631a23e533711bfb3436058b6472a863479ea10f74383c64d81", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496668, "uuid": "92f36c45-f0c8-401b-9d22-be52968a10b6", "value": "T11CD533A33A85EBA7C113B5740094D0C41D5BFE7943A195A8F796B15DAA3EFA0E200DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496668, "uuid": "a69f24d2-8de8-42fb-9bdf-bb86929a58f4", "value": "49152:aXPbIlnmSjkjIEFL+6hdX8XMZl5r6goM2ngm0e:aDI1PeIq+UdXn8gpMgte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496668, "uuid": "7d34ffd8-af25-46a4-9431-0a261e6a2503", "value": 2777088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496668, "uuid": "03618f1d-e150-43fa-baf5-c6a505c61206", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496668, "uuid": "e2c98a2a-524d-4ab0-a326-6b918fef0a15", "value": "SecuriteInfo.com.Trojan.Siggen32.1057.23380.7751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb8d341-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761496428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496428, "uuid": "81144976-5c79-483c-8d50-cc9c1dc76b83", "comment": "Malware payload (RemcosRAT)", "value": "d9c1b4a7b9419d49dd1c46f4d7dd2dbb", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496428, "uuid": "fe9c14d0-c470-4ca2-b7e9-c91766cbe3e3", "comment": "Malware payload (RemcosRAT)", "value": "a95e430dd35c03340ecb6140238fc7773f72fff0167e49ea939eb8855602818b", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496428, "uuid": "894431af-1c1b-48ad-b5f2-525197d71aed", "comment": "Malware payload (RemcosRAT)", "value": "cd98716a47b9ecb55de379e3fa0aeda97259ac03", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496428, "uuid": "4b90bc6b-b096-4c17-9a39-d0821268fcde", "comment": "Malware payload (RemcosRAT)", "value": "39feb2e81d1e23b66b62d4a8073eaebd105777784c99c0528230d595e1c336a2e05e1132f4b55229dbd23b5b042ea155", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496428, "uuid": "e9b3f32b-c76b-4cde-b1b7-936e9f37c199", "value": "T188C5CF5D94B05D825024FE74AAC5F793CCEA07851A274B920FE5E2A67202C43FF7B762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496428, "uuid": "38348c15-b757-4358-808c-bc866d0d4f41", "value": "24576:XokcDVKNaxoS7yOlskBo9sWL6VwXv8MSAp:LKKMNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496428, "uuid": "d9c32f0e-0eab-4264-92ea-3b25e782baff", "value": 2681070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496428, "uuid": "1e89d550-9510-49d6-8e5e-a11fe263b540", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496428, "uuid": "c8a05be7-5438-4f49-b936-f2fc5f436a7a", "value": "Purchase order.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e6a7a4-b269-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761482787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761482787, "uuid": "a096f0d3-edee-4265-a367-eea50ccee32b", "comment": "Malware payload (Mirai)", "value": "7e3949c5f4ae9c8aabed66aea491ad51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761482787, "uuid": "3258259b-bf01-4ebd-8718-8ea80c44d9ea", "comment": "Malware payload (Mirai)", "value": "a9dc73cac55360e8a92bdcf28bca8077f025740ba0632c7bf1c8d123f2348189", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761482787, "uuid": "45786d41-b029-4b8b-a63e-e0c58afcff48", "comment": "Malware payload (Mirai)", "value": "e2846e33e9d2cec47fdc993be93bd409c05f441d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761482787, "uuid": "82ff0a61-9c82-4215-a660-18f57c455bc9", "comment": "Malware payload (Mirai)", "value": "c1c1f34d9fceebfe4225429b6a112b5b3a5ee48d0d90858b3ce960a517ee0c4e0225d53cdeeb2fa2cefdacbb2ef87dfe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761482787, "uuid": "489a7f3e-35a5-42ea-9784-166d6a717d39", "value": "T17D148120FA0663B1CC721A38A7992E4A6E7714555FEB26312D1F533CDE628509F31F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761482787, "uuid": "701bfce7-93a2-4eca-9d88-151ca2faf3f2", "value": "3072:ixsAb4hcVbBB3htYg7sqKH6hmwnKnytOVIu++qUTV:iB/zhigPZmnEOSYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761482787, "uuid": "ea7dde9e-8e82-40fc-883c-1b7a5bd18bea", "value": 201460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761482787, "uuid": "5e77058a-7c08-409c-a2c7-ea7cb94a95a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761482787, "uuid": "55c206bd-82e1-48ae-9119-0d420d40966e", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a918e910-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516662, "uuid": "80202b21-728e-4a03-ade0-92b6f5ec224f", "comment": "Malware payload", "value": "1b3278b5c08f676c62c0a1f5dd1fff43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516662, "uuid": "18325bd2-3c69-4cab-8de8-cff661b5dbbe", "comment": "Malware payload", "value": "abfef5885b48d80f03063d96710c39d285dcd948acff2d2e7aca3c1e902245e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516662, "uuid": "dc0b3851-08dc-4c7e-af60-19e8c5be4eea", "comment": "Malware payload", "value": "975d92a987210bea7e93f4ae526461307538095a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516662, "uuid": "7f77992e-2e2e-4615-905c-e2844815f0c6", "comment": "Malware payload", "value": "0c2acc2d7a7565f7ff7c518f5abeed2579e4157d1d22c499003192befabb6ebdef046ae387f5d3dbfc54a7c36f1f8873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516662, "uuid": "e07e5a39-293d-4006-b630-2df37c799b0b", "value": "T19F07330AE7801CFCCDA796F48B529A42F73BB46603B5D98F07689D924F275818E2CB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516662, "uuid": "011c944b-6d4d-4a5b-beea-72a168cf0222", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516662, "uuid": "ceff235c-1bc4-47ac-b2c7-a533e8152b74", "value": "393216:5eZobjTkIvLBLTypt/cIIioc774ILwFFVMS:oZoXTvLBqpt/cIIitcDMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516662, "uuid": "528e028b-1f4f-46de-a532-f06738e6c092", "value": 17158707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516662, "uuid": "56befd1c-267b-42a6-86ce-ddced45d4076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516662, "uuid": "530ffa40-e3e5-4fd8-8fab-c6b75a0fbb43", "value": "_Ashampoo_Driver_Updater_1.9.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8536b2d-b251-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761472477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472477, "uuid": "5c2127f2-474b-43df-813c-4b95556a84fb", "comment": "Malware payload (Mirai)", "value": "45ac69d95b400e703776e86d00024d2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472477, "uuid": "ad007736-69ba-47d9-90b4-65d2489c4108", "comment": "Malware payload (Mirai)", "value": "ac06ffd608453abb116c06c3c714badd364198cf425ee5cce394e2e42e5183ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472477, "uuid": "8137f6cf-dc84-4238-af3a-4c88c2dc2b3d", "comment": "Malware payload (Mirai)", "value": "f89798fdf4a7a1fc444a19d043747de67ab72d79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761472477, "uuid": "4cad1a59-86a7-49e7-9bca-edbc05b54eb6", "comment": "Malware payload (Mirai)", "value": "12e5882c8d1c24a9ad40d83ebfd5154374a4e2a2a932483d8e11094ff64c2ea677f1cfc70084ff891e6e9bc6a879662e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472477, "uuid": "7e919a1b-ccd2-4ee8-ad80-1c4bf5c4fa8a", "value": "T1F2532A56B9C19B21D9D0127AFE0E114E335317BCE3DFB2268D20AB3177879670EAB506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472477, "uuid": "4d4e8709-566c-4223-af17-4d53e8e31d97", "value": "1536:xwnAKY56gg5MWL5Gc25UaA5vcA5J7iX5Gjxaqw/MIHiB41nMsLrzAz5BYOf:EY5dg5VL5d25pA50A5J+pSaI41nMs/z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761472477, "uuid": "b5af1354-c25a-4e1c-9484-8ec8ade3ddaa", "value": 62876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761472477, "uuid": "11f71a0d-22ed-4609-9efc-39c77eb6ee78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761472477, "uuid": "f7c9b106-27c0-4e20-b3d3-fbbf04ed3bd6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0e5590-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1761516937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516937, "uuid": "feb73a25-808b-482f-b771-10639e0b44bb", "comment": "Malware payload (RustyStealer)", "value": "8c581b011a9d2301f239ff8234d44835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516937, "uuid": "6cc81e00-65b5-4e39-ae2b-c2f94bf2dccf", "comment": "Malware payload (RustyStealer)", "value": "aca6be26ac815b0b15cf3c5d9351fb960659dd49cec6059773116eb8b0e6aac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516937, "uuid": "72e9384e-a360-40f9-9c57-ec32ea44a3b2", "comment": "Malware payload (RustyStealer)", "value": "d6de247d11062f632cb6eacee930e3cd1620148c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516937, "uuid": "abd65483-2c66-427c-912b-9fde6b8f378b", "comment": "Malware payload (RustyStealer)", "value": "e7f8947f5d2e6f54d101091d253623c78715e65a844d4a096f129d78a47c9eecae0192fa0760f0d27c2505b0f6ed407c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516937, "uuid": "69b78bd2-c228-43ca-816f-360df807488e", "value": "T127C4AE12FEA585E4D086C47483168273EA717CCE0B36B9FB5AD505302F99FA16F2CB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516937, "uuid": "e53ca765-37f0-435c-9cba-91c138975cb0", "value": "6f25e5a32544440f356a702c94e6b3cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516937, "uuid": "d4e82e18-0eb8-493e-ba30-7b6d6ffd99fb", "value": "6144:fPhi4RHINYs08ZZGMoNXBEF8o5YoKwT9qFeJe7+uf/+f8xTSTvSDsDCNTBz7cn/C:fpimHu08GzYdaonghi8xWgTtQ/gd9okB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516937, "uuid": "1503a3bb-14a5-44dd-8837-774c99320e2b", "value": 577831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516937, "uuid": "ed9b6612-fd38-4c76-911f-e783c78ef75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516937, "uuid": "5390ce09-ccd8-4073-877b-a57c1b5a68cc", "value": "4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad28698-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469367, "uuid": "8139d9ec-aecf-4db6-87fc-13d80038dec0", "comment": "Malware payload (Mirai)", "value": "2ee22eb3b637e5dfc28669009bb05e5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469367, "uuid": "326bbb74-7b38-4465-879c-e8d42edfc1d2", "comment": "Malware payload (Mirai)", "value": "ad2364198fc450df56a290f0d2bf993a57529db874e7f37c8585166ed86c74f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469367, "uuid": "26fa46dd-580a-4926-a0b6-3dcef9d11a20", "comment": "Malware payload (Mirai)", "value": "f53b7687fac165da12a0775a4c7025f0b79c51aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469367, "uuid": "098ef265-b951-4749-9358-abced2022413", "comment": "Malware payload (Mirai)", "value": "ad5254293bef664919894edf579a58dfc8c15f4b2727f88ce9cc0e9d3fc1d804e17b6dc79308d30c63ed86f66bf26051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469367, "uuid": "90372437-2e19-4511-a095-b59ad09831ca", "value": "T1A7934945F8818E12C6D553BBFA2E018C332153E8E2EA7217DD256F6173CB92B0E77991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469367, "uuid": "f79383d6-d40b-493b-b053-7b8def2c2d60", "value": "1536:Yw53Jth/cUo6Y5fQ+1TXjKI3Lwr+w0CfvSlb2ZkmAFRhZuE9Z8guCv5wbZnI:P55teBsaXXbwr+wXfvm4FAFRh8E9Z8GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469367, "uuid": "ef0d4d6c-3243-40d4-b732-2e5fda935f07", "value": 92796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469367, "uuid": "4ce2f094-d51d-4b6a-b164-9dd09506704e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469367, "uuid": "289b56d7-f45c-4196-b97f-a1220f9e379a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b30735-b2a6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761508652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508652, "uuid": "d637950f-4a19-4b5c-8506-c21710493ab3", "comment": "Malware payload", "value": "5ea519b65653e2d0821b23e4b00e0d09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508652, "uuid": "ba3e703e-7079-449c-9a9d-a91f9d88e63e", "comment": "Malware payload", "value": "ad61959f21fc0078c83f70d86c7b66d75a81d085409589a8f2861a9d5cb023e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508652, "uuid": "ca520b06-2f78-42e7-bf66-2849f635f6df", "comment": "Malware payload", "value": "2667399290d894af886f0e5a4501f70045af5080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761508652, "uuid": "6403c276-bbed-412b-8f5c-d5a9be49245a", "comment": "Malware payload", "value": "1fe0ccfe6c9c50997f115fbc77508048cb101302b5b5f0399a7aa8d5cf78ea48b796e388238943d541d38a4793bda15f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508652, "uuid": "c2671a5b-8a40-4da2-9ff3-4fd71cdf6188", "value": "T13A05E4042B944D00D1843AFD8DFA6A15C71EADED3A02674B3706F2692D72DEDDE2D2C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508652, "uuid": "e2b51fa9-c527-4ffc-a1f3-f1d664034d3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508652, "uuid": "f20e5403-5521-4374-a507-7872bd146c25", "value": "6144:VA4cfa5nzSWnN1XuuITfKVKEolWcYFEcNFhJeV2aK+P9spcdT1z5w53a7s0Yfgbh:Ozy5nz3nvWTfKVRFEcPHGr63BMYIBCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761508652, "uuid": "c6a08762-72ab-4061-a3a7-0ece11d9c60e", "value": 854528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761508652, "uuid": "95c9ee9e-07c4-44c8-815a-8632a66f1030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761508652, "uuid": "2a812110-2add-463d-81c8-51ada15f92eb", "value": "Neverlose.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99e5466-b249-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469043, "uuid": "31e2d68f-4ff7-4b3a-b4a6-606765d2fb6e", "comment": "Malware payload (Mirai)", "value": "1d5bf0c226a49eb6edd0176ccf8bef59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469043, "uuid": "efda649b-3b19-404b-815a-c4a92f2a8391", "comment": "Malware payload (Mirai)", "value": "ae20df897de06b00ab00d5bc75a91b0e427217d0d344dfb8af759566e680bd75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469043, "uuid": "fc3b4723-c9a7-4003-888a-e2d508f4dbe0", "comment": "Malware payload (Mirai)", "value": "3676f04872e65199626622c80bef2c6afda2a82a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469043, "uuid": "37d6cb11-5f65-4942-b731-f99e48e68434", "comment": "Malware payload (Mirai)", "value": "7c396c04fa4a93cfe750d7218d62e5e9e3b5ab5317dd5a401548a3bb88634984072b28f965c9a082d06eb9ea5f6fbeb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469043, "uuid": "1aac21f1-24d4-4dbb-9b7b-cf7b1fd6e98a", "value": "T19A243A46EA408F13C0D727BAF69F4245332397A4D3E77306A924ABB43F8779E4E26505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469043, "uuid": "32bd2a3e-0662-4142-981f-59499002aaaa", "value": "6144:VTKlMTtWp8/FzaEOA3zHpz1tzWFgVl3theM/Rhm12JLGhQH:lKaF/FzaEOA3zHN/SGnhX/Lm1sLGhQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469043, "uuid": "9f9df5b1-6894-48b9-bae1-2f82148b08de", "value": 219690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469043, "uuid": "2c1cae86-e9b7-487b-8aeb-afa252fde736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469043, "uuid": "aff56942-0ffa-4acc-bf60-7053c58f7ca9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fbb3c9-b23a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761462586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462586, "uuid": "41b1ee0d-6235-4868-ae02-2660a161bad9", "comment": "Malware payload", "value": "1474da92b41f4fa1ed760dc3655230fc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462586, "uuid": "e18965b8-794f-4777-8fa8-d4c7c35f77ab", "comment": "Malware payload", "value": "aee616bd1abc008c1c7f9e19e1a16558865c2088ceb8d89bc652180085e64b54", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462586, "uuid": "8f435c5b-15d0-48d6-a48f-02e78a7312d7", "comment": "Malware payload", "value": "2f5b10d354aabafaf87809b2717a4a1d021a8904", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761462586, "uuid": "08983bd9-3208-46f3-9869-b294db10594f", "comment": "Malware payload", "value": "8aad07dfde735add96f2300664f9e33180c3a5bbee8ccdf09f50adef7295447d54d992f276b20bda2d443d25570a84af", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462586, "uuid": "13c77b10-5ab1-4349-a226-cee8a4e1a627", "value": "T11BA4AE306BFA5204F9B65F3EE97A7221882B3DB4DF3AC34C01858B598932550D465F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462586, "uuid": "9530cd5d-e045-405d-822f-f709ba3e1634", "value": "48:mjEMpf842vPxrn4Hd9p6+kPpf8PreICT4H2c2ehkPPpf8lZU6lHD/PJ/mA+9/RNJ:m1pfZ2XxL49c+CpfRIzhk3pfmZB+hkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761462586, "uuid": "56cf650b-5663-4ac8-a4c2-c7b03511b0b7", "value": 467102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761462586, "uuid": "ae872052-b295-45b2-a607-b9bec43dd760", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761462586, "uuid": "f8cfbc0a-1113-4d29-b9f4-ee1b909f4d4e", "value": "Dodatok_do_zapitu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bef099f-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1761497608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497608, "uuid": "6eafe728-4eac-4140-b460-04ed1741fdcf", "comment": "Malware payload (DonutLoader)", "value": "7c5d9e4121c74f9b5c7be2bb03018a2a", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497608, "uuid": "33ef7c71-6618-4f76-9df9-915088af3422", "comment": "Malware payload (DonutLoader)", "value": "b0961aa2c9918dcf749b377444825d064161c4c4abea2c7fa143b634a4d2c8e9", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497608, "uuid": "c97408ea-182c-412c-a48a-b3b5334e82b1", "comment": "Malware payload (DonutLoader)", "value": "30d32984988e34295b3845ff9c7792e1369aef80", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497608, "uuid": "acbfa3f9-8379-4b2b-8f17-3aa2e683c807", "comment": "Malware payload (DonutLoader)", "value": "fb7a4d9fb05a60f7f4a62066597be3ccadb169df9c9f8df6a1f0e1cb18d96381b8dbac10f6e7627ca098e85e53c43014", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497608, "uuid": "b27d528d-839b-4093-bafd-7f4081540ddb", "value": "T177D46B2CE0B6D4860205E3EE75A40686682A11DFD1EFD26816B4DD6FA41873C73FCFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497608, "uuid": "ad8d892b-51da-4702-bfe7-4c9ddda7ae85", "value": "12288:BlhNPtsD6VOv+2EbEJGa0k5O6BdPhBHtmxdfsThttq1o:VttscOCCG329BdhBNG+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497608, "uuid": "e6928f0e-cc57-4723-bb84-7f395636761e", "value": 654782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497608, "uuid": "a9fd0ac6-77a5-4c37-bdde-dae09d197a43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497608, "uuid": "aac397d7-2cf5-4469-942b-427ec9f4b707", "value": "Quote.pdf--09098.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85273f63-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469357, "uuid": "c025bb8a-a9f2-4e32-95fe-b78212834577", "comment": "Malware payload (Mirai)", "value": "5067862fdbcc047f25ed781fc7f0d399", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469357, "uuid": "3ddfca87-d3a0-4474-83c2-73c488693237", "comment": "Malware payload (Mirai)", "value": "b0c0060ddb0f0aab58cfd89db84e74189a72ff8a729d6278fa71d444e8a8eb2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469357, "uuid": "7903d870-95ca-42cf-9a6b-43ba18c92f7d", "comment": "Malware payload (Mirai)", "value": "e90cc4aefb34ad3efd2ee9a9bcc97dfa71d956a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469357, "uuid": "730c5a41-bb26-4767-bfb3-d7c7178b29b3", "comment": "Malware payload (Mirai)", "value": "605a9061b231a035deb8404ddb9abbb72a98c5d04c7a2ef52b56ca674bb2d9850a6e82f4299e9006bdad55b724936d84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469357, "uuid": "5f5c9fce-6afc-4609-9b16-433dcc9fa85e", "value": "T1A0E3D81A7A118F6DF39AC23547F79E31566436D22BE2C045E17CEB102F6038A685FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469357, "uuid": "7e551c78-7a08-49ba-aaad-752113dc7791", "value": "3072:hPe4Q4LAnPVSqEm3CjzjuP4pJsUQXXwbZnr0PV3dG:hw4LAnPV93CjziVXwRrI3dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469357, "uuid": "1a3c5cf2-7eb4-4228-aac2-b505a11e4d92", "value": 152503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469357, "uuid": "eb51a1b3-76fc-4ea7-bcbc-40b11f5d11ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469357, "uuid": "52416e16-d93f-4d91-91ae-46bd53f51a44", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776bdffb-b28d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761498111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498111, "uuid": "a08d1424-b349-4f25-9cb5-24228eeb726e", "comment": "Malware payload", "value": "03c050cd02184a4d28db77fa4dc1e9e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498111, "uuid": "566dd649-372c-49cb-9686-544d2dd26a69", "comment": "Malware payload", "value": "b0e10105327534786c62ad3082d87ae21d1203f24865dc8ecb86e212ad506715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498111, "uuid": "efad40f2-27e6-497e-8caa-9d61c5ca1377", "comment": "Malware payload", "value": "7da705a2dbb5c9fc5766155963eaa658c609e3e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498111, "uuid": "8735d468-a341-443e-aa3c-9d7c0a0ca496", "comment": "Malware payload", "value": "729e380f172bce877ac9b6b7703e911db8fb6474e5c3adf509c84d3db513bc5c549a32fab31470836f1d0ea20d1df5bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498111, "uuid": "60551ccf-18c9-42dd-a7a3-8b59b2b2fdfb", "value": "T1A46302167D3152D2DB84CD7EE1A430138A42EE9FFD26AB889110E150B5ED8BCF36D287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498111, "uuid": "678efa2f-8896-4e48-9634-59deba6be1f9", "value": "1536:FqrxuyCW3jW8jiuVJ/kSHO1s+mP4C8lPgMzEjSu8uANy:Fqduo/muVxkH25aPjzEjSpNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761498111, "uuid": "cb6eb859-238b-479d-86fc-878e3e8b343c", "value": 66736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761498111, "uuid": "d95b977f-e39f-4b0a-b3a1-0af38d63d265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498111, "uuid": "4b4acf84-b2e1-4bbf-b6f7-5e713e59287f", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a1e866-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518673, "uuid": "86ef9e44-5ab3-4927-a9cf-370dee572dbf", "comment": "Malware payload (Mirai)", "value": "1801ba8976a798d491aad1594c639508", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518673, "uuid": "d5f5924d-f8b7-45f2-9297-5e163a392354", "comment": "Malware payload (Mirai)", "value": "b1ceeb5f82df1a8c0f35e4211d0720e3854fd9b5cb62b3294babb926751b7525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518673, "uuid": "bc9a5b79-0e37-441f-aae2-d80186677da4", "comment": "Malware payload (Mirai)", "value": "eda3e70905f9ce650b775c863dc7f4daa02c15a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518673, "uuid": "11affd00-4718-4b2b-8cd6-58af5c811991", "comment": "Malware payload (Mirai)", "value": "8f3d8157f23217ab57ecbb720d2642f7f05fdcb4856297e07594caa6d21de47e4b80db983ed08607ce420b580acfd3f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518673, "uuid": "011aad95-2caa-4bdc-96e5-b99360572d94", "value": "T19CD3E84ABFA11EFBE86FCC3745A9170524CC562721B87F7AB530C518F24A28B59E3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518673, "uuid": "18d6a49b-3b64-43c4-a24d-0c3ae9e822c7", "value": "3072:EYbTVObeGdz9cNCvSpFe1Von3z19BmjOy:NbRObeGdz9cNmSLe1Vo3z193y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518673, "uuid": "7c3d8031-90e7-46ee-9b70-b21f313fb39b", "value": 134420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518673, "uuid": "c007e78b-f9c2-4acf-a8c3-eebb80f4652a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518673, "uuid": "e5c78290-2c1f-45d4-9903-e5bc0eb1cf61", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7832d6f3-b237-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1761461175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761461175, "uuid": "36793f1b-d8b1-43d5-9898-ffece14d0e9f", "comment": "Malware payload (XWorm)", "value": "a533992101052c6d93c0d729640336c5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761461175, "uuid": "aca748fd-7ac7-48b0-9027-80c9cb9fd3ac", "comment": "Malware payload (XWorm)", "value": "b397fdc99957dbe1c9631fc4ad16ea0b1738f28423ded2915828689e85303e74", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761461175, "uuid": "2303a6e8-7f12-4111-a1d5-451c83666f1c", "comment": "Malware payload (XWorm)", "value": "afc2e18c45796ec2ada537470afe7fbadd398e46", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761461175, "uuid": "e2512c49-9505-4105-9672-94f87170f729", "comment": "Malware payload (XWorm)", "value": "a5a0928b8fe713174fdc8ad54dfff80c1123606ed62d706708b64580fd636eebe5732f3cc1d5fe2b46547ebfe9510782", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761461175, "uuid": "fa206f38-58d9-4d51-8096-e147e82c329c", "value": "T181A125201CEB00C8F2379B315BECF5F748A6E855A92EB6F4214186844B35AD4D8B3E79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761461175, "uuid": "8debe0c2-f90e-4315-9873-4818e7fa6baa", "value": "96:8q5ZxJG9Yc1EbdLAt3UgEA/B514q8YcwEL7ZmMAk:8q5ZxJKLWbdLLgEk7SYcnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761461175, "uuid": "2c0ee9d4-b932-4fc1-957c-a2734382f1ec", "value": 4746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761461175, "uuid": "1d7492b0-8d8c-4494-b103-85969ba0fb9a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761461175, "uuid": "01c4463d-fe6f-4cbd-9ca7-9af42cea21ed", "value": "11.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ad2ffe-b24e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761470857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470857, "uuid": "e640b7b0-6933-4d93-96e2-09f8efd93a98", "comment": "Malware payload (Mirai)", "value": "a8bf07f63dac48c8afce0e3bb0ba5d29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470857, "uuid": "11cead3f-9515-48d7-8535-ad0d4a0e31ec", "comment": "Malware payload (Mirai)", "value": "b4334592b513a6f9a236b81d76c2c8791306af5547be5f8bc329098849860630", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470857, "uuid": "a77a7a51-09b4-4d83-ae80-919af94054a5", "comment": "Malware payload (Mirai)", "value": "bcab0cb42c1ff41302bc29041ca932372b1db83e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761470857, "uuid": "5d907b37-5b12-4996-a54a-f5a66455c556", "comment": "Malware payload (Mirai)", "value": "bca1f5787804dd05c2d91e4dd545aaa3bf55508d92270e74bcadd6c9b05e6b2f68d4b27b48d917a2cca064d21d0c21cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470857, "uuid": "228fef3f-9ef6-4884-8dad-7d455953fd91", "value": "T15CF35B07F5C184FDC896C1B44BAFF636ED72F09E1134B26B27D49A622E5DE201B2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470857, "uuid": "aac17699-68d5-488f-8c4e-b5071ad7b88c", "value": "3072:JBx7hJMJdMjD1gzTYJanIZlbupbiik2AKzopC6FyqJhYx1Ha:JH7heXIWFp8BIba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761470857, "uuid": "540f9a5b-b879-4a2e-b26c-9f85ac696302", "value": 159256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761470857, "uuid": "8737eb3d-4d03-4f23-a15b-b8e7b18d1e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761470857, "uuid": "9dc3834e-38e5-4d8b-b5be-c5198ed4a2c5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6df50fe-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497358, "uuid": "e17e5576-fa72-457c-a549-3462fbdbbf14", "comment": "Malware payload", "value": "8eb8d06b906656d6b6933fa7317251ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497358, "uuid": "416316a9-081c-4069-914a-53e4d3e2f664", "comment": "Malware payload", "value": "b47b698db6c3f3834005bf71f13b0598301c6cf348c2c260d967073d7d8b1539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497358, "uuid": "f41cc4d3-963b-483a-8937-10178ba1d6e4", "comment": "Malware payload", "value": "c95db3c232e74be7b4d306923d81b96d37f8ca54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497358, "uuid": "1d60a052-63ff-4840-91cc-f8a1846e021c", "comment": "Malware payload", "value": "97cd8889d6c18da0e0396e6a40de775ac3f93794dd1e248617add997f48d97b01688acfa6014433c81a22c77a9c973d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497358, "uuid": "0615ea82-8c37-4eb2-90a3-5b1dbfdfbc68", "value": "T1F70633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497358, "uuid": "74453c79-f191-48a7-8e4f-76e97782bd48", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497358, "uuid": "ece848e8-41f1-40d2-ab92-1ace55eea6a2", "value": "98304:agT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:z2w3E16MiBrUfmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497358, "uuid": "c47bda77-beac-4474-9de6-cecb5b401520", "value": 3781846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497358, "uuid": "65d57aa8-50cd-4bcc-ab22-609949fb3e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497358, "uuid": "421b5f6b-5eff-4274-a788-8e23662aaee4", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78f0849-b297-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761502621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502621, "uuid": "c141f30d-1528-407b-9214-6e176829f21b", "comment": "Malware payload (Rhadamanthys)", "value": "8e0fe8dabaae7e9ff9e6b0fe980f4b9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502621, "uuid": "99ac90ef-d7a1-458c-a1e6-096ab9a3e543", "comment": "Malware payload (Rhadamanthys)", "value": "b4a64ea2ed40a02c49143e54d121a15b546371d7f82b4e58f37442a3dd5b0b49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502621, "uuid": "bf89797e-8019-42a2-b4d8-c8e796b0631c", "comment": "Malware payload (Rhadamanthys)", "value": "04f90e3733e13cc7469415f305f34ab6dcc614a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502621, "uuid": "ecf860e3-f065-4097-8bdf-52d597519255", "comment": "Malware payload (Rhadamanthys)", "value": "670bd9922c3219a1474943baec8b7ee611e5f7d1d3da7756468cff2e6e7b7a815fca66ed4d878c079d97712a37267fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502621, "uuid": "9c7398b4-8705-4ccc-84e8-58eaf4982f64", "value": "T1587523595AF9887BE6B4673499F92083EB74B8211B795BEF21D864BC0F227D07430F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502621, "uuid": "85af65d8-49ea-440f-b895-3e3d7223458b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502621, "uuid": "70092723-6e3b-4029-a5aa-a6aa0e62d62e", "value": "49152:SjvKrRXuO/gihxi/SzspIiuFvlTOLaIVeMxKtDzXJ:HrK8xVzsyvlTOJVxUDz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761502621, "uuid": "d7043633-e50d-4762-b326-ac52a9bb5886", "value": 1634304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761502621, "uuid": "2444fb5e-8daa-46b9-a573-82321d460791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502621, "uuid": "407bc3f0-b23b-4261-9816-aa05ca093920", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a3da40-b2c2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761520784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520784, "uuid": "84d7ed1f-03d0-4cfc-b5d9-e539b8932df7", "comment": "Malware payload (Mirai)", "value": "9ff39656889e4e6a649df860c6c5a346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520784, "uuid": "f8080b60-e49b-4e61-ba90-2b4ffae4197f", "comment": "Malware payload (Mirai)", "value": "b7261d331e103420918666a13e5b2ab2f2851eaf8ec7303b50331554d2b4e23e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520784, "uuid": "b184a9d1-e3ed-4f13-96b0-e7fb8a26fa9e", "comment": "Malware payload (Mirai)", "value": "ac26a78361069d491972027a60fab4992f2e7c2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520784, "uuid": "9ddc55d9-7e71-4111-a618-6bef83158614", "comment": "Malware payload (Mirai)", "value": "f0881316b8ccdae6285545125ece67c87dd6e16ef78f6e9039a26f22930d99b0045a7dbadd7918a127c2afd5aaa900f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520784, "uuid": "1ba05d07-9dc8-4407-8f1a-cb16c2dcb60c", "value": "T1D203F19350E88F80E4F422FC76EF7473105C723A83CEC9517BC9E4E72946F405599965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520784, "uuid": "d883de7d-a90e-41f1-a96a-a273a3cec2dd", "value": "768:Hd6BI21Hi0DvtrACGytO8utDaMvTL83xpwd5IfmYP3sUmnbcuyD7UHQRjM:4K24ckB8ut2jey8Umnouy8HyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761520784, "uuid": "899bfa52-c5cf-4950-838d-a40f740aff69", "value": 37804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761520784, "uuid": "315bdffe-29e3-4778-aeab-a89bfdaa6003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520784, "uuid": "dcda55d6-b17d-4651-b6fb-84b9ad0edc2a", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e278f0-b2ae-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761512407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512407, "uuid": "31cd8d1e-63b2-443e-bffb-e351554218b1", "comment": "Malware payload (AsyncRAT)", "value": "f1c54236161834ebc8ae7dc4521d26c5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512407, "uuid": "1e44f776-97bc-430c-8eb3-b847a62cb8c6", "comment": "Malware payload (AsyncRAT)", "value": "b8962a1b58495c62186162aac32e55ddbbde1dbab222e718b847eb36783b80e8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512407, "uuid": "3c59ff1d-9395-4b02-b618-1d6d26b1e2ce", "comment": "Malware payload (AsyncRAT)", "value": "6a3796c164b6df929cef52d7ade26d59d85b5b33", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512407, "uuid": "9733584f-58ae-46b2-8cc6-bf46b396dab2", "comment": "Malware payload (AsyncRAT)", "value": "4a945a241e9f41819a1552170ca42ecb08a39ecf7c416d7dd12e2a3164e1affe3e007e9d2dab67f5dbad65a82a14ba95", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512407, "uuid": "b9688c51-c08a-4bb3-aaad-eb6c71c436f6", "value": "T164231B003BE9822BF2BE4F78A9F26145457AF2632603D64D2CC451D75B13FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512407, "uuid": "e25e5716-1df2-4158-9a55-72e4862dca8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512407, "uuid": "d4924d59-7823-4c4b-8312-dc28ccf84a68", "value": "768:GuYHKTsufqG9vSLjWUvlPRmo2qbUKjPGaG6PIyzjbFgX3i7RH4Y3S0DaWKFBmSDf:GuYHKTsjMvSX2BKTkDy3bCXS7RH4Y3wN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761512407, "uuid": "49fca223-f815-41ad-8cf5-7497a7e69628", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761512407, "uuid": "bec0592d-856c-44c8-8d2d-a3b3f7c6c9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512407, "uuid": "534b226b-ed49-45b7-a151-ac00daec6db7", "value": "b8962a1b58495c62186162aac32e55ddbbde1dbab222e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af51ee0a-b28f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499063, "uuid": "d5b5ac45-2b54-420f-bc58-f75612f6024d", "comment": "Malware payload (Mirai)", "value": "f00d0ba2fab15056ef19a83b6ea4a070", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499063, "uuid": "6f5fa5a5-12f1-4782-9e61-0188e3ad6ed6", "comment": "Malware payload (Mirai)", "value": "bafc863a717c0f13ec4e27587fae282776315333f532e1c65d900b3cd25cd82c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499063, "uuid": "f23a9a71-3b62-4ba8-bc57-6978a4bf2080", "comment": "Malware payload (Mirai)", "value": "3ed4e522025be79d6556e30fd549d6f605d3c978", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499063, "uuid": "60539e51-616e-4a56-9df6-021daebbde60", "comment": "Malware payload (Mirai)", "value": "1649e517c9f582dd3cd485cd58cfcb9bba8cfa1b21afd3014eee056e7fa7276c31d72a63cba104fa1313686b767332dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499063, "uuid": "0399c24e-756e-4ab5-8fd5-95f73da92bb7", "value": "T1F024B70E6E328F3DF66887344BB75E60975D23D623E1D685D1ECD2151F2028E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499063, "uuid": "be693252-8884-42ac-96ad-9353a4889de6", "value": "6144:A/lKyaHtFakZSdE/nSv88ftxksSeXEOVl:cEylkZL81xpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499063, "uuid": "bc3ccd3b-b05e-4e19-bf15-4ef04114c2cf", "value": 223988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499063, "uuid": "d0c2d828-7dfb-440b-bc06-ff0dd757f259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499063, "uuid": "2845ee5f-cbcc-40d8-abde-83cd74379ef8", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994cdac4-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761517065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517065, "uuid": "bed86e05-add0-49af-b561-ac4dbf0ec928", "comment": "Malware payload", "value": "9b36e1f1663c424fa9fca3484deeb050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517065, "uuid": "4b22f162-383e-4f70-a037-a0a72dc78b7d", "comment": "Malware payload", "value": "bb2419dbca5d15cdadd4c34be1828901a094b9b84d157c670b3350dcf691307e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517065, "uuid": "1c4a6642-e771-4974-a991-c0e8e3ff14c3", "comment": "Malware payload", "value": "f89522a1ba3fee7339bacee2c5d20727eaf41c90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517065, "uuid": "23ece719-fa52-4e5e-9cff-7d8da43b0cb6", "comment": "Malware payload", "value": "5caceae018a2e0c98e669d3e3b403ea0949c55387d127514356ea4a8b4949c562ea5631586c088f4006c938ae572b1b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517065, "uuid": "c3589cd7-c34e-44bb-9061-f4f20276aa04", "value": "T13C470011397D1454F38399A32D321A31782A4B9B71E5EF87D84318DE5C3F64B988E3EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517065, "uuid": "19831acd-c256-47d7-ac72-ca76afbb18a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517065, "uuid": "a6195616-8512-4c14-9376-65dec00adf28", "value": "393216:9ZHwAlw5pZhFbCSmqsigOdu/aHM+KmlCAL8pwcmogudHjy5gGMxT6CVYs:X1wHZhnYiFduCHMTmgAL8CpWQMpKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517065, "uuid": "d18449ae-decb-48b2-a8f8-aa5f85991b6e", "value": 24801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517065, "uuid": "085d21a6-7f14-478a-816b-993569cbb4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517065, "uuid": "4ff54268-a0ed-49e4-a5f9-4fc2ab9ab3eb", "value": "ypogzp_KMSTools_Lite_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a882fe06-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499911, "uuid": "e8130361-5565-480e-85d4-5fa2ddf7644e", "comment": "Malware payload (Mirai)", "value": "2cd5e1069bb979e716ee02a78085ad83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499911, "uuid": "670bf0b9-938d-46cc-ac65-ea17c64b26aa", "comment": "Malware payload (Mirai)", "value": "be6105ef2b86169055f3c1db4b2162626b649671b65281f3754ee9f115478a5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499911, "uuid": "7a0b435e-0515-45d4-bba1-26e0a4cdfae9", "comment": "Malware payload (Mirai)", "value": "e3dd6ffdf2909d50f8b320745a80d1e99d223a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499911, "uuid": "e102a016-6be1-4019-bac8-ce180ee2e68a", "comment": "Malware payload (Mirai)", "value": "dd397a3b231356a347a1994bbf14047d0574275faa6490abbbf59274f19a18cab679473319018d3e3c366273375bfd93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499911, "uuid": "658065ab-7b47-4953-baf8-4dee2cce0cad", "value": "T13B831A85BD829A13C6C1127BFF5E42C8372A6398E3EE3213D9255F2537CB56B0D2B611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499911, "uuid": "8df8f6f7-03fa-4ade-8b0d-9e7b506fd849", "value": "1536:6YWvtNFhJ0bKPkT2nCu4s34SBZyOb99Kx2l8b5MJTIVN:6YW1NFjgLT2CupDBlgol8FL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499911, "uuid": "642d01f2-e278-4a4c-af91-6f1b0cc21de0", "value": 80796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499911, "uuid": "cbb08074-81f4-4845-9029-bacced5849e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499911, "uuid": "52fde4c9-dcbc-4ed4-8843-884385c558b7", "value": "kvariant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0200d3a6-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761497484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497484, "uuid": "cb42c615-562b-4f74-b64d-0474c3803425", "comment": "Malware payload (Mirai)", "value": "beab72e8e9206e31bffdd393923cbc90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497484, "uuid": "30d36960-3f5f-4dc8-afa9-7e60c032abd2", "comment": "Malware payload (Mirai)", "value": "be952d709848255e1c14c70377bffec1f9bbc9d5546f333ffac521fb121cfd98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497484, "uuid": "1afc913a-3f0e-40de-b936-5b80c0d96f9e", "comment": "Malware payload (Mirai)", "value": "dd180dc33b6d18caae4353f6cde24d561aef425a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497484, "uuid": "acd2c4c5-e964-4f15-bdc4-0d71237a8b70", "comment": "Malware payload (Mirai)", "value": "4bed6a96f52835d3f71e44e3144ace2ccd1098474291a4543fb31aba56c7bb7200d52317c6e363d829241fbcfa276b9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497484, "uuid": "352cecfe-f3ba-40d2-aa4c-61b1da349f11", "value": "T1FC630252636B6F53CE931CF3ECCC8E9487018A5AF4A571561382CA2A54E718F5FFA213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497484, "uuid": "9344fe5d-f039-44a4-8a46-a24e8bc0ff31", "value": "1536:k/EmUNENVVXkj01rkMh4B9qzBzQY+1lFddaHVmmImLmnLi:k//UNYVQkWYkFdOIxnLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497484, "uuid": "0e4f5fcc-6312-4190-a17c-5a67469d2be5", "value": 69844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497484, "uuid": "0c5f393e-c81b-4232-b3f1-7eb0317ef96e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497484, "uuid": "c41bb49a-1248-46c7-b5e8-c10e18539fb9", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccf96fd-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497502, "uuid": "350b1f6f-b5be-4e76-8452-6e0376c00be8", "comment": "Malware payload", "value": "ff827deb78dd20372819c6024fee88a0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497502, "uuid": "028f16bd-2283-489d-ae21-678322762871", "comment": "Malware payload", "value": "be9b12fedeeaa1282aacee813d6da92f4b21e0823e870ab4f834f6705329e7d4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497502, "uuid": "6051b990-68e4-415e-b1c7-89f7d1523525", "comment": "Malware payload", "value": "962851a5ac707116cba8e6cfaf364a08e2872126", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497502, "uuid": "ca2281b3-6121-41fb-91ae-c69bb4c431d5", "comment": "Malware payload", "value": "dc0368596abd1863fa1d358f224ae583315d90a33d526264ba5a3d2fc17cd37c5f79aeb3c8a6989bb500fdcbeaa10513", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497502, "uuid": "75d9efbf-a850-4be2-acc9-d7b2249c24fc", "value": "T1E0E37A207BFA0204F5B64B3C9A7AB220886B39A5CF3AC34C0192C71DC532940C099F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497502, "uuid": "7e130bcd-3d70-4366-8424-12b15c57c6a8", "value": "12:8d/iRWGWTs0oWjVUP74SWo6Gs8Xl6niHXSOI+42/0ryxWkjBdP9lUPpqRifn4BqG:8d/i6jFfGuiHaZ2KyxWaRlUsCESGOUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497502, "uuid": "536aa74b-37ac-4218-bf7d-0a31151b7edb", "value": 156034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497502, "uuid": "ca7d2acf-876f-41a8-970c-595e233bce97", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497502, "uuid": "dd9173aa-3a22-41d3-932a-259312afc0e4", "value": "Zapit_iz_verhovnoi_radi.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e96b27-b248-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761468386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468386, "uuid": "a5540ab5-d91f-4772-abbf-b1c365d17b59", "comment": "Malware payload (Mirai)", "value": "d44ff03afbef0b9e59bbaec74cf34764", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468386, "uuid": "03c0ce1f-dc53-45c6-a7cc-48007c9641ac", "comment": "Malware payload (Mirai)", "value": "bee2f1a195824c4eedcaabc5794ba40ae5cbcd04280ca41030ea191d873ea087", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468386, "uuid": "26b2cc7b-de0c-4eb8-9a63-3f2eec446af1", "comment": "Malware payload (Mirai)", "value": "2a2d81fe7597a6da124d46c7820d3fe98d94dd09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761468386, "uuid": "d281ec93-7ea2-4f0d-8f44-725a4dcbc09f", "comment": "Malware payload (Mirai)", "value": "7915ec3a7fb787c6d7d5fbacfd62ec3c5ab687f80d24907fbf3472bc8ada8111d3c426a43c701d388d2f9fb0ea579515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468386, "uuid": "f8219372-4a01-4b16-89f7-8a9ca1026493", "value": "T192B36CC2F743C0F6D85305B1507BAF369E33D4BA5025DB42E7689A31DCA2A05D71ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468386, "uuid": "7f8c98f7-3944-4efa-aeff-b332de8b378f", "value": "3072:EPian1DTyim4EgPg1dRP2V2Zsv1hIB18eJ:Eqan9BSukZsvoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761468386, "uuid": "6f7c12fb-902c-4a25-99f3-708869fb6042", "value": 116168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761468386, "uuid": "d0f2d4a2-ce4c-4d27-bb71-e43ad3e8ab75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761468386, "uuid": "f8a69a22-91e7-43ef-8ef5-3a50c60478ca", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e106e3-b28a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761496951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496951, "uuid": "9eed438d-c371-44fe-a958-3549d52cb297", "comment": "Malware payload (Mirai)", "value": "50c1f1edec67d0038aec2792f5a1bb2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496951, "uuid": "add69053-e542-4764-bce5-a0064431b720", "comment": "Malware payload (Mirai)", "value": "bf26304b272c03299d247413f643597b7e1fa90bad722ed6f25ae43880d6bbaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496951, "uuid": "e38a12f3-8559-4671-aac4-f98192222b1d", "comment": "Malware payload (Mirai)", "value": "2b9fdff3c675468088cc2eb3c4214a35793496f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496951, "uuid": "938d1b7e-c685-431e-8567-c1eeb0d394d8", "comment": "Malware payload (Mirai)", "value": "fb7954c0c3c312a2acb91b21817f98025414fb7d43b9a70f646fffe380d25da67f114303658fe710e6f16337345cff03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496951, "uuid": "219e7012-103c-43ad-aa4f-8324517b2837", "value": "T10CA3E195B110BF4AC0A776BC71850E40D3E27EBA179A261A4463B5747EBCCD83F07AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496951, "uuid": "824c4686-93bc-4ca1-a2b3-42f404e7b616", "value": "3072:b+SZXZFszHA+R75lfo65MwHzErWqwuwY:b+esc+R5zpTE6qwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496951, "uuid": "ff56457d-40d2-496e-93c2-7ef522f111b1", "value": 99696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496951, "uuid": "ed964097-0667-48a3-ac97-ebfb33e28301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496951, "uuid": "7be853a3-ccdd-41c2-9097-c7ed967b2cae", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb901078-b287-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761495675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495675, "uuid": "e6014ad9-d9df-4166-b3be-eacfb6f3b7f4", "comment": "Malware payload (Mirai)", "value": "477ec709deafe7d4cfad30a1750bc767", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495675, "uuid": "734712d9-d1f4-4afb-9281-71ebeb5d8e31", "comment": "Malware payload (Mirai)", "value": "c099391242485ad98161f1c531f86b01265f3efb4be3c66ab8eabed5f8785e15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495675, "uuid": "3d36a315-0d96-4887-9727-9083c6e14eec", "comment": "Malware payload (Mirai)", "value": "009a2c62c57ce4845198d0059e6b0df053012e85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495675, "uuid": "107807ea-da2a-407c-9c24-87c44b106383", "comment": "Malware payload (Mirai)", "value": "3fea88753c154a45c9914555fcef701d80ee5fb4957b195c19b282ae4902d7fd29f42455c4be300e94a4fbdfa7982c92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495675, "uuid": "77546e8a-b3b0-43f7-b3d6-0fa4e7220477", "value": "T13C530248DE1A2A00A274CC35A6A7CFDA77336D9DD87B366378441378E6D6ED900F046B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495675, "uuid": "0dbdaf10-385a-429e-be83-ae96324af7d3", "value": "1536:Ph0Ba1D5xler5evYYCtfvMeGyF0vEblzwXfn3b7g5hLJza:2CNxgEvsfvMY0vkar7+Ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495675, "uuid": "15cf7756-48c2-404a-aa5e-e7b2ea0b24fb", "value": 64424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495675, "uuid": "2d3afa70-5206-465a-88f7-1b59c8da27f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495675, "uuid": "a6604223-3dda-4fa7-b7e4-d4f386a4c1f0", "value": "Orbt.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541a3b04-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1761497622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497622, "uuid": "60b925f5-446f-4fb3-962c-77755e9bc828", "comment": "Malware payload (PhantomStealer)", "value": "6773537b0042a9ca564816cce023dc55", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497622, "uuid": "7c23a267-3375-4f9f-b64c-d85c16d7e9dc", "comment": "Malware payload (PhantomStealer)", "value": "c0e7dcf3dc7f8585cca9ebc201b47eed57a71b296a6ef9b6631920fa8db2216e", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497622, "uuid": "577dd995-e2da-4bdf-991b-b22f2f88c4e7", "comment": "Malware payload (PhantomStealer)", "value": "ea814489d3749954ee4e86db1a4abe4f54823c25", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497622, "uuid": "c8dff2f1-6586-4dd0-8f2b-46d66877591e", "comment": "Malware payload (PhantomStealer)", "value": "5ee81a172470d12d6615c0d2fb5ba6389149b6357e29ae31101d6c6313c8351fdeb8a5e5876c7f6fa1933e04786551ac", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497622, "uuid": "a60b8ef4-d27d-4ab0-a6f5-240f94ebfc4e", "value": "T135359D049E39AF65974072E14D89881B3A18E88F7173ACDF7F94C6AF559EC04E7D202B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497622, "uuid": "82ed5830-af47-4166-8a93-75fdaf4f4c37", "value": "24576:yEW3UV9gLJ+fFj46RKmFu19qouETNacc9pYtmBvzBsK9u1+xpWk9MWtaofinWYkR:hk1EVY1K9u1AuUDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497622, "uuid": "1dcf49bf-e85e-4f1f-b9eb-5cd1edeeb72f", "value": 1147233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497622, "uuid": "460c648c-3e5d-41d8-8e7b-aa29926b6432", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497622, "uuid": "8ce78d2e-5896-40e6-8fc6-0a354d15d170", "value": "Purchase_list_and_specification.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4716d97c-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518645, "uuid": "f961d894-e72b-474f-989c-e7e98bc9d91c", "comment": "Malware payload (Mirai)", "value": "3cbae471b1289c799d2b170b69f8c4ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518645, "uuid": "74929ab0-d6a8-4904-b2ee-97b160af12e1", "comment": "Malware payload (Mirai)", "value": "c10112561683550e5df5ef9f910b2a63f0e674559dbed260be732c3b828b863e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518645, "uuid": "2a83eec2-4be2-45ac-8287-78d2c4691642", "comment": "Malware payload (Mirai)", "value": "b5788f4b86cdb3230df610972a323eef329a91e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518645, "uuid": "d3b65f4a-ff03-4bcb-a6cb-4b0e30a5d1f5", "comment": "Malware payload (Mirai)", "value": "6660054d153dd76002a9b04835a91c651ea071f8aa5f4c34649f395447766f46d275d402d50fdfe299152d46764e8050", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518645, "uuid": "e811d6cc-fe5d-4505-bcef-d91fa2a5f649", "value": "T1BF13F1CB335A8BFEC4479572A42F71C47ED22926649203F706E7B7F35E74488AA16602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518645, "uuid": "2a4052a3-7498-45c7-a486-ecf39a90ee75", "value": "768:u9xnrXXy3Ccs3ECjr07Lv6og+RMFgV69xahcVMGxHOXwV9jQ5egtu/IJk0x05q:gJjw7q+RMCV69xah8OXLsgtAkAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518645, "uuid": "c8bad6ec-66e4-40d0-a3f6-8970b36b989d", "value": 45412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518645, "uuid": "53dc94b8-ccac-428d-880f-e274ef986e18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518645, "uuid": "2be8a2d5-74c0-4ccd-b9d1-123098157a91", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ae3109-b24b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469714, "uuid": "41f51893-fc01-4a30-b301-238dfb9017c2", "comment": "Malware payload (Mirai)", "value": "e09bd4e76c3b851da3a69487fcb4c47d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469714, "uuid": "b025a7c7-4033-4e1c-a4f1-01872c0ec4b3", "comment": "Malware payload (Mirai)", "value": "c1bc0d716c279a5de09732b59cc40f801f80266bec89311ce4d7101e973e966f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469714, "uuid": "73d3fbe9-cc76-44fd-9115-0622e92b5cd7", "comment": "Malware payload (Mirai)", "value": "af19c37c5745f3d2d2579fb3bd6841bf2b6e440b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469714, "uuid": "15ad0eec-8866-42e1-a750-cced2ec90014", "comment": "Malware payload (Mirai)", "value": "66e3c5c533c107af3e8c22d523aee4e202546d49c90423ef5efb8f39b8ad08105db28e7f20a38e967818009b805bb392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469714, "uuid": "24b22b4e-14d5-4d4b-8554-95e6add0e9ca", "value": "T1F6C30796B881AF21C6D156BBFE5F418E33135BB8E2DE32039D141F6477CB94A0E3A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469714, "uuid": "77ba05c6-5659-4d14-88e7-40a0c0a857eb", "value": "3072:Ot4ovhBZ41YX25tns3eIQw1uN8olOEFXI+AYibmW15vnT2:Ot4ovPZd25tns3eInuN8MFXRAY+1p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469714, "uuid": "2b5bf403-8b6d-4f3d-a251-bfcb7fafc8a2", "value": 128048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469714, "uuid": "9f19ecf6-20dc-4439-9c4b-aa91b347ff34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469714, "uuid": "5b1b45b3-6692-497e-95d4-cf1c939e41cc", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baf10c7-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497125, "uuid": "e5bd3aaf-bfdf-411d-a59a-415893ae4b5d", "comment": "Malware payload", "value": "5eb6f01cff9dc8608e7ff92bfc8488b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497125, "uuid": "1af4b004-c2bb-443e-b634-b0d9ae53ba38", "comment": "Malware payload", "value": "c436325311b9ae81bff8fae127e46e80b4087a4421dd9545d87ec493e73cc981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497125, "uuid": "b65e215b-9ae4-41f0-b0de-c99adb65f1d9", "comment": "Malware payload", "value": "b1e328c09aa73133241f1afb1fdb7af33a525526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497125, "uuid": "def6f8bd-4342-470b-8a60-88e9cf269d1a", "comment": "Malware payload", "value": "93964cad0bd2ad62bd5be135fce4a8de007e952403d8e654ea6684d3debef3f679da619280c9cdef5fbf2ffef690d9ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497125, "uuid": "c8f9a7fd-5cd6-4775-8b94-a0383873b6fa", "value": "T15BF523A4ADD91FF4D02FC7306541055CB3263B72DA7866AE5F84E0258EE22B81E7B5CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497125, "uuid": "1c8704d2-886e-4ab6-9df0-de4923c9c975", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497125, "uuid": "02ce0c44-6d77-430c-9e3d-3ce170bf6013", "value": "98304:tQuAYyCXx8iMXqYabLatb0OXJW6RFS8fQPNxq:rAYyCXx8iMXJiQ4OXJVVOxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497125, "uuid": "ace14a8e-ba69-4b46-bb16-5e431f0aa960", "value": 3612080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497125, "uuid": "6f022819-ca1b-4217-a048-ab8984c9b146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497125, "uuid": "3664711f-50c8-4d70-a7e9-ba8e858e5f71", "value": "5eb6f01cff9dc8608e7ff92bfc8488b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b252ed88-b2c1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761520543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520543, "uuid": "77be0cdc-b0bb-4b25-9341-032b803edf34", "comment": "Malware payload", "value": "67c4e0802a35ea60bed04c9950464eb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520543, "uuid": "9ae70d39-763f-44a8-a7bf-714774fe5e41", "comment": "Malware payload", "value": "c863438406b132131c358acfbd6f8590eff104efed5208b0d078e06f634b7a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520543, "uuid": "7f254545-b955-4f09-9c1c-2c562989ec11", "comment": "Malware payload", "value": "8040f826f0866db2fd4fb95f34db67181ba88178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761520543, "uuid": "0526fd9e-42ce-42cf-b5c2-c17016559024", "comment": "Malware payload", "value": "a58cee41aa96f2f7ee71a3e33b4f7eebbb05e61c6106972cf44b81eb0004f75bc13e8e305761611443c4e22f4efd26b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520543, "uuid": "0d289757-99e0-4c3e-b1dd-3427bbc4fcd0", "value": "T1B524738ABFA13FFFD81ECD3302958A09129C490A52D87F762A74D518B68B14E5DD3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520543, "uuid": "75810fc8-f843-499c-97b6-4234b9a90675", "value": "6144:i2G9FuLd6EROyxNttkvp+X/8wHniHYobsYk4UHUTJwBl/XKF:625eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761520543, "uuid": "6420a617-39d6-45f4-946c-519327553da5", "value": 228632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761520543, "uuid": "71f6fafb-dde3-41d0-8be2-8e0d4f4e2063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761520543, "uuid": "61d41fe2-3bc8-4d02-899d-212b56c554ce", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c445493b-b2bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761519714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519714, "uuid": "24fa4f7e-3237-4fd5-a348-794a72a7fe81", "comment": "Malware payload (Mirai)", "value": "d200e6e5f531e5db8d18af40b97a5fc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519714, "uuid": "caaed2ce-8f29-4682-aa44-998462d260a6", "comment": "Malware payload (Mirai)", "value": "c8f15043ded2f18bef1ec19d1fbee187ec0321f7aae18bdf7dc04fb09de9a754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519714, "uuid": "8bfd50b3-e477-4e11-8338-367ee2b86112", "comment": "Malware payload (Mirai)", "value": "54ff0ef3c7710fa5f116496c1b59ded36b5dae13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519714, "uuid": "a90a959d-f0c9-4eb3-ab85-66080a9023d1", "comment": "Malware payload (Mirai)", "value": "186f37be983c5d93ec54318700a726142269c2701e9d7bdd99c3c13d4ab0f4141ecde309d6593e15a84e1a3390e93164", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519714, "uuid": "0572dc02-25fd-460d-83ff-c1fe3c1c97fe", "value": "T1DEB30809AFA10EFBEC6FDD3706E90B0529CC655B22B83B767574D428F54A24B0AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519714, "uuid": "ba7f3fbe-d0f1-490c-85f1-284293106524", "value": "1536:m5sONan+gF8JMCp3UKN17Wwi/hv+my7bRYOYIFe/KwV4/pZrkJZTOU5SAJ/lE18X:ksYLzUKN17WVJvMOK//p2m0Jg8cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761519714, "uuid": "8db2db7c-2049-4591-9b2c-21fc645b9b4c", "value": 115500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761519714, "uuid": "b94f524e-7a66-4250-8191-f3388001a1ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519714, "uuid": "4be56a44-7537-49fc-baad-baf11ed33b63", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c5f944-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761517009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517009, "uuid": "0852c1a9-721a-4198-9a14-b80af5b934ec", "comment": "Malware payload", "value": "ded931b438845d9e14dc063b06b27aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517009, "uuid": "3a8e33d5-e2a9-455f-b466-951a384a1b6e", "comment": "Malware payload", "value": "ca42ce16c46c4a052d32b046f65c6785f339423d92a2b7f9c227f11a62982e63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517009, "uuid": "ac29f9d2-4941-4fa7-ba0b-12a160b0aec5", "comment": "Malware payload", "value": "0bf631bc6820a55ad05a2b72a6393db786588f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517009, "uuid": "aeee6006-c7f1-4561-94a2-3f8c71ed26dc", "comment": "Malware payload", "value": "bd5f382925f31cc35df1e1ac6e7ba58357ac65695c8efb338962d95b08ecd6bde6fc02f6dad3bc1bbfe777c7ba134259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517009, "uuid": "20b4d4e2-a735-457e-b4a0-9030d1ef4753", "value": "T1725633E83BCE90D6C1C12A3E15A44BBA1B54E5907DE5B386C28B8B7F1F5CA1D6D530C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517009, "uuid": "ff623046-c1db-4b2c-a3af-2a2f49310d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517009, "uuid": "25d69e87-19cc-423c-97fb-b4d26bc23ca8", "value": "98304:Uacq1ijm7K8l6F0rE65yQZi3DqWJGEwufHL4x2NJ60h8Xv1L87kZ1KfeGusqg:lN1ijxSIqyQyDqqBHWXv1LPZ1KMs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517009, "uuid": "8e0872da-ddd8-4d3e-8a5d-bfa265688f83", "value": 6221824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517009, "uuid": "d8b04d66-76d2-4d65-909e-503ad4e8efc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517009, "uuid": "013ceaf3-c80a-46a6-9e9d-5a52e2123e80", "value": "ActivationProgram_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42befb20-b245-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761467099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467099, "uuid": "df382c02-49c4-4715-b67b-42bba65b495b", "comment": "Malware payload (Mirai)", "value": "d4985b78a129e54f8eef891a0ee1d08f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467099, "uuid": "d2e696d8-018d-4477-b970-a55fe8c6b9be", "comment": "Malware payload (Mirai)", "value": "cd849cc67e476550c84a8f24a8a80647e92f30280ed3c345b0ccdc59fb05ef50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467099, "uuid": "942e1f1e-664c-4102-8ce9-beb9b95428b7", "comment": "Malware payload (Mirai)", "value": "4e8757748d8114f46211161661962a7f51c4dcdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761467099, "uuid": "1c1f6175-45fe-4a32-bf27-bca4ca712bf8", "comment": "Malware payload (Mirai)", "value": "bfac472e644848e96f4b19d5427cd7f7329699b14bef9b419740b26344203653b2a7a81769dfbec3449fde4b78f354e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467099, "uuid": "e3d1baa7-e92c-4e40-ac4c-2ccad82dc57e", "value": "T184B32985BC819A22C6C24ABBFF4F428D3316539CD3EE3213CD285F6536DB55A0E3A056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467099, "uuid": "1ef2b501-f115-4eb4-9878-bfc0dff63b8c", "value": "3072:XB6h7hTY3z6NdXDcFu7WCfvGFN38O5bpdxv5mHWM1Fa2+UTBGBIrYnTW:XB6V1Cz6NdXDcFu7W4vE18O5bxvoxiMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761467099, "uuid": "cbb5a432-2f9e-45a8-a9bc-bc94c0771efa", "value": 115892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761467099, "uuid": "fef93fcf-9dfe-41ee-8f27-9f2365706420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761467099, "uuid": "7edc4a60-9fdd-4c6e-8a5e-b4d5395fcb24", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8477b921-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469356, "uuid": "4a918b14-e09c-4c80-8178-157f27a3b337", "comment": "Malware payload (Mirai)", "value": "f9daca9d3513e6af1cf18b6f54503080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469356, "uuid": "8e79cacc-becc-4552-a598-c85ffe3eeb86", "comment": "Malware payload (Mirai)", "value": "ceaa1815c4cfcdebd03e4aeda4a7fd7b8b17c009ef4ee5da62c6fd1b70264494", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469356, "uuid": "2c6a034d-a7ac-4c58-865e-214f48614f0d", "comment": "Malware payload (Mirai)", "value": "33acd191eb01acc4132c2cef14cf514d8b2ac089", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469356, "uuid": "45b0b821-9101-4499-ad3a-622c38c4716a", "comment": "Malware payload (Mirai)", "value": "d25c7663344fc3add60c3a81be5cd1b206159f0ddb954df706d74305dc8db45c8c124abf09a6b193a7e8ab5d353a1f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469356, "uuid": "82892fe7-0122-4c9e-b4ab-69a477c15294", "value": "T1F4B36D13D1215E93C0435BB926FBDA352B13B8A14B522E71916DEFF84A43DCDBC48BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469356, "uuid": "803ba105-07a5-4209-bc0b-07738c514761", "value": "1536:pd6+XRXY09VLjlr8437jWo7ErQvm+oJCgyvAZfjakUwbZnRUocI+Cr3IReW4X:W+XRXY6LxLp9vmVcmfgwbZnRUo3IuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469356, "uuid": "e216c72d-3af9-4935-abbc-07480e97c4f3", "value": 113138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469356, "uuid": "8d8d60d1-ba2c-4fd3-8178-56c257b172bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469356, "uuid": "dd367cf0-8a7b-48ce-b580-fed5876b2bba", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffa5995-b299-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761503494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761503494, "uuid": "f0adc1a6-ebda-476d-b56a-563e5dc73f74", "comment": "Malware payload", "value": "6609ff667f8912a6ab94f047325db02e", "object_relation": "md5", "Tag": [ { "name": "CalypsisStealer", "colour": "#5A804A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761503494, "uuid": "c0b6c4ff-3d7a-4b74-9573-ae7d459f5944", "comment": "Malware payload", "value": "cf2f1171cf18b47415dc872bba83468c37e138058ab80690df3c04a7c0f3e57c", "object_relation": "sha256", "Tag": [ { "name": "CalypsisStealer", "colour": "#5A804A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761503494, "uuid": "d33c5ea1-b5c5-409f-ab17-e6384d9a0e5c", "comment": "Malware payload", "value": "27d859ca7ef041758b58314eb6db52e030594721", "object_relation": "sha1", "Tag": [ { "name": "CalypsisStealer", "colour": "#5A804A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761503494, "uuid": "aacf4cdf-6efa-4497-a6a6-bf3fa95beae9", "comment": "Malware payload", "value": "3cdf89ed470700c77335a1448a94ec5642acc4be0eb74cc56ae3557601c1080b18906aa2d00127656c9ddf1ec04d39bb", "object_relation": "sha3-384", "Tag": [ { "name": "CalypsisStealer", "colour": "#5A804A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761503494, "uuid": "81c45c13-bda9-4a5a-8162-c6ea413fc1e5", "value": "T1DF173384F3B158EBFDD7A23B66108142A2B171315B52C9CF967C03A43F5B6E4293E7A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761503494, "uuid": "d4bcace0-26e6-4fe5-9566-a6026faa37e2", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761503494, "uuid": "6e341bee-ab90-4d29-a064-36bcf5130132", "value": "393216:mCxfRk4RhbOoeWzQ71q3sB1rnpDz1ZFIuJUdHnE:mYqiID713B1FDxZ69lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761503494, "uuid": "2be7a1ed-57d9-4995-84cd-d18db8654be3", "value": 19972179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761503494, "uuid": "422e9d89-7f68-43ab-8be7-97745d8edc1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761503494, "uuid": "5bfd1ed5-bfdf-48bf-9ca5-0cd540ffa82d", "value": "DESTINYV6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8410be18-b226-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761453894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453894, "uuid": "f9c318bc-a6d0-42c3-8ed4-747f9cd30aeb", "comment": "Malware payload (Mirai)", "value": "0c1cdb895167127f65a109d852c8b8c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453894, "uuid": "f2b5a6d9-3752-4818-ae49-37f1c96f525d", "comment": "Malware payload (Mirai)", "value": "d03af00a45e512727d12ca0a188c8b989c5bb4aab90b5ef85bb081b16b819b8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453894, "uuid": "982ac03e-fb3d-4721-8851-a6a64351c49b", "comment": "Malware payload (Mirai)", "value": "aff602050c4ec8ebf084db7db05e6dbd7bf04ce8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761453894, "uuid": "1c3ce425-e118-4067-8b58-7c8b51d19529", "comment": "Malware payload (Mirai)", "value": "7621dc349aeec8783efcfa81966de65475553e6f4d5f43c4d0717fc9abd0ba162575e2be98749ccdb21c271b370c0bc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453894, "uuid": "10341612-965e-4eb4-9ad4-0401d63617cb", "value": "T13EA3AF87B5507AFEF0D45D3FC5038F169619AFA009871B2E61BDF991AE393943283E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453894, "uuid": "46d938df-f651-4009-bcb6-82745d233d72", "value": "1536:5pDRczmt8gjZ0iQyJ6DJGTk0/Nf/b5BJa5ED9BHE/L+iTXPOgnDum98rYDs:5Lgmt8gjqwNkSNftC6HsL+wnDJUY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761453894, "uuid": "35a17e33-7d68-49b3-ba4b-0bd6c0f03bfc", "value": 107064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761453894, "uuid": "c1834738-3e5d-4b65-82e5-2dfc11d39356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761453894, "uuid": "821548b9-c727-4013-981e-e16486cfa4d9", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363c5af3-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499719, "uuid": "de92ed11-b5c7-4f2a-9c20-a6ff2eafa7a2", "comment": "Malware payload (Mirai)", "value": "21712e7fdb24dc93ba9d1550b2f432a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499719, "uuid": "945828e5-ac3b-4639-af4d-e86568f0763f", "comment": "Malware payload (Mirai)", "value": "d1066e79d8fd5cd296555c3828882669a59a6efb5240c6365615a16dbcfd39dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499719, "uuid": "521a165f-9a9c-4e4e-a538-9137f8a969f8", "comment": "Malware payload (Mirai)", "value": "f6b03ee69a8866de9b34dba0f8d24d6912396f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499719, "uuid": "632dcbf0-1140-45f4-bc8a-bca244974dce", "comment": "Malware payload (Mirai)", "value": "a0e23dd7bda7b954181d825def95268dbab333f2a5e112b5f8a9b2b09433c9e30884667b009ac5629f744b3980b2a89e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499719, "uuid": "381eb236-7417-4d42-a0bd-190654e4a700", "value": "T1553309B8150AF1BCFDF15078F00330EA2962051C369DE3E3B4970072EAB9B4D795AE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499719, "uuid": "8a682aff-c2b8-4e1c-810b-c7dbda8e6759", "value": "768:BvUhdcbK1X7gIU25H5aKyyusayLjQhGGGK:Bz27d1gj3sayIBGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499719, "uuid": "17392013-0e88-4fed-8bd2-576bc407fdf8", "value": 50616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499719, "uuid": "135a63ec-636d-4977-81d2-70bdc4abe0c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499719, "uuid": "d7a2f69c-685e-4b9d-b9df-e4e518ef629d", "value": "kvariant.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a79adfb-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516638, "uuid": "b003de60-ecbf-47f7-82fa-7f59bbc20b5a", "comment": "Malware payload", "value": "b42375b914e243c33628031afad878cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516638, "uuid": "753a2e64-16e9-4769-97c9-386e487e7eb7", "comment": "Malware payload", "value": "d10a70eb4f1a6df7aa06196bc76a1c80f316a0b7cfdc2d18276af1c610e38866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516638, "uuid": "0e31a6df-6e39-4890-bc34-8b4238668cc6", "comment": "Malware payload", "value": "9a177e934a465ae57a9b4edae2d1bf87896d1ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516638, "uuid": "4e602bc5-0621-4b2f-a646-c128372fb2ad", "comment": "Malware payload", "value": "fc95d03ecc62a75f97cde0b8dfb22e2f6d026e8d7e6b4a6fd6c9b2eceed6faa854ffc5eb9fa980a3d48695ce22c64faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516638, "uuid": "d0255204-ba49-4ca5-bb66-9766b4119102", "value": "T121573379DB6620F8C4BB223462EF03F11E16FCB80656A52857BC13DA7BDB5788D4C249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516638, "uuid": "bb6e8cf3-227e-46b3-9ace-abba6ee4286a", "value": "e1a617195887b9304c668489956651f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516638, "uuid": "68651275-51c7-46eb-896e-52c668505b83", "value": "786432:ZJdWuEPzcuGNYUpWHrzBSVfXFDryxF4OAvHDsqJna:PdziFUpWHrz4V/pyIOcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516638, "uuid": "3473119f-27c6-41e4-b06e-4d306a14e941", "value": 27732480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516638, "uuid": "5ab2de03-efc5-40da-94da-2969801f3741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516638, "uuid": "2b944108-2dda-4bc5-9010-771b59f792d0", "value": "xcore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a24e3f8-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469366, "uuid": "0b5af614-8b20-476e-81ce-bc81ac05193b", "comment": "Malware payload (Mirai)", "value": "8a75ec391d2ee176d54337dc58102cce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469366, "uuid": "23c57138-60a1-4d72-bbb2-395dc34d4450", "comment": "Malware payload (Mirai)", "value": "d12c018c1279937c444abc12b69194d4bdbd6b5180bf883f307a1935db9241b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469366, "uuid": "0d5d7534-4bef-4123-890b-a4a02bae02be", "comment": "Malware payload (Mirai)", "value": "763e5b7e8344edd5b8e20b162b731ae82e412ff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469366, "uuid": "13710f8f-45da-452f-81f8-cc1a8c769276", "comment": "Malware payload (Mirai)", "value": "20c3991598e7502f4b8b7eafddf805a5347af5d5dc6f6a91972a96273b11bbd33edabd33b09d8633c8420e13aa622958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469366, "uuid": "70bb1b4a-bb5b-419e-b66d-5cd178a19351", "value": "T1A8F33A56FB414B13C0C6177ABA9F424A33239794D3EB730699287FB43F8669E0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469366, "uuid": "6ad45814-2a12-4cb2-8328-65a4e0acb765", "value": "3072:hcloB4DnIyGGCDG2a2Awjo7DA3TA9Aw1YSwbZn5R6ZgPxVC8rs3b:ul/JrWG2a2Awjo7DiTAxLwR5R6ZgPxV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469366, "uuid": "5368d188-8cde-4a62-afba-8292bfac48fd", "value": 168445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469366, "uuid": "37706582-d841-4b4f-a8a6-25eace438543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469366, "uuid": "b3f383d1-c8ec-414f-9bc7-b0416d8f1701", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088d9e13-b28a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761496636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496636, "uuid": "cb410312-6132-47ca-9b54-d073025fd0bb", "comment": "Malware payload (Mirai)", "value": "c9ecb131c5217508116cf532de5f2b5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496636, "uuid": "5290274d-9dc1-4348-a4f3-b3d30fadb744", "comment": "Malware payload (Mirai)", "value": "d24612ef55c45cce15c81b72ad0f9205f87721c7a748faa55b34ff57efcb78f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496636, "uuid": "f3bee40f-4ca8-41a5-bf06-a8de53a8f006", "comment": "Malware payload (Mirai)", "value": "205915ce600cef85e16102f256be1caac604c18f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496636, "uuid": "f1b23d43-9247-4a5b-8cb8-593b0e3f0774", "comment": "Malware payload (Mirai)", "value": "5c54f01fa6a679ccb547f7817f18ca68a75c84e7fa0ed0434ad1898b2fd4f06aac3b3e588ee1fc2be7b6df69ecbc78d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496636, "uuid": "06f84157-fb62-4a34-a396-cb3c900b2cae", "value": "T19543020443EB1A4ED1AFA7B2929ECB0E2570D1296434FE7BAB1134FB4C877549B4DB48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496636, "uuid": "83fd3d0a-8cca-4269-bbd9-e63fb8c0f58b", "value": "1536:O3YkXWL1lgELyMvNSCe9k352cFfeg5rPNJs3TOnouy8HyK:QYkGtyQMk35xtvs3South", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496636, "uuid": "fcb5e0eb-585c-4b5d-9545-ad42b9670fd9", "value": 57352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496636, "uuid": "b94d6aef-3a63-4259-a650-c46161e06f5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496636, "uuid": "70097ff4-1a0f-44a7-926c-c56114c3cd69", "value": "Orbt.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7e5fac-b277-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1761488751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488751, "uuid": "f76aac5b-3203-442f-965e-3c443be04fe4", "comment": "Malware payload (GCleaner)", "value": "860e2e53bcd4ac3a0fc5fe1776b4b965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488751, "uuid": "acfb2817-8885-480f-bd0e-f5eb977a804a", "comment": "Malware payload (GCleaner)", "value": "d270e151fdcfab55ddbba8198881aaac6bd9f44a3113b8b2cb2ed64581720296", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488751, "uuid": "b3b184db-014c-437d-8603-02c2f98e3edf", "comment": "Malware payload (GCleaner)", "value": "ff87bca7d0418fd6042e4c8c13f17c6ce2277a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488751, "uuid": "55baf934-60e9-414f-84d6-4dfcd7a38c73", "comment": "Malware payload (GCleaner)", "value": "e758ada8d03c7d2e64ddaf6b3a3ba5804730242199eeb0ba7971e3610aeb3076751ef0a86f095a7ebfee503fe45beb00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488751, "uuid": "a64895d6-0cb9-4e47-a91b-f2a94b7fbe30", "value": "T12516DF1A5DF95A3EC1B109F50FBB92F9382F3E1026C4DC445EAD4485BA64E7133292BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488751, "uuid": "7b693ad2-b867-4fe5-8361-77e851c769ac", "value": "513d0d27bece74b1bceeb6501edda78a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488751, "uuid": "cd09252b-c7bd-4c7e-a0b4-54289467e2fa", "value": "49152:zO+5Pl3wN83x0/iDcWTGb0BtdCBl/dFLwwH7DDmEMz:znF5wShxDjTgfnvH7Dq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761488751, "uuid": "33cd0500-6da3-492d-bed5-98ba4f94d56b", "value": 4386576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761488751, "uuid": "3c774f15-8528-4ca5-852b-4d598d0b3b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488751, "uuid": "41420c5a-55a4-4f01-92e6-67fd103c31ee", "value": "SecuriteInfo.com.Trojan.DownLoader48.64288.28127.22700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9657e583-b296-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761502028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502028, "uuid": "399c205c-2177-4856-b42a-1c11ff13c7e5", "comment": "Malware payload (Rhadamanthys)", "value": "ff16d278706c6e0ef3ba1c1a3a61fbd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502028, "uuid": "1d8a4f9c-cbc2-4c7f-8a6f-c5daf3ca5581", "comment": "Malware payload (Rhadamanthys)", "value": "d378eafd2f24af93bfd44936867aa85d2b78434b7fd04960f7ed696f337b4389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502028, "uuid": "530b8381-1fc9-446c-bca1-ae05a8fea01a", "comment": "Malware payload (Rhadamanthys)", "value": "2ddc94be0034cadf884cd82cb9555966fa47f90b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761502028, "uuid": "92d799ef-de40-4deb-a251-fb374577a16d", "comment": "Malware payload (Rhadamanthys)", "value": "b1d9d081a4c4ef05b94367d9ee77996b6d067c8f515edcde57b74ac9d175fb3f808765a15e3b540ece3bd7ea229a1ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502028, "uuid": "243f0ad7-bdcc-41ec-a258-8eda929d4101", "value": "T174D57DD7ACF008A5D8599F35C9A25292F735BC052B3223D72A60B7B82F727C16D36B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502028, "uuid": "8630b125-88df-4763-ab81-ea3013c1856d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502028, "uuid": "9a8172d2-301a-4be7-84b7-c7011500aea8", "value": "49152:ypkax8zTEWr/JwbjqfTiHaQd16fIHvLlFluqKwFluqKzg:yuEk/Jwbjq2H3d16fI0dFdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761502028, "uuid": "d5f6be34-a631-4157-96a9-367cda6d82a5", "value": 2954712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761502028, "uuid": "24994066-f0a4-410b-ac88-d95fcd5856d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761502028, "uuid": "d0d62b6a-7361-4c96-a18c-924a1dd023b1", "value": "DropCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19623ddf-b28e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761498382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498382, "uuid": "ba0fa14c-c71f-425e-be12-a85a51d7b64a", "comment": "Malware payload (Mirai)", "value": "7c9adc701a7546f3a62f5bf35e2f88df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498382, "uuid": "b64f738a-4387-45b8-89d7-45557f85c7ae", "comment": "Malware payload (Mirai)", "value": "d3b1579cc87790e6e1c20d678feb4e298166c799ef1cdf9298b6e78f7b9984a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498382, "uuid": "c31990d5-197a-41ce-8830-50e4cddb4df7", "comment": "Malware payload (Mirai)", "value": "671f4f9e70d053b178ed1778e680920ff6e23a34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498382, "uuid": "b0064c4f-4a0c-4cee-b5a3-924ddb0e41eb", "comment": "Malware payload (Mirai)", "value": "a6011ea827bba0cc9439ba71cc2e0fffdfa2c2acc1af30b2ee25ffc209e3d77c6f5e0bc93f6e8fd24a702237c55951cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498382, "uuid": "7d4111c8-a687-4c75-99db-61b974c621a7", "value": "T10FF3BFA3B70F2191C86206F40BCF6B5D262335125EAB97E76C6E363E5A331DE45063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498382, "uuid": "94902d72-a486-425c-91af-0c695e0f0b4a", "value": "3072:vyL+QrZhsVoc++qVwCk2emWKXu20SHzbA4g7Cd1HVUVZJuZq:qhetEeOXuHMXAdCd9OVmZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761498382, "uuid": "adc9ca67-0a86-4f1c-8a21-88b7f9352289", "value": 165504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761498382, "uuid": "904ffb46-92f1-4a83-8df3-e5114f76b68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498382, "uuid": "b64e8a0a-0557-4a68-9d96-48c679c334ba", "value": "Orbt.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a1e0dc-b282-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761493439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493439, "uuid": "fffc2a52-2600-4068-868b-fefd67fbf9ed", "comment": "Malware payload (QuasarRAT)", "value": "4bae72ce0d82f38e221ab32f00f341ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493439, "uuid": "a918be18-dc17-48e4-8613-8229ecee4a3c", "comment": "Malware payload (QuasarRAT)", "value": "d3ef0e594e1984dfb2a32349c2ca01cecc9de210b3cc4358516a5ee5046b42f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493439, "uuid": "3dc938f1-a9a8-4cea-884b-865aeb57dff1", "comment": "Malware payload (QuasarRAT)", "value": "47814224e4c29a4269627dfef067dfa180d8cfb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761493439, "uuid": "b6e76dc1-204a-4d59-930b-d34f8d6bf5bd", "comment": "Malware payload (QuasarRAT)", "value": "32f91c5c249516e437197d90fd6977e1d1edf3916659c26c632969e86d311d24e9fa2df8270638e7fc47e23cfa296d67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493439, "uuid": "e19bec55-3492-4442-87c6-48102f6e30c2", "value": "T1C015CF4473F94607E1FF1BB9E4B61A050B73B942A537D75F1988A09E0EA7B80CE503A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493439, "uuid": "c3b5d82a-a9c1-4807-989d-fdfcf858e539", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493439, "uuid": "c6be92f4-7f6a-4a4e-94c8-bd08180242aa", "value": "12288:iMen0tWfOzABQyg7oZisqtksOtgg+WLyDrQ9/7Wxdtbiyt+vcNWcWqX2M:zDtWfOZyclOoWLuyWf6I+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761493439, "uuid": "35140e34-e4d6-4cf8-aef6-ab0e2cf9a012", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761493439, "uuid": "cc246428-d077-4ee9-a4e9-1e363d285da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761493439, "uuid": "58171d5f-64fc-4fdc-a258-680567cdfc13", "value": "xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879127a6-b2a9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761510164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761510164, "uuid": "c6c1291e-14cb-428b-844f-e25eb90c22e1", "comment": "Malware payload", "value": "87fbb9802855f368f5b6ed38ee830b96", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761510164, "uuid": "4fef27f6-7054-4d9f-ae53-5da22b1d7622", "comment": "Malware payload", "value": "d53c7114e69262d0eb88e3caf376e24e97bc2008e8e40751cbbc4c217e9ecb59", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761510164, "uuid": "3b91f79d-a8cb-4db4-b7aa-4bded9fab3be", "comment": "Malware payload", "value": "fb743917702ecf743df02f547cd0599353ddec7f", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761510164, "uuid": "f198c944-bf0f-4dc0-8ae6-a26f49d3b31d", "comment": "Malware payload", "value": "d480158d775fe4da4d10e675e797082f0143565f1d477971ea81885a3e97004e3c51c24a298b6df12504e0982249008c", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761510164, "uuid": "8bd8cca8-03ea-43e5-958c-3b72dc3c9ea6", "value": "T15D854A03F695C0EAC59EC0788757967BB632B88D0B30B6EF27D41B742E66B90671C319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761510164, "uuid": "bcd3cdc7-6a7a-4585-89a5-525a1fedfb30", "value": "eb0cd2b16b2c1f35fe7d74e4b9acb542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761510164, "uuid": "14584bbb-75f6-4810-b98c-fce8df94477a", "value": "49152:tHP043T1Pw4g34bWu8cm291+o5BKLfIo:DquFmLfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761510164, "uuid": "2f85ca42-d3a9-4e4f-b2b3-e522c7b91d0c", "value": 1725952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761510164, "uuid": "a53edc6f-51e3-448e-811f-13489cb0a68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761510164, "uuid": "00fbe70d-1c1a-4111-be4e-957bc6187a4f", "value": "d53c7114e69262d0eb88e3caf376e24e97bc2008e8e40751cbbc4c217e9ecb59.dll.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab02124-b21b-11f0-91c6-42010a9c0006", "comment": "Malware payload (AntiDot)", "timestamp": 1761449341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761449341, "uuid": "1d4efce4-a876-465e-bb3e-2f0db68daa15", "comment": "Malware payload (AntiDot)", "value": "d14bd632ebe6cb014b710b800e9956e0", "object_relation": "md5", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761449341, "uuid": "909f9bc9-d43c-41ea-975f-579db68239a4", "comment": "Malware payload (AntiDot)", "value": "d5b173bfff8c3d29cb97e20681cf8742e13c57f45b2c900b19a3fb14c0373861", "object_relation": "sha256", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761449341, "uuid": "b435c5b7-1105-45d3-b5bf-708959c4c831", "comment": "Malware payload (AntiDot)", "value": "cb6acb0c7245eadfc4b98b5ffed700e364db66e4", "object_relation": "sha1", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761449341, "uuid": "31c88b1e-3350-4e07-a844-076c90b6bdbe", "comment": "Malware payload (AntiDot)", "value": "9655b51c5c4dddfaddddd18962773a5fa7faae16cac7e1007d92e9c0554fbea14c142ba064836875631342f2a723f3fe", "object_relation": "sha3-384", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761449341, "uuid": "4ebd04ae-62ba-4b49-83ef-cc7440b5d2a8", "value": "T1D4E6026AFB0CFD2BC47A50B2CA16A133B16A9E214E4282F77808731C74B75E94F55BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761449341, "uuid": "2b3e17a9-d69a-4618-afd4-cb9b3693bab6", "value": "393216:e6ss0u9beIzKd7gm5XquEdzNBMdqnMtEdow:e5svKxMmU6oMSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761449341, "uuid": "f3ba216e-fbdf-47e6-8a92-ef15fef71b3c", "value": 14202920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761449341, "uuid": "4acb7cc3-55e9-4e60-b7cd-9902422f81f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761449341, "uuid": "2c028df9-7264-466a-8236-bad834445464", "value": "4K+HD+Camera_1.4.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af2d9da-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518652, "uuid": "6b4b3867-ed5b-47b5-8879-b0c017c099c7", "comment": "Malware payload (Mirai)", "value": "0bea846f9f9e660ea4d709eb4d6d99f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518652, "uuid": "f761ebd6-d76d-4cbb-a7fa-5b4c1d8b1102", "comment": "Malware payload (Mirai)", "value": "d5b3e583d9732c69e8320372d07866eccd9b792ad19a1f06c1868ee22388505d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518652, "uuid": "9a888a11-6596-48a2-b422-2451fad6c45f", "comment": "Malware payload (Mirai)", "value": "8e9423a2e6d08da8628cc290d5c573642895e92a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518652, "uuid": "35339f2a-80aa-4497-af3c-f8c0a3da774e", "comment": "Malware payload (Mirai)", "value": "dd10803c8dc09ad629085080a50ded8340286f053e3a1f5eb360e2a725c30c7cc42bae7080d1d0b2390d2b747ca0572b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518652, "uuid": "1f85e31d-202f-4092-aa6e-c81774d85c62", "value": "T1DC23F17976607246C9F22A315FB18DE6387B93FEC4EEB423334811D50CE185322B689B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518652, "uuid": "bde5bbf0-b21d-4b65-8fbc-56e3f2b26cab", "value": "768:Li8Vl4izRXQeOey1lkqziqY+FyBntkXfVW4Gr3vlIDe40tvidyxN9q3UELNf:LZmiNAeOexqzJyTkPVW4bDeltviggLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518652, "uuid": "64cd4846-0f6f-4b90-9f68-77bc6feaaaf3", "value": 48820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518652, "uuid": "162b5d91-d5b7-42cc-bbc5-90a20de1cb2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518652, "uuid": "4fc66fae-1f6f-4612-a8e5-df46743c5486", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4889c4b-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497837, "uuid": "cf0bf9d6-aaf4-4cbb-a110-547ad82264fe", "comment": "Malware payload", "value": "798aafc191de3f565f0dacbcc7f97d50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497837, "uuid": "8fb1d4b7-4a33-4ef7-bf74-0112b8f9363b", "comment": "Malware payload", "value": "d5eebf4329a00d747f8259e259c3a16d38b84caccba4faf00ead1e536ea8d872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497837, "uuid": "988ed4d7-cf7a-4526-bf21-63991d956b4d", "comment": "Malware payload", "value": "f73dc87f4216935bf6cdcd3364fe5c09150dc5e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497837, "uuid": "78da8152-7de3-41b4-8493-535441467bbc", "comment": "Malware payload", "value": "0d8d2b6991c971604ede776771ca627ddc878cacc1def7acfab8368259aacbf2c989e324840952770391181e6d1e70c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497837, "uuid": "9e5d5f87-876e-4e29-ac17-18c4ff1047a3", "value": "T17163016A683CCA31C7978E364132F6A0B9E734F30B637D7C7CAA61E9962C2590045CDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497837, "uuid": "63c4555f-c830-4064-9ff2-afa66aa40b1d", "value": "1536:L4E4klANFvzbD6Vb6L2eneqili9l+fo8mtOZ4AoGW1oM0z6K7kAofxPOorW:LqdHB2enFili9ls1mxGFfzgfx2SW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497837, "uuid": "bed6877a-ee39-4fb8-acda-5a56806ad2cb", "value": 70592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497837, "uuid": "eabd0ea1-38a7-49c3-8d23-7459eee63ee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497837, "uuid": "11f4bdd3-f195-42e7-9a3a-a0bf1e5d7d58", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d93a9e-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761517039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517039, "uuid": "b5123a99-58a0-4a01-a36b-cd2742cc060c", "comment": "Malware payload", "value": "58feaa4fbc66569dfbb656e81a63e9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517039, "uuid": "3f89d428-c825-4836-8d67-ccda01a0eab1", "comment": "Malware payload", "value": "d6c26a876be3ed69bf5db1c6b9fdbb9e65961b4d31be6f708482f42c032ef40d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517039, "uuid": "701a3927-7c3d-4e78-b54a-c9e80de0fc39", "comment": "Malware payload", "value": "74d0468ec1e4931fe268dcca0e873b5d3b5b5ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517039, "uuid": "d9fcebc3-50e7-4c72-badc-aee168ec516f", "comment": "Malware payload", "value": "b1eaf70e64cbeb427e6370a027e2964b796792038378d7c68b60336adcc46247fcceba53b588245c3a8bb84181e4d406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517039, "uuid": "b064e198-8293-4c3e-928f-155f90e9bd6c", "value": "T1D6C633F2B7911E14E18D6472C172973407C6CE4E16F2D6492A0B5B8BAF4E2E7890B7DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517039, "uuid": "8ae897ec-fa3e-4575-872c-6b3956f332ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517039, "uuid": "a285c3e2-150a-4ddc-9454-7f9e09980d84", "value": "196608:tRlxP5noo1rHs2yhkhXbN/aoFWhQENIAQ16twqzlK78cHzdCrWYE/gnIYh9ak:tRlxZHguhpXFWyRh6m7Zdy0gnIYP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517039, "uuid": "a5d8fd0c-43a3-416c-b9a9-518c360c61a4", "value": 12442112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517039, "uuid": "5d448585-8e4a-4fce-8a6e-99f0523728e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517039, "uuid": "62aca455-b1e7-4fcd-a84a-3793059534b3", "value": "ActivationProgram_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2996ce76-b264-11f0-91c6-42010a9c0006", "comment": "Malware payload (MetaStealer)", "timestamp": 1761480371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761480371, "uuid": "417d6760-6439-47fb-a265-1d85dbfa6055", "comment": "Malware payload (MetaStealer)", "value": "0c72bcb8307ef746f5b3ff2156a13d7d", "object_relation": "md5", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761480371, "uuid": "d9208b5f-38e4-4395-bcbe-dcfad6849f48", "comment": "Malware payload (MetaStealer)", "value": "d6f0f997309ab0f4942e901be4be0c1d4d307805eab51b74e4446c2f9917e670", "object_relation": "sha256", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761480371, "uuid": "1d3f3fcb-1682-4723-b3a2-8743b97c4c45", "comment": "Malware payload (MetaStealer)", "value": "746d55dfb8c160ecbb93b6b2bc4ae09e08cd54ef", "object_relation": "sha1", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761480371, "uuid": "ea299753-f44a-414c-be7f-f7b190ccace9", "comment": "Malware payload (MetaStealer)", "value": "9129bfac0d135f3c7afa95904c52973d4f0e432f4376d05f74d167a4dafb83a25bfa91ef08535d5da78cd6f4a0b1c135", "object_relation": "sha3-384", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761480371, "uuid": "63be529e-67fc-4241-afc0-9127a10f57de", "value": "T1817677E13780D127C94709761E53C399672DFCA1AE31B08B77A4F76E5B39AD26C28702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761480371, "uuid": "3401bcf2-1cb7-4d88-80c1-1e3bb67ba7e1", "value": "196608:RQkShPtMAr5Ao1NknsYn1wL/r+hQmDkSEVylGdI:WXrJ1NIscM/6DDEV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761480371, "uuid": "d303d10d-8e4e-4ba7-8dc7-24a34a59e04e", "value": 7757824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761480371, "uuid": "48a3a577-1d04-4fd5-9821-149dbc11b66b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761480371, "uuid": "5e3ca046-83af-4bd0-addc-653100385273", "value": "fhst.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5283c362-b253-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761473138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761473138, "uuid": "a4cdcb77-396a-4bc9-859e-e0c8926a0156", "comment": "Malware payload (Mirai)", "value": "298470ebef39a3ddc36e7c53db76bb39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761473138, "uuid": "39a76efe-942b-4eb6-8b85-79ce612582d9", "comment": "Malware payload (Mirai)", "value": "d728e3db2448842fa9d4f5875deda6e4381185e12da2eea6e41f88ec7f0880c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761473138, "uuid": "1e721fc1-24f7-4a36-ae57-083498a38485", "comment": "Malware payload (Mirai)", "value": "ded00d433f2c81552fcbd74138e1a4e51b310e19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761473138, "uuid": "d193ca2c-41a9-43bc-ae1b-77f3301121d6", "comment": "Malware payload (Mirai)", "value": "08c122eed43c3a47ca61637e509369f09a0c9680340511e0feba14dcd9b63b62b8aa47758fa8a19999886da14ac57a21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761473138, "uuid": "f6a7d5ca-c1a0-4b96-a0d5-170fd9440f53", "value": "T193533BA1BA819752C1E015B7FE0E018C372613FCD2EF72168E25DF2133E796A0EEA555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761473138, "uuid": "0a83d28a-7129-4b98-a36e-91b8fd99694e", "value": "1536:QOAo3XZv3VdC6LwxPryr4KnZvb6PVblIjFO5irw1cZXq7T/vaf:Qxo3XZv3VdC6LwJryEoZvuNpKFO5ir0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761473138, "uuid": "ae147d02-49fe-443b-ad3a-0570638629bd", "value": 62816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761473138, "uuid": "3bbe6337-29f8-4ec0-908a-480fed4e3b30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761473138, "uuid": "d65d6b54-4786-4f6e-b698-5e06723033e8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa16d698-b2a0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761506490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506490, "uuid": "70f57d21-839a-4f0d-a051-3fc5f7b704c6", "comment": "Malware payload (Mirai)", "value": "420824fc56ce8c49d5588046c45ad14d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506490, "uuid": "88e36187-9c19-440b-b6b8-296db73ec427", "comment": "Malware payload (Mirai)", "value": "d9c341129cf7fb0cca7c085ba5568ec073c17ef8303ac60abbc6732282331709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506490, "uuid": "9dddcad7-afca-47fb-8f85-eb07f65dbcba", "comment": "Malware payload (Mirai)", "value": "e3caf6a6f95d21a9460755831eb3cbae22cf6dbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761506490, "uuid": "fa9caa97-922e-4304-ab86-6e9ed3379eb1", "comment": "Malware payload (Mirai)", "value": "edee2267eb7aae02f3231af2d5556aec504bf4219b80a249e9a8c15e930a9e131d6178ef071e078f6f7a3aa85d5d6652", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506490, "uuid": "f1a3279d-1280-4c8d-a101-8bb35aa86ed7", "value": "T153736BC4B683D4BAFC2202716177ABB69B72F43A0129EE12CB75F975AC16501B32774C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506490, "uuid": "73a0f83e-bad5-4480-b324-f1b62861cf68", "value": "1536:wAXMRW9WqsHz6Ny9g//dnJ1DpfQE8end9hX9EGPqpOwuAZbCbdS:wyCnHz99k/T1DmEXnNaGSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761506490, "uuid": "4c715c54-1793-4523-85a1-bb43cc911885", "value": 74932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761506490, "uuid": "94e3df02-4277-46b5-9af2-0653783800b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761506490, "uuid": "49564c97-d061-4a34-9347-9697c9a4f7de", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7606c653-b28d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761498108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498108, "uuid": "80076266-57ce-4359-9c4a-1748825243f7", "comment": "Malware payload (Mirai)", "value": "2914a062ef4fd0170f13fcdf5231d1e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498108, "uuid": "b1bc137d-5c97-423e-9c18-0400a6e732fd", "comment": "Malware payload (Mirai)", "value": "daff00bad4af1038b641087e932ea759d3fa39b6a191f0a999bd9fda5bfe6b4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498108, "uuid": "df92510e-28c6-4b4a-8890-b95d8b855fbc", "comment": "Malware payload (Mirai)", "value": "0d80005973fa8a21b38bbdbf490538cd2c619a2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498108, "uuid": "dac31581-19fa-4052-aa1c-2c016ced62a7", "comment": "Malware payload (Mirai)", "value": "4462a11497ee5f06e7b7fa7d82f631f16bd8c783ef28d7257dd2ca2eae5aad1be06027db8dfebf42c07e1d1ea10e0aec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498108, "uuid": "f69ad388-56e3-47a6-a509-6388689ded85", "value": "T1CCA3AF47A4507EBEF0D5AE3FC4134E17BA209FA005835B2D65BDF990AA3A3507292F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498108, "uuid": "93269111-cf0e-4a2b-8e46-3b1fa1facb6e", "value": "3072:0XebLKKMKJE1pTtp8P1fXAA/ajDbbdUYI:0cJE9pCZH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761498108, "uuid": "f01e9707-4da7-4826-b788-438d3827d037", "value": 107064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761498108, "uuid": "106ba03c-ee90-4b1b-9b2e-a68b5e991e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498108, "uuid": "14216aa3-3e3f-45d4-83cf-abbe12ccc275", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3404c8a-b27d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761491420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491420, "uuid": "ecfa36ca-3f51-4476-bc9a-d70cfb0e44a9", "comment": "Malware payload (Mirai)", "value": "fa460c55dfc81119a5dc919c6beb03ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491420, "uuid": "9f79880b-d458-4133-b1aa-2012308883c6", "comment": "Malware payload (Mirai)", "value": "dbe0aa55bbe0e605e9271fa8e879f2b383850cb76be0618df8a665dbfa493818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491420, "uuid": "69287fc8-6722-453a-a825-4d73fda455fd", "comment": "Malware payload (Mirai)", "value": "8809ab29c8493ccb88116082e3dbae5d2d3cad01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491420, "uuid": "25b66f42-4ae4-4d68-b21d-e970f49bfe22", "comment": "Malware payload (Mirai)", "value": "5aa428ee771ff0ee9624cd522f5bbfb2a948be523515c1cce69c63fffafe3e442b03211eb9af8ce0ace4c8fe8285e976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491420, "uuid": "4c45b84b-24b9-4613-aa34-99424c430362", "value": "T1CB13F1BBA6ED474DCD1E683C08BFFA883849A3492480D1275A8071B21CE7FD56A1DF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491420, "uuid": "78d4fa0e-fbb7-4701-88e8-62a4ed68e306", "value": "768:cAorMFjo9iQAJk+XY98pdJZJmVFmCmbISvl3Gh6e8Hr1c0NnbcuyD7UGQRjx:cqFb3JKcJabGbIs2CrDnouy8Gyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761491420, "uuid": "cd77d080-fa08-4c89-8784-c2918b826085", "value": 41528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761491420, "uuid": "774fda07-29b2-401d-a108-08fd99aacd83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491420, "uuid": "864ee186-c9c1-4892-9861-36a4035606f8", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4601f125-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516926, "uuid": "39bc76be-bbce-4bc4-9ac7-c1fe1d1621c7", "comment": "Malware payload", "value": "d6fc4622d807c7218d698d92bc0ff22a", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516926, "uuid": "1b9ac638-7fde-447d-9620-9ec6fc0b65ce", "comment": "Malware payload", "value": "dc70d12c3c69fcb5024bbfa5bc6dd7b4bd31bb8eeca2efc8a8a1042d2d9b1ea9", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516926, "uuid": "a06cd987-efaf-483b-a30d-df7931eb10a3", "comment": "Malware payload", "value": "c813d7c9cf7d87ae4dd20edaa4abe8446236d3e4", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516926, "uuid": "2ca74c6e-6245-4f49-a3e3-54f463d7f6bd", "comment": "Malware payload", "value": "41ab68b801f363d0384bfc50a3533863d1dcd567d63e2add42b1ebcbcfa9187e94d167499703b3a3d9dda839bf5e191b", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516926, "uuid": "705aecc9-2619-469b-be63-28a7bbb5d28e", "value": "T10BB48D19E7E404FDE0B7E578CD934906EB76784A0771E6CF03A499A61F232909E3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516926, "uuid": "c819956b-a16e-469f-be00-f49b9db96a95", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516926, "uuid": "3d6a5194-2b2f-405b-a0b1-da56cd124dcd", "value": "6144:8j1zho1x2kD02IXYwa6fWnUh7bxa57SzYCO8gG4iR+v/74D8+xm4Rl1jqme4m6qu:UhoVY2+LfWvRSECKG4iRkTP4RXaJ6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516926, "uuid": "61dd7b0a-b43d-49d8-90e5-f5e3e8b7c38d", "value": 495544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516926, "uuid": "135618e5-f6aa-4019-a8b8-10a53f914e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516926, "uuid": "d9c735a8-0762-4d12-9aad-0582939ee9a0", "value": "67416741gpj.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4950d5b7-b2a9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761510059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761510059, "uuid": "7a1355a3-079c-43f8-84a5-aba48a526429", "comment": "Malware payload (Mirai)", "value": "a12c8241f8d6a1bad5d84b8a99d8f5b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761510059, "uuid": "eb2e9e12-ad66-4352-a37e-ffbc1ac2876d", "comment": "Malware payload (Mirai)", "value": "dc75b491e223c1dd5c0e08c84f5bb22900fc628e8ca6ad9dbdcb36120f2e2794", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761510059, "uuid": "a0cb92db-86ab-4531-88af-a71eb4e171e8", "comment": "Malware payload (Mirai)", "value": "5f6113f5c9210fcb1d000591e55d80862792b379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761510059, "uuid": "adc9c1ee-c38c-48ba-bd38-e36a7f735d2a", "comment": "Malware payload (Mirai)", "value": "4aac10fc3a5a150526e1d097fe374811af7423da4ce643bcc51d20872e367e58d5960c8c11ba945f34bbf2e79997f6b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761510059, "uuid": "f0c9aa30-8661-4ec5-988e-bd38a25da843", "value": "T10FB32B4AEA808B03C4D517B6BADF42553323D754E3DB73068918AFB43F867AE4E23516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761510059, "uuid": "b3325822-2355-4643-ba69-d0fbcdbd10d3", "value": "3072:akVb6/78pgqdp4773gimGcHFvcH6rkM/9hCX89:akVWjIR/E73gimnH6H6wM/9hCX89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761510059, "uuid": "42b052ef-4510-4239-a985-2a0020b48aed", "value": 114441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761510059, "uuid": "afde0119-8960-40a6-89b9-18bd57eeaf16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761510059, "uuid": "e45ead79-13ce-4784-954d-9a17ae09fb3b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58a1655-b2b8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516791, "uuid": "61e46e0b-b516-47e4-9802-5d66451e0f4c", "comment": "Malware payload", "value": "3578abc209bbf982df7d21423053ece4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516791, "uuid": "a9a7b527-9e4f-4eac-9649-851e4d59e65b", "comment": "Malware payload", "value": "dd3ddd077513015cbf001db3aecb945431a2aa75a571870e432d242e1d3ddf3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516791, "uuid": "729f0535-118e-4753-99a8-c5654ed31239", "comment": "Malware payload", "value": "c004aa4c3162053134077cb5da73f21dad092b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516791, "uuid": "ab7efa01-5d7f-40ba-bffa-8988c08f9046", "comment": "Malware payload", "value": "abf357097a289220e742d3af4d96499b543fc3c35e4854e787dab7359b350fb491ba5ed2e55d23864526ec99d3eba475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516791, "uuid": "734588c1-c9cf-4bf2-a813-caaf4cba5e4e", "value": "T1E7C733FCB270C9F7D1A20675B6F7EA109AAE9470C6D6F250A63C6C4C4E3449C5C6B48E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516791, "uuid": "b01f495b-894a-4b5d-9222-82045975dfb5", "value": "1572864:kCwGRpDW2LsZ4eCjdvkIXiFUpWHkr7dOd/NC:QmpDW2QZ7u32uwHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516791, "uuid": "c3e9af32-d25a-480f-94f8-65bfc45be237", "value": 55549187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516791, "uuid": "318a8236-d8bc-47d5-b7d1-d5baf78f8033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516791, "uuid": "b0453736-3c3b-4624-a483-9972f2c5c4f2", "value": "Credential_Guard__Key_Guard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf1ca09-b28f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499006, "uuid": "db985553-824f-468a-9dfc-3eeca9fac8d6", "comment": "Malware payload (Mirai)", "value": "ca42e574fa23464c04275e068d3d1520", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499006, "uuid": "64e53c60-3bea-4f4c-a509-5776fbd3c787", "comment": "Malware payload (Mirai)", "value": "ddc8a3d0a9c5f1384376e3cf576fbb51c4111872c4f0f35eef07eca9d53d19d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499006, "uuid": "934cad80-84b9-496f-8602-6afe2b5c4227", "comment": "Malware payload (Mirai)", "value": "39ca645322432db87a73865940031d2339807d5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499006, "uuid": "a6468f7a-0a1a-480f-8def-4f7a25fbc255", "comment": "Malware payload (Mirai)", "value": "5c627abd2c5851879a5bc2b12b059a568711154e6695e30ec28801cd94d9558d332ebadbe945b1c747ff27493b2d620d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499006, "uuid": "33f7fba4-ff01-4007-a6e8-10b10897fc99", "value": "T17A63011D2A9F60BFEEB9C5FC118302E00D5D4FF69B41D8065D6AF36299C5AF1608AF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499006, "uuid": "9c46f26b-4120-4a4e-95f2-4b3c4fc58861", "value": "1536:DwfdDdMh1rB4uAQwX2a0oL+mnV4nPcaCN6u4FOFz/QwVJu/5:OdkrB/9aL+iV4nPcZD4ETVQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499006, "uuid": "003d79d7-4537-49b9-b591-e980559f6bcb", "value": 69832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499006, "uuid": "3527e40a-06c3-4842-adab-b6eef00b25ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499006, "uuid": "7c54cd48-80df-46eb-87f2-7972cf68314c", "value": "Orbt.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835661a0-b28e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761498560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498560, "uuid": "953ef486-9ffa-4576-9600-c2ec4aecdc2a", "comment": "Malware payload (Mirai)", "value": "e7fc0ace84195e0b232fcf2bc8a4d426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498560, "uuid": "285511a7-3617-4985-8ed5-0df13ac22ef8", "comment": "Malware payload (Mirai)", "value": "de2a6f53dec7a04bce34e364e60245593125d354afbb238232408026f31ab91d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498560, "uuid": "865ee0b6-8727-484c-8e7b-bfff0ab35eb1", "comment": "Malware payload (Mirai)", "value": "ba11f8bd609aded78875209aeff8b0c858e13da6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761498560, "uuid": "d8a6083d-c4bc-43d4-9a41-fb8d0e4ba493", "comment": "Malware payload (Mirai)", "value": "4afd84a19afbf1d53f3d0cc80660d19af546905cd3ce1e1b980bc7771266c1f90713271f3029aec095c107349dacf171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498560, "uuid": "24ddaa84-816a-4416-bfab-091e545cb1ce", "value": "T12CE38D22D864AE98C224D471F021EE389B539EA645870FBB5AA7CB715043DCCFE453B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498560, "uuid": "055e9e9a-b873-4598-8372-5f76d92f0705", "value": "3072:bxtbP49Cnee0PIOopvWgazo6Vmo6srZ/fa84LWImqeYu:bxtzWCpvWT9Vmo60KFaICYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761498560, "uuid": "94f48101-f4c7-417e-a7d7-3edfe71534b6", "value": 153380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761498560, "uuid": "07d74442-eef2-446f-9054-b43503331dd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761498560, "uuid": "416dafd0-5ea1-413c-9829-6f96637c3499", "value": "Orbt.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad3e351-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761496425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496425, "uuid": "8c0f998f-950d-4d21-b1ae-36e362b0d08c", "comment": "Malware payload (Mirai)", "value": "4e7c7e6c87b9fbd14be997bf27910b47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496425, "uuid": "0d017207-30e5-41ee-a7b7-f88c83a95d78", "comment": "Malware payload (Mirai)", "value": "de3bd44346ee186e67fef4c87774f452833e37908a3dea173c2969ebe2443ad6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496425, "uuid": "65734ed0-b92f-4cb5-9fa4-1d35b6b4703a", "comment": "Malware payload (Mirai)", "value": "590750390a82994d4970482ec2fa3b0a0dfe622e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496425, "uuid": "5d96a7cf-77f8-4772-8a61-2f2f7f4f174c", "comment": "Malware payload (Mirai)", "value": "3fdb6fea05c02b91c1ddde4840e3e973064154fdb2e74b13c08c9214b22fb17f9c58ce0357f4453e6c25dcda9d9fdf37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496425, "uuid": "41f26b38-1725-42c5-953f-11c3f4aef71d", "value": "T1FE631A82B9D2855AC1C163BEA76F659D3361A3F1C2CA3503EC975B11338756E0F26F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496425, "uuid": "7e5ac78a-8b84-4818-96dc-9e87f30e3ea6", "value": "1536:UdAb+UhjNyDXrdwjr+HFZk+4RIlh92diFqHHbUn3ISJdUa:yi+UhjNAfHCRIod/H+ISJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496425, "uuid": "8ed267b4-b33f-4d4b-bf9c-7b144377424d", "value": 71160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496425, "uuid": "d625c415-cb20-456e-a309-9ccacda3d6cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496425, "uuid": "03c50575-4619-47d0-a0ff-3dfb6f8d9e79", "value": "Orbt.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae0efe7-b2af-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761512693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512693, "uuid": "395b4013-b6d4-4d8e-837d-b1fccff8e467", "comment": "Malware payload", "value": "8fc3b40c2ee1fe69c36c762cd6241cf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512693, "uuid": "364866b5-8ec1-4ce5-ab02-b08fb5e8a26d", "comment": "Malware payload", "value": "de52486606258cec40a979d027f5e788b55cf7c8572b3333713be14c2970a68f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512693, "uuid": "05ba5b11-0d73-46d7-92d3-0db998c2107e", "comment": "Malware payload", "value": "cc3df89d733c2b0c175d70a2f086be958ea5716a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761512693, "uuid": "25077708-2e89-4d55-9e1a-ed15919b8703", "comment": "Malware payload", "value": "781de745e6bdd7e9ab8217e7e75fa33cf7d5c477f126f5407ba7410b731bc8013a25d7aadb39dc1ecee60f234fb1353a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512693, "uuid": "7fe0a61c-34e4-40fb-a9c4-cb41e9d99275", "value": "T1A114A51E6E228F7EF66C873047B74E34A76923D627E1D684E1ACC1105F2429E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512693, "uuid": "9bc59f43-0c8b-4da2-b7bf-e749588ea693", "value": "3072:URD+mtEeGy7pE8aYAlpkBcfuPByxL0CSQiZ0hNFQsO:URRtHP7porlzfK4xcQThNesO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761512693, "uuid": "26c96b2d-4ba8-4f78-9c18-381490a48f20", "value": 203448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761512693, "uuid": "6c521ab2-9395-4f6b-9d09-2a3bb91e64bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761512693, "uuid": "192e4a3f-1c80-419e-87ce-b15912fcc509", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038dabd6-b299-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1761503070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761503070, "uuid": "795697c7-96b9-4a0a-ac93-068a443c687b", "comment": "Malware payload (SalatStealer)", "value": "64b5622d4b928bb1f738aed0cad24bac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761503070, "uuid": "f3ecaa4c-95b3-4912-b343-6f565b52217d", "comment": "Malware payload (SalatStealer)", "value": "de7013337ad2e5084c1a67977ff7082ef2deb92ff8f64152a28d22b61294aad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761503070, "uuid": "bda0288e-1184-4606-8e0f-a806fa1dff56", "comment": "Malware payload (SalatStealer)", "value": "cd5f3b54d3b84d89079c4c3c64d9f86170918503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761503070, "uuid": "f7fd16df-a6cc-4094-998a-08481e4cf343", "comment": "Malware payload (SalatStealer)", "value": "6988b20de8a80bb6046c5bcd1184571ce7b5856844c32157784c8069f168af1736fb21a77739163bba2b16971ed51dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761503070, "uuid": "2096417a-52ec-4a47-9c2e-e53fae802752", "value": "T1D7F53348EEE041CFE76369F0058486D32BA393D1F771A26145E74BE0364DAEB6236D9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761503070, "uuid": "94139d5e-d4dc-4fa2-a561-1322812eec46", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761503070, "uuid": "06b48105-bd85-4057-80bf-dbd9a1b01115", "value": "98304:hbrNzUf91Lrokv6iHwu3yx/pLFycprSvs4soR0Cl0Y8m:RaXtFHpyhpLFyqOaS0CiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761503070, "uuid": "7a1ffe75-ae62-4877-b43a-2b2c7b943b6c", "value": 3558400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761503070, "uuid": "58b74820-1649-4d33-ac18-ac4d8f735b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761503070, "uuid": "52ba6c3e-226c-4fed-939f-cdee3189a981", "value": "SecuriteInfo.com.Win32.SalatStealer-A.66784112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eebc83f-b2b2-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761513961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513961, "uuid": "3e79f392-3aa6-4bea-8229-c16fb2c5570f", "comment": "Malware payload (AsyncRAT)", "value": "9a24861f1a3b281522eb6f274359df8b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513961, "uuid": "af809f33-055a-437f-8023-2621ff44cc0b", "comment": "Malware payload (AsyncRAT)", "value": "df8a3aa8281ab768be25aa7e6994cb4a2b75c2fb76b9decea321cb2f032c4cd8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513961, "uuid": "6ed0b280-45ac-427b-8f3c-cfda0b0387d4", "comment": "Malware payload (AsyncRAT)", "value": "4fe89097bc73eb6cca9070a4705b3a58eb267d35", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513961, "uuid": "57079096-2495-4bf0-b0a7-638dcf69e42a", "comment": "Malware payload (AsyncRAT)", "value": "e0a6e7d7413bee2b845e590bb97b13e346a51f02c0a4527b41ce2b4978161cba30f717d922b61e63b5012b7c93b20b62", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513961, "uuid": "11547182-fd60-4f3c-98c1-176958d80920", "value": "T1E6134B487BD44612DAFEBBF51972B10A4B32F5135913E75E0CD49ADA2B27BD08E003A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513961, "uuid": "08aba5ae-cb21-4945-add8-d04f1a92648f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513961, "uuid": "5e5675a7-2fba-4116-bced-bb53333faccc", "value": "768:8AoPDwgJOSpuqldThkwh77LXk6mJomQS4FFRPa9Oh16POCh+O+bK0:8VDwgJOSp7ZvZE1XqFA9Oh16POC4XG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761513961, "uuid": "8c49c7a9-75fa-44d4-98ec-82717b95cb22", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761513961, "uuid": "c46eb8d6-6846-45da-92e3-6bf553947f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513961, "uuid": "bc82605d-6061-401a-9763-357e1c63c51e", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c79ef0-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761497375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497375, "uuid": "1f211524-3480-4e9e-ae22-3fe60a1a9cbc", "comment": "Malware payload (Mirai)", "value": "1712c88a258b384d861e5211f85b0730", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497375, "uuid": "fae21fda-9d5f-4f6a-a022-0deded59c8fe", "comment": "Malware payload (Mirai)", "value": "df9841ec9446662fb9066c6c6d9a5b9634451fd21fbbced40e75bccddad91d58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497375, "uuid": "0db8f0d3-30ff-401c-b83e-f81aa00f89f6", "comment": "Malware payload (Mirai)", "value": "0bc4affd6cc94426cb2bdc9c74f7c86de74de42f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497375, "uuid": "5c84a33b-d791-4482-84ee-3c3109a9b95d", "comment": "Malware payload (Mirai)", "value": "f2bc237a6c709ad5c2ff07f1a29c8d9faf62ad580b451c4491a00b0649bc4d312b94528bd8c7cef8ee6f2bc02f8397e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497375, "uuid": "6a91278d-54a0-41c3-945c-449ff49f8c38", "value": "T1884302ECD2FA8C97C9BC147241EE174F841DE6FC6821C386AAD161BA588AF345D084DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497375, "uuid": "0a1ecd20-d049-49ef-9a49-20c16d35c412", "value": "1536:ITjcNIsehg47HiGI01VM87/w0+p6/IzD6bDnouy8tyt:xCgsiGdTd7/B+kf7outA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497375, "uuid": "aa6a892e-d353-41a7-92b3-087d97f0bd15", "value": 56656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497375, "uuid": "f6479543-26c1-4c9b-8d99-0402051b9426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497375, "uuid": "b8438985-57ba-4961-8ac8-e233eb4a1390", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda76cf0-b2b1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761513744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513744, "uuid": "a920203e-f2ce-459d-960c-6170ed819bf3", "comment": "Malware payload", "value": "93237c304012ae32e36030902b721e32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513744, "uuid": "e34e509b-82f2-45c0-b0e0-ab3795082c6e", "comment": "Malware payload", "value": "e00c2ac73e86d22d10bd784dddae83b67a4dc6e3b085e4f6995d325660903fe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513744, "uuid": "a3b54eb8-c7b3-4c64-965a-71f66e47e378", "comment": "Malware payload", "value": "57a43683ea6a1d608c6870f2eba7b6e8fc453b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513744, "uuid": "e20e10cb-603b-4c31-b34c-2dfb5b8a8c64", "comment": "Malware payload", "value": "28b677e5d15011807e8989ecc6d8de0ed17ee2ddca0de901f1954eb302c00220d17d13d41d21c42f95072c0888fdc0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513744, "uuid": "a1846fb8-254b-4a6a-a215-815d0ce58c47", "value": "T13F75231B02F47477D9BB1FB489F9069384B1BCB42B65029F1AC1F1B4CB726C8A536B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513744, "uuid": "1980657b-9d8d-4fa0-84ef-ef7da3fbce45", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513744, "uuid": "fcb7b32e-d6c4-4106-9ecf-6b5f95159661", "value": "24576:pjm8msEADS8b6JdC/H6ZuLuL2s5SDVi/RNGo96/CUNVy2mxgJXD/LmUTzj:pj0sKbCHhaL2s5HJNGPCIVy2nXDqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761513744, "uuid": "83bd076b-5f8e-47db-92be-2b5e9ac35ef0", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761513744, "uuid": "6046442d-587a-4974-b6b5-86d0feb92ada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513744, "uuid": "a9dfb6c6-4018-4a25-948d-28ad76bb71fe", "value": "Kiddion's Modest Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33e3eca-b25e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761478105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761478105, "uuid": "47a6dc09-5b27-4afb-8c8e-a7aab84a30b7", "comment": "Malware payload (Mirai)", "value": "7122fcef392dac6f06957cab8adb6bad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761478105, "uuid": "3af0a657-5e26-4b1a-848e-1f8de9d6b8aa", "comment": "Malware payload (Mirai)", "value": "e035310dad99f654b0319774efb98e0b0eee2fbf8db57e053aabd224119d2362", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761478105, "uuid": "cb95c542-54fd-4ab3-8e0e-7e08e666b44a", "comment": "Malware payload (Mirai)", "value": "a39c32a1217197e269203b46f1017fc4b8019de7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761478105, "uuid": "a412da8f-89a1-48da-89b6-e59551983aa7", "comment": "Malware payload (Mirai)", "value": "7136bc86ea7c2940f4aa8df7282e05168ae5c44b63e1a154f9115bcba6945cdd25c2cdc09c5735b768e8ee0a47b85155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761478105, "uuid": "0db57c09-7005-4c61-9bba-f7826914318c", "value": "T114D35BB7D8292FE8C120D8B1F4359FB81B63559541431FBA6AA7C2B04487D8DF648BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761478105, "uuid": "706843be-9d59-43de-9221-412a963a77f8", "value": "3072:ywo5SE0Y6Lgj03bt/S324Cz0TQdILbvB6hh1bro:z9geSheoQdCUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761478105, "uuid": "c90e48f8-cae5-4856-b32e-d4781ffbb3b9", "value": 141412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761478105, "uuid": "a6af62c5-97b6-480f-a201-b3b1c8329e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761478105, "uuid": "736e60ac-79de-4377-b640-8c26df56a585", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9298660-b288-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761496154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496154, "uuid": "68d46fa2-b2c9-4d69-9b03-c783bc1a290c", "comment": "Malware payload (Mirai)", "value": "2a5ed2293a1304939f29423fd9cbcbbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496154, "uuid": "ddd9d3a7-adaf-4346-8ba9-26c17f6f15ec", "comment": "Malware payload (Mirai)", "value": "e1a9a620e179b54ab31c63ef60eb0cdcf0c007fe8abb4070b091f98bf8eb9e1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496154, "uuid": "8cdaef9d-acbe-45ef-9a81-e29d08df74ef", "comment": "Malware payload (Mirai)", "value": "faf9a6e5d5b54ba36a5abfd7255bf9c4fc31ea18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496154, "uuid": "77f2fe4c-553f-4bbe-88f0-f4d58f900f21", "comment": "Malware payload (Mirai)", "value": "9fff393eb80f5fc1d025f66057e4747c6bef73f293480a73b8d486b3473556fc34d42cebfa99f06ab74dfcf6c2abd774", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496154, "uuid": "c7672ff8-f44f-46f0-b711-72fe7b8592fd", "value": "T104B3F84E6E629FBDF768823447B34B24975823D127E0D685E2BCE1055F7028D682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496154, "uuid": "5f5bfe4f-d1b2-48dd-a958-842167ec15fd", "value": "1536:zIJwgUpbbGMoYZa2aXH1cQDjceJOddQy2SPzeqkl4TB57emNGD:zIJfUpbCMoN1cQDDJOddQLYhBfGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496154, "uuid": "a9c49292-13b1-4ed3-8f4f-7a16f8a891b2", "value": 111396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496154, "uuid": "f41f8854-a8da-43bd-8d41-6215856ff28d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496154, "uuid": "7ef3fde4-01c9-4439-acab-dd61e0e4b6b7", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fbc38d-b2c4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761521620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521620, "uuid": "da542048-4477-45cf-9276-c8eab6c6a76f", "comment": "Malware payload (Mirai)", "value": "1067964a6cc957ac0c12e88888403298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521620, "uuid": "4bc5aea0-254c-4e5d-a5c7-ac9bd6d07373", "comment": "Malware payload (Mirai)", "value": "e265f01b4a15f5f0c43d21b94c8d7848773fe2311b9641fbf0250e4838b6b053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521620, "uuid": "cf406bac-f5c6-4a73-8de4-4b55efa993ab", "comment": "Malware payload (Mirai)", "value": "a8906decae4f94e473fad05e61066b37a316d4f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521620, "uuid": "a3bfd05e-ca52-4b1e-a5b2-f6e83b283baa", "comment": "Malware payload (Mirai)", "value": "b44881c8e8fa26b4946c85227f9cb8772c2dcd46065be1c6157fa43d310ee8770cd8794e40d0f14c499b8fca4e801425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521620, "uuid": "b4d1e41f-7ad0-4516-be64-d84d10836aa0", "value": "T13403F1F7622648B6C17755F52CBE4688FC60FC3CAF429F3244F6543CDCBA5A14626A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521620, "uuid": "8348ed49-6a79-4836-b434-0fba72c91b8e", "value": "768:Sof4qHai0E4nPfczRy4RRVj7lv6o1LH76fcNGL6SjQOjJ4R+Hx0Y4:StqHai54Pu44RDHlyo1z7Wcu67q5x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761521620, "uuid": "e1dd6a03-6084-491d-9219-be5ea42d8fae", "value": 40068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761521620, "uuid": "5600d63d-468a-4117-b997-cf1bcaa0ba0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521620, "uuid": "df923cef-05bf-4bca-8912-4cc3f2e181f2", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26f4fb0-b27e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761491794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491794, "uuid": "0f587e7b-3b42-4084-84b1-5094d2e6eaeb", "comment": "Malware payload (Mirai)", "value": "93f6609c66f7f300a73dba9a6c4bb39d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491794, "uuid": "8b9a446d-f28c-4843-aaf2-e7f03427d364", "comment": "Malware payload (Mirai)", "value": "e28366163e0f523480b21e08a79f0c12d6e8d21697c0e7d5db5c8124abfb623c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491794, "uuid": "3e8c1566-99d8-4c0c-a4b7-5c656447cf65", "comment": "Malware payload (Mirai)", "value": "e20e90195721003b784721c3a8ed27ea68d48ecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491794, "uuid": "1ebe9e67-fddb-4395-a8d6-6a7570a15625", "comment": "Malware payload (Mirai)", "value": "cefe07fe89b5a2386412a425a35be83c7ecd675405caa2445eb22949296e427d6a3a6e7292777900a8dde8d41d142444", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491794, "uuid": "7bfda94c-0164-4504-902c-6b401f2342aa", "value": "T13B631BCAF401DE7EF84BD67B0C564E1CB971B3D106830B265BA7FE97AC72158291AC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491794, "uuid": "24cf83ff-21dd-4f0b-a124-43858637b7d5", "value": "1536:JE8oBLKMV2YnDx8QNa8QeuacWjcW0JcWcBs1JUf6cninyubQ:JE8oBLK22YC8QeuacWjcW0JcWcBoJUft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761491794, "uuid": "d62264d3-7582-4187-a350-ce351f395449", "value": 71960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761491794, "uuid": "6d3d124a-6caf-44aa-9d8e-f65ee13ecb44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491794, "uuid": "f3629690-5467-451b-9ec8-c9aecc14cd97", "value": "dlr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2744d6-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1761496350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496350, "uuid": "f03c0ca5-daa2-4e82-ad51-4296cf133f91", "comment": "Malware payload (RemcosRAT)", "value": "4b4ea640b9be52f92d539cd754584d1e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496350, "uuid": "7a86a361-909e-4834-b61f-d04e514c1131", "comment": "Malware payload (RemcosRAT)", "value": "e2b78112cd00ec127d902e5e053f3de6a6d998d7f4487ee5b322d57ff2e02c4f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496350, "uuid": "82afcb1f-1d3a-4429-b7b6-c8cd8da67a22", "comment": "Malware payload (RemcosRAT)", "value": "88a32cb19538258b4cd79d4aa0c755fcdbbfaa1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496350, "uuid": "2c8d7b2a-ba84-4b35-b7e3-36b01615778b", "comment": "Malware payload (RemcosRAT)", "value": "aabf76098af6c4f0d1e6c69e09506915e7441edd3805fd57400625b36005a283f6ac7a9134494caf073c64e38c4ef7d5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496350, "uuid": "efaf92f4-7557-4f37-9a05-ce494fbe045c", "value": "T17A85DF3B8133FCDF772C295890082C570D582A5352A64A6CEC495B7E79C9703EB9DABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496350, "uuid": "94b0f011-e1e8-48d7-9d64-2a78d2d68cec", "value": "24576:T2D0E/0R2Pxdt1uhGd79GR5+wcWVV6EL0tWCLxpx1umn2mdiPV:aprTDzns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496350, "uuid": "f0422203-8394-41a6-83b4-acfd308b59fc", "value": 1842188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496350, "uuid": "1e927cfb-d00f-4a59-8662-7a084840651b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496350, "uuid": "3c05a0a1-20d3-47a9-9585-defc3e94e972", "value": "DPE X DPE VALVE LIST INQUIRY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3188b3f-b27e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761491795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491795, "uuid": "ebf6a87a-7c1f-4b26-90bf-36f350f377e0", "comment": "Malware payload (Mirai)", "value": "9e576e3e942bada6a37cec4bf301572f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491795, "uuid": "8d1d9c3c-d161-4ab1-9495-5a1b0df39e26", "comment": "Malware payload (Mirai)", "value": "e3a2641d86158c48d3dafdb1535f32500beb1bb2aa8cc62c8fc61ed3fd8bec77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491795, "uuid": "6adaf108-5094-465b-b187-123d0bc62b76", "comment": "Malware payload (Mirai)", "value": "110baaf786e48e2703b818044b62aa3a8a961de1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491795, "uuid": "90c6342f-957d-4310-8d25-f768cecef985", "comment": "Malware payload (Mirai)", "value": "a47d70e70a72fcf07de5f8c87bd6e244a293594cafd6349cc28bae6c04f230813bc0b46b32b98817395975e36f4deb66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491795, "uuid": "96d0ae8f-76ee-4526-bdc1-a131f80da7c3", "value": "T18FA33B22773A1B22C0E1A47940EBDB3673B69BCD1A64820F7E611F897F166E035437B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491795, "uuid": "6dbc5ee5-fa58-4e92-89d0-fd9d87a88ec6", "value": "1536:R/BskZoqKZTeSZWVGqGAWZdno8C4M6omIkQ5XmwfqgClNfEsn0SZU:VOKGqSuzmIbhbq7fvn0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761491795, "uuid": "4dbc2cc3-6400-4f7b-8c4a-b5bc299836d2", "value": 103100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761491795, "uuid": "230c5aa7-bfb6-4449-a5f9-48f14bbab58b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491795, "uuid": "9ff13141-e87a-4a44-9454-0a01d556bb37", "value": "dlr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5731a335-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761497198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497198, "uuid": "513bfdd1-9273-4ab0-b5de-9c8b50bebfcb", "comment": "Malware payload (Mirai)", "value": "8a59fcd6bf5db9c861498b91a67422da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497198, "uuid": "0d347a31-d259-45ae-abff-f479131468f2", "comment": "Malware payload (Mirai)", "value": "e48620e4b7023333ab8be0fd3748ccd9968c595e2c57ec3de9d49fae8389ba6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497198, "uuid": "aa71086b-725e-4049-b6fe-96837aadd239", "comment": "Malware payload (Mirai)", "value": "f6bc4a3b01b9112b648d17f7fc09ecd707039fe8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497198, "uuid": "d2c0d6a2-1bc3-4562-b487-3c3a69af6e35", "comment": "Malware payload (Mirai)", "value": "ffaba57b0b7d0d03e48960e67f5dae3fa6b0938b8e3b93e89e42a7e1ad7b43f5f770d0a0916b26f96f148dbacabccd96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497198, "uuid": "d7a7b47a-49e3-438f-807e-44180bf9db3c", "value": "T1D0D3BF31F0056CA0DD1006B834BA957C1341EEB40AF55282EFBED5AE2577D987AEEB70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497198, "uuid": "6375f0d8-90e8-4943-9ea2-71f157a9d56d", "value": "3072:QQbVZgFAcCCG6q93O11GZvhHQpvsbn8pWdR4ZRv:QQbbg10RRQpiniWnSRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497198, "uuid": "32cc834e-21be-4e08-a086-af42c926fa11", "value": 131796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497198, "uuid": "6fd68287-839f-44dd-a101-9680e21cd160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497198, "uuid": "a3083176-5b31-421d-8296-5ba450edb056", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330ded3d-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761497567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497567, "uuid": "b58570ae-cfd9-4c83-8d02-61638c705589", "comment": "Malware payload (Mirai)", "value": "c089f50a8eb429b7d0f92635372883ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497567, "uuid": "bb02a3ce-3e46-4e82-81f8-aeb038d600e2", "comment": "Malware payload (Mirai)", "value": "e4cfaef1bac55e231f332c431ab0082e606e2e4e02588345db07303a4a2adf51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497567, "uuid": "12c38c37-440d-47af-8142-286168d4be51", "comment": "Malware payload (Mirai)", "value": "e2d2424745224233e5a8e0fbfbb495ecad681071", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497567, "uuid": "7cfae0e0-062f-4727-a2f8-fc0a59e82720", "comment": "Malware payload (Mirai)", "value": "9db06527d1cab4b4319dc1d7b1263d22924f29fb33227a105e41800716b542657bd854ddc678e7e86e6190a661cfad59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497567, "uuid": "aebb3a7c-8254-4265-936b-812e6b8180d6", "value": "T17E040846F8C18B11D1C111BEFE0E518E33235BB8E2DE7212AD256B60778B9BB0F3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497567, "uuid": "81767b0b-6ad3-47af-8c7a-0561aa1d11a6", "value": "3072:yjCSnHu7xx7VxMQKoqGBXWto2aaZQcuiBO7qVsF2Dfvr:UCSncE5obXWtoBanO7qWYDfvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497567, "uuid": "9632e3af-0086-46f9-8978-c0a98b4e7cef", "value": 184732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497567, "uuid": "eaed95c4-41ac-42bb-a0d8-6b4d6688e4cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497567, "uuid": "d6af24ed-4a17-4522-aa0d-4b81bdc8d465", "value": "Orbt.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26761c7b-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497116, "uuid": "d92220c1-95f1-4f4c-bb83-8036d00d29ab", "comment": "Malware payload", "value": "49184cedda8261d59795644b57ba291f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497116, "uuid": "db334bfb-af1c-4945-b4c6-fc21cf2f09f6", "comment": "Malware payload", "value": "e4f86de37fab2dd717742e45a9c438145fc9fe6c090ed8e2c0f5e65f302ac41e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497116, "uuid": "a3850b99-05df-4d86-a4da-8714b2329087", "comment": "Malware payload", "value": "d0c38e9ed08258108be6052625b914472fbd4b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497116, "uuid": "8f065334-2af4-4ef5-b2e6-83ee0e99b26e", "comment": "Malware payload", "value": "30b18d6fe56dfb9f02c9f03049a4dd472c89e9e9fa00298df1206ad94643df00a4ba864255915447b429bd83b7c3395b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497116, "uuid": "8d566b51-372e-4dcf-a710-63b855e46314", "value": "T142F522605D852FF0E02FC77075910A0CB36F3BB1DA3866AE5B95D8254EEA5281D327DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497116, "uuid": "f7641cfa-4420-4a40-b509-424ccacf141d", "value": "3e0e6d32ffd90c41d6f9e812a56d2d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497116, "uuid": "ed682103-2d27-460a-b4f6-68e76f7ded05", "value": "98304:rX6Zem8UssOM5/5Xpsl+1atb0OMcV1B6jxp42R:L6cTUssPXpsKQ4OMcsNp42R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497116, "uuid": "bd96e785-6a10-4693-ac6b-01cdee46c72b", "value": 3614128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497116, "uuid": "d157978e-2740-44f5-8f4d-2ad4a8be93ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497116, "uuid": "c1af5f6a-15ff-484c-a233-41709f60e6c6", "value": "49184cedda8261d59795644b57ba291f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b776686-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516935, "uuid": "c221c159-02d4-413d-a9c7-c2991432511a", "comment": "Malware payload", "value": "2d83c86c96b47a315577c093d97f69e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516935, "uuid": "4daf6513-375d-4231-82f7-55814d92bfc7", "comment": "Malware payload", "value": "e5ccfa49f96294344c3498330af7a99cb6bc7808430b3390000f5fff99f64f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516935, "uuid": "08e86989-bfd7-4595-886a-7a4f00ab6de0", "comment": "Malware payload", "value": "d06804784da0f44643c63d2cc632608887035921", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516935, "uuid": "17c18845-eca9-4d55-90cc-0a9721afef00", "comment": "Malware payload", "value": "aebf98e0c0a9d4848cee35d495f2711e1173de5b78a60a6a5c089b1afdc35a803a0a691f5cb6b3a915d8efb655868bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516935, "uuid": "9a27e9df-f478-41e1-ae28-c59ffa3c72a3", "value": "T1B066334E7690BDF7FE56BDF3A25BC3634E24F8469B2894911202B67C07448163C297BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516935, "uuid": "4ace59ad-2842-4e50-9fc9-c7bcc2974783", "value": "35972172e234f6e80257118fd144383f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516935, "uuid": "112d6cda-c7b0-42c8-815d-70f9371fd225", "value": "98304:Xvx3brlbrlbrlbrlbrjkF9pA2U2SXyBQylFm23zoqsawH/sfMkdLOISR05q:XZ3vlvlvlvlvjyLAszxsawH/s0kACQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516935, "uuid": "19ed46ed-0c6b-4c65-bf88-4234e0e231bd", "value": 6740961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516935, "uuid": "8c64eb7f-b479-493e-a0d2-f4e0e5bbc7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516935, "uuid": "72e1159c-9920-4724-bd46-29258652a016", "value": "di8_setup_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868fb003-b24a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761469360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469360, "uuid": "9789fbd1-d25c-4a84-908d-86a7a736d6b9", "comment": "Malware payload (Mirai)", "value": "4f14193412c241508c3dbc56438d7907", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469360, "uuid": "a4dfa3e5-8bbc-4b2f-b957-02a42a57ffaf", "comment": "Malware payload (Mirai)", "value": "e6c1b01d13a516eb17974b9ef423ba625c65e8121c6ddf10f53a8723a92d0b0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469360, "uuid": "99e998da-c57e-4b23-8d2f-56853176216c", "comment": "Malware payload (Mirai)", "value": "c4fd6f97f4bf39a21656f9611c2ba3e103da3312", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761469360, "uuid": "5d3da921-0d06-447b-8f50-0d3b4b816340", "comment": "Malware payload (Mirai)", "value": "c2a96d7d926a58f7641938764f6b13dade145354ecbec798aff69216732f180ffcf239287bcb1fce1b096302107f5324", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469360, "uuid": "ed6b05f7-5e8b-49cb-8903-383c73cf7993", "value": "T19C04D916AB550FBBDCAFCD3706E90B0139CCA44722A93B363678D524F54B54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469360, "uuid": "eb1fc34a-b328-4ef5-844d-33e85d92ff77", "value": "3072:cYhJ9ZfwiS+YVNCsemnqX3PeAiUguxtmbmb:cqJPfR/Y2sEXfeJn/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761469360, "uuid": "e8bbce6d-ec07-4d80-8fa2-2a9e7649623e", "value": 182040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761469360, "uuid": "bd4f50e0-87b6-433b-8c98-4ee0b9f87612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761469360, "uuid": "989bc1b9-09c9-4917-a422-b85b443c4954", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abfe5ee-b2b1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761513498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513498, "uuid": "3eda02cf-ef7f-43d4-85d2-55fea15ba0e1", "comment": "Malware payload", "value": "2b5b77caaf1916a52599cb936c7736b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513498, "uuid": "403ca223-bea7-421b-b530-2c33a4ca011c", "comment": "Malware payload", "value": "e8374c24ce9d58bd6e96aad2131de32504b93fcd222e29b4838349270a324438", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513498, "uuid": "249f3642-4c58-44e7-b4c3-73c36ccec004", "comment": "Malware payload", "value": "76082f2523a34c2dfc27404e0ee82dd777330716", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513498, "uuid": "7f5af162-96d2-4d03-9a1b-6333a4fee50f", "comment": "Malware payload", "value": "df1dff20faffecffaa17e869e007e90f68da2d2779b80a98d4715ec982efa1dfc962b571182129fa37a7da0a64fec23d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513498, "uuid": "b21454a7-d042-46fe-a704-a5e0066c4dfd", "value": "T145F5C286B9A0C675C057D23588B751417A75B878073732C3EAD376B8EABE7E82B35304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513498, "uuid": "dc8a174e-ef0a-445d-8ed4-753d4db534a1", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513498, "uuid": "843d726a-1a2c-4b16-9e90-dba9a6359307", "value": "49152:E8D1n1KgRTNFyGgXyh2JbAbhLLw9uY3H8xO:EM3Fmih2JbehAT8xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761513498, "uuid": "68469afc-5028-42df-ad77-a10f52538625", "value": 3331463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761513498, "uuid": "2785242b-2f79-4bb4-9948-872cbe88f68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513498, "uuid": "5a2601fd-f88a-48df-9386-9c2b243acfea", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857f7830-b2bb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761517891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517891, "uuid": "8b3a13e8-be33-476c-abf8-c8a6be7ceb8e", "comment": "Malware payload (Mirai)", "value": "806bc1a2bc3d67b5f1ada8a3e394ac41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517891, "uuid": "cf800f5a-ba8c-4023-a766-93135c953afd", "comment": "Malware payload (Mirai)", "value": "e92aed6d7e526d70dc68736244b15ff4fd856503fc02c4cdf9ae61facd846f8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517891, "uuid": "b8973f4c-d07f-439a-ac4f-c5d3dc86b370", "comment": "Malware payload (Mirai)", "value": "2d107cb0f3dc6143ad7f701284004c0d85fe34cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761517891, "uuid": "94f25c96-b331-44a2-96fb-dd4f0b3ea2a3", "comment": "Malware payload (Mirai)", "value": "54599c035dc9d94c4b7ba2d20ac18765b3162ba02a8b5d19613e13196f05d749c6c62ba0bad37ffa737b998aa271d48e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517891, "uuid": "fc0c68f0-6553-47af-82d3-b30bcc8a0ff0", "value": "T1E4933B56FD815711D9C015BAFA1D114E33131BB8E3EEB3629E24AB30638A66B0F3F546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517891, "uuid": "322f334c-3132-4fd8-bc36-33861ed1b88b", "value": "1536:B4nuwcB/WtowtyQGwazwhitbcY8qHBa72pE4KmdPiKecuJXGn7Y85/YIjXema:9eywtBGwazP/8qHBa7SecuJXGnM8Js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761517891, "uuid": "132941bf-76dd-48ea-a330-4c0fd97c0096", "value": 95620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761517891, "uuid": "6e7a6862-fa57-4c1f-8e57-d869ac75d76a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761517891, "uuid": "d13bf45a-3767-4376-af1e-87ef61e14cf7", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbc817b-b28b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497289, "uuid": "0599bf2b-0fb9-472d-a086-4378a78321c1", "comment": "Malware payload", "value": "06e0c9cd4b0ae1e043d01dccf4015f32", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497289, "uuid": "83b89634-af66-417b-adf8-93ac79c0ef9e", "comment": "Malware payload", "value": "ea36101d6c5102fec766a5437479a8606a6926633caeea88b55bca1e33b5d6a9", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497289, "uuid": "d557bce0-d144-4ffe-9e88-e814e73844c7", "comment": "Malware payload", "value": "90fe16693ae5c3efda70e37b52d11cadf894b349", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497289, "uuid": "e26783a1-0a22-41e4-97df-03d92219c45c", "comment": "Malware payload", "value": "b9ccc91c71d3892296c957c119104f4628bdb3979219dc04ebf07e5f503f8f57a2bb49b2fd53b992e7ffae5aeceed23a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497289, "uuid": "3d3965bc-d364-4f71-8b08-67dba304b3e8", "value": "T1A8E1511836019265A1762B3CCDD3981DFF3A007B11655208B4CD52D06FB6A6FE6F8F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497289, "uuid": "891d6ed6-ed21-4255-8ad0-e2a1fb278720", "value": "96:s8z6C6fasnRZ8gimZYkRxw4NQPLhwHg4A39/2l6eX8I7gdo4ikN7rUL6cyvoz:sHZJivkRxozhwHgTxoD7gdqkN77bAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497289, "uuid": "602f17a0-804c-4687-83c2-bf99f27c3215", "value": 6785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497289, "uuid": "420f2c39-28c6-4c6b-bc49-4d8e7f188f0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497289, "uuid": "0bf1dbf5-a54a-442a-ae2d-8c289b3bfc30", "value": "auj60xfe0vydxmu.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31efa02-b2b0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761513297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513297, "uuid": "a9fffb93-222f-408a-aab4-693af0a9bac4", "comment": "Malware payload", "value": "9d7dc6c5d833fcf6b68c02504a73ef64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513297, "uuid": "33e99054-e2a4-4e0e-909c-761b10485e2f", "comment": "Malware payload", "value": "ea9f63b2c579cee274efd8a346508ebb4976b6056f6f5d11815cafd8c1474343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513297, "uuid": "cd476cfc-9032-41b6-8150-6fbdced68683", "comment": "Malware payload", "value": "579fac20b7494409081dfaf0d9bd390fff706c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761513297, "uuid": "def183df-cb6b-4489-859d-aa29d836ff64", "comment": "Malware payload", "value": "464fa1560eccd548eaed45d93ee45afbb984f6c2405bcb5d15b5e7680a8ee3666352a8b2114ea09b86be4c6664aa8c55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513297, "uuid": "6c79c4f4-3b81-407a-bebd-fcf622f2b78a", "value": "T18B062947A8A00475C775563486A251A23625FC670B3323F3FA94BE392AFEFF04976B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513297, "uuid": "d2418b81-d32f-4677-a353-14ce61c44a8c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513297, "uuid": "5ee5f75a-7fb4-450c-aef9-fc6e05515d05", "value": "49152:4bBPweZH+fZKlXZu5RugVvAB1k07gM2VtG75:4CmJujugl07gM2VtG75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761513297, "uuid": "dbb9ff4f-e92f-49b5-a5e0-64b51a391dd8", "value": 3800488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761513297, "uuid": "1a6ccb82-f230-44db-a534-06e527a48526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761513297, "uuid": "a79cdf25-af64-4154-b323-c89bb418d977", "value": "KiddonsModMenu_v1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b04713-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761516999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516999, "uuid": "896b7eee-7b82-486b-bdba-4b2b24107bbd", "comment": "Malware payload (AsyncRAT)", "value": "627fed14a62cdeb89fb8520edd9f162e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516999, "uuid": "f410be09-1314-4278-9cb6-c23696a9d712", "comment": "Malware payload (AsyncRAT)", "value": "eaebdc155633a11d0022f2b8adc28bbcfebbf60613166fd1c2fa0589295eeef3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516999, "uuid": "995373d1-12f4-46e0-ba62-3c9f8d3adb9f", "comment": "Malware payload (AsyncRAT)", "value": "b033d4a03ae206c289659b760cc5184d8b856921", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516999, "uuid": "41365cfd-e981-4176-8a3e-9779334e3573", "comment": "Malware payload (AsyncRAT)", "value": "8327e7280c4cb1bf85fc46ef474cb1513e31cc0eef18c65306556074498dd127cd0d4c8b0039eb28387f8a4923fb90e7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516999, "uuid": "fb69c711-babf-4fcf-bb39-ca8a728f5197", "value": "T15FD25E3CEE63459F316589D2E8E400C798BD37DA760E6BCD0985A3F5071390EA86AC1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516999, "uuid": "939a7e45-25c4-41b9-a200-bf43714ab1a9", "value": "768:RPFuq8qF3nwErOCWEyXNMjvAOG+5v9bdbasWyYEVN:dE+5v9bdesWyYEVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516999, "uuid": "65c83263-253f-4564-8e8b-1acae6b6b937", "value": 28416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516999, "uuid": "938a0335-a6b7-44d9-8878-fbe14d33499b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516999, "uuid": "41c2c433-352d-40a1-a161-635058e60cdc", "value": "3_1515Vcontainer_crypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692166bb-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761497657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497657, "uuid": "7e923ff3-2c11-458a-9d2e-51b79ccd81f2", "comment": "Malware payload (Mirai)", "value": "b032e66bb14e96654a9cbffc0761b7ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497657, "uuid": "775b3b8f-9c97-4c5c-8342-bfced7896478", "comment": "Malware payload (Mirai)", "value": "eaf09e686a80a943ee34abadef65f06cb165ad107160ef626aa079682e276612", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497657, "uuid": "77dcee47-af51-4290-932b-bb3e2f0ab9a3", "comment": "Malware payload (Mirai)", "value": "1f80b1e47c163dcfdc2bdc2f855113104214947e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497657, "uuid": "b1a6a232-0413-479e-a830-d97a7d82bb36", "comment": "Malware payload (Mirai)", "value": "0d072668b45a0d9c339e65315f667520721c6b27a65e4fcf13a99ece333d9526a9cae9fdb0ad00187f545b0ffb350c38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497657, "uuid": "0ac018bc-4db6-4985-b8d6-0c4d2a011c81", "value": "T155932B56FD815B11D9C1157AFA1D124E33131BB8E3EE73628E24AB30638A67B0E3F546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497657, "uuid": "923e536b-9b62-4638-8484-58f7e5c5706e", "value": "1536:qznRja3cMKMG8sM4bQbMfVesNyyPafyo14/Wdaih8MoaVes7N85nYfzw4ema:9MYG8j4bQbMDyyPafD8jaVesp8B8wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497657, "uuid": "aeeebabd-8fcd-4306-9ad8-e906df09f44c", "value": 94304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497657, "uuid": "6d12a08b-3c65-4ecc-a659-803388c10439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497657, "uuid": "dd2ea45c-fa91-4eab-b524-385319893664", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5740b263-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1761497627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497627, "uuid": "5264359c-83d0-4f94-9b77-f4aecef16e5b", "comment": "Malware payload (AsyncRAT)", "value": "f83ac7fee0584fd517dfcc333ad5f6fa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497627, "uuid": "9eb26fc3-b5c1-409f-bb24-f554e28030fa", "comment": "Malware payload (AsyncRAT)", "value": "eaf0cc301ae124b8a2b966a9496e02466390f1557c1dfbfe26da8ffcb3df996c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497627, "uuid": "e3e35a9e-4148-451c-b181-def6ee1027ba", "comment": "Malware payload (AsyncRAT)", "value": "dde7fd97be9a07f5c32f247aa2bf73d65a9f7159", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497627, "uuid": "f85adc72-3621-487c-ac9f-afc84cebad5d", "comment": "Malware payload (AsyncRAT)", "value": "01bcde9feb532c0383d24f77d75ae4bd89e03136954ae61ae6023cdaca147b9fe46d2ac9e026757b0658311b1efbd306", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497627, "uuid": "d991cc99-b179-43f1-ac7f-566178ce6cb2", "value": "T16F3616191274FE19750C0EBE5492A82FA65DE8CD9C7F4CDE1188E3362B5F90C8948BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497627, "uuid": "bc8b5e14-0400-4301-92b8-ea7bad295b44", "value": "768:rhgxAxhgxhgxhgxhgxhgxhgxhgxhAxhghxhgxAxhgxhgxhgxhgxhgxhgxhgxhAxS:eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497627, "uuid": "9e84b736-2123-4654-a68f-4b32a27e3911", "value": 4867280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497627, "uuid": "73c01611-f02b-489f-b551-cc8e3f7e4c1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497627, "uuid": "ea868bcb-2992-49cb-952a-3937a69f6af0", "value": "sostener1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c4ef6e-b218-11f0-91c6-42010a9c0006", "comment": "Malware payload (Joker)", "timestamp": 1761447697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761447697, "uuid": "84966df0-fdca-425c-b45c-5b11d27b5360", "comment": "Malware payload (Joker)", "value": "bb4efe77361b980675075c0d2ac394ec", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761447697, "uuid": "c556be49-37a5-4c72-9b56-2a1d3e2e207a", "comment": "Malware payload (Joker)", "value": "eb538d6985cc16762687ac1a9cae7579ffd1485c9b201dcab43b1e34a1e96549", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761447697, "uuid": "40889744-8e51-41e2-9c7d-e0c229659587", "comment": "Malware payload (Joker)", "value": "b1410dd91fece4328b1a5e6063d6537a5e61c46c", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761447697, "uuid": "fab443cb-19af-46a1-be26-a8efb238609a", "comment": "Malware payload (Joker)", "value": "3a68192bd0de8243c1279caec42ef05b9b60aa1eb2355ff23fc1d514e9ed8e42f5a5a614b59518c6a4d3d3c8294ab0d9", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761447697, "uuid": "5ffa4be5-1a19-43f7-b80f-34aa2aeaec1d", "value": "T185472209FB0D7A2FDDB7F0385F4A93727825AC65B500968B9901B26CBAF36E54E013D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761447697, "uuid": "c3f09130-afd3-4a81-bb47-860ce0ff2a19", "value": "393216:vdOJ4YPOChPLgXyhmhINTwvq+1iAZUnkyNbvmY92k5m4tsLr/V2EcXLr:vdOJLOCVLvgkxTRv192kHGnt2fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761447697, "uuid": "905cd149-b6d5-4d8b-a98b-fa97f64e1125", "value": 26675114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761447697, "uuid": "24458c3f-4202-47f8-829d-c9827cf98e87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761447697, "uuid": "30c20426-e0b7-4c19-8f28-d058ca16a436", "value": "Fast+AI+Clean_1.7.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3593318b-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499718, "uuid": "0ca1de92-ea41-413f-9f2c-46cf00395c1e", "comment": "Malware payload (Mirai)", "value": "6b9efd3fabd63b8f511efc449db317ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499718, "uuid": "24f78456-9825-4e4c-8b96-2a288dd4e704", "comment": "Malware payload (Mirai)", "value": "ee35d11bc656c7e9d032b217b9db45631c5a962bf736d9fbef55bfb56d21e373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499718, "uuid": "89926a89-8c3d-45e5-863a-3ab4675134cc", "comment": "Malware payload (Mirai)", "value": "e2e84f0de421bff436a9c3db8a23bb693199f812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499718, "uuid": "bca1529a-1559-4808-b387-42f42d4ddbf8", "comment": "Malware payload (Mirai)", "value": "fc7cd7908f01b5b9384cb2a752ac8015c814bef0a14ee2a18b01aafba506bde1fac83ed0ce82c8a3d5c2cab6f80faf23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499718, "uuid": "605c31f5-490a-4134-ac6a-d61e6b34f251", "value": "T1EC731A42B31C0947D1A35EB03A3B17E1D7AFAE8121E4E748350FBB49D1B1E36954AEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499718, "uuid": "8c5db4c4-9734-4558-a471-bdfe34bc25ce", "value": "1536:lWYmMxlj8c0UI5MP4fyZQZ2SuWt0eTpgQky54UiBQC6CK6dSZG0pjC:lWR6louwGCky54UiCLnFxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499718, "uuid": "bbdc1878-650e-40a2-bdec-deadf7e45b10", "value": 79304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499718, "uuid": "989acacf-b30c-4842-a557-47d91276d533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499718, "uuid": "75b7954d-2032-4c01-bc43-6ed1f3d632c4", "value": "kvariant.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa43c30-b275-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761487709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761487709, "uuid": "06522bcb-114d-44ba-849b-9c2caea1e660", "comment": "Malware payload (Mirai)", "value": "8d2fac889bbc420350c456f70d78cedc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761487709, "uuid": "3530392d-bd0f-466b-bbb0-2e42f0283544", "comment": "Malware payload (Mirai)", "value": "f23af96e9f6782188937419070b4dc24c84a22fe42541a76ffe941d0869cc8bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761487709, "uuid": "a502983a-6123-4e50-a11f-dd87ed7cecd4", "comment": "Malware payload (Mirai)", "value": "854fe61f2cc0f09f79e41bc77116042078bcb253", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761487709, "uuid": "add5d56a-92cf-4b2c-a4d9-44718a9729be", "comment": "Malware payload (Mirai)", "value": "288d1679c105c07e4155806748745db9c4057143a83ea2a15929b95467f9c42ca320fa9c45b60ac98c6f0f3b8047d176", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761487709, "uuid": "c63eefbd-68d7-4d59-8f42-b6585e2883f6", "value": "T18F931956FD819B11D9C125BAFE0D114E3323177CE3EE72129E24AF31678A56B0E3E906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761487709, "uuid": "c66536b6-188e-4dc6-ae36-8899d0260c8a", "value": "1536:B/YnQYXT/Uy+T6xzbCNWBE7uvuEqabUhbu4pjdaig6s/7/I7ry5pYLzlema:BYzU32xbCwuEqabb6s/7/Inyrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761487709, "uuid": "ef49885f-9a84-4d3a-9b2c-a474349ccd6f", "value": 91524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761487709, "uuid": "7e5e02f7-31e0-43cb-81af-97786b8edc5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761487709, "uuid": "4fa2bc17-05be-45d4-936b-ee8c6467bdd0", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44876d4a-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518641, "uuid": "16f5c16c-8725-4ebd-8f7d-b5ca25e099b9", "comment": "Malware payload (Mirai)", "value": "0721a4af78af4b8ef7e9cc760a7c48f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518641, "uuid": "af765354-9bbb-4cde-a1fc-1e2a75ae29df", "comment": "Malware payload (Mirai)", "value": "f29bea572d172174e525c30022f323888739f8ff4099f202461599efce3ad3a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518641, "uuid": "abbf44b8-56f4-4a30-9696-5d8431238d9c", "comment": "Malware payload (Mirai)", "value": "97f68917c699e2e29b20b7d4f9783271985bdbd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518641, "uuid": "6cfcc18a-7958-41b6-a975-9e2dec5a5b86", "comment": "Malware payload (Mirai)", "value": "86c8121e1c4d95a84e31162ddb6d460d52615723ebfc1af2f3cf615ea5d18df52e9b7964813dd803673ae809db9e8933", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518641, "uuid": "3f9d2440-b561-40cd-8199-55bb8ebf84b5", "value": "T12D13E10AEEAB6B51E10CC2386777620D58215DA522C6127B1780A436DDFA7397F2CDCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518641, "uuid": "4ef8e931-f482-4597-9425-6a5be1fef3c1", "value": "768:NesQQWeGUyEqbL/omRveqwPmthTe/MxKvivzMvnEfBnbcuyD7UHQRjW:ksQQWJflJeOHTe0xFU+Bnouy8Hyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518641, "uuid": "9016da10-d9e7-44f0-a03f-bffc09c7dcd2", "value": 42996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518641, "uuid": "0109d6cb-1610-49c5-aaf4-045bd1bfb3e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518641, "uuid": "8924aa11-559e-432b-a16a-bacdda314340", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559d6fda-b28c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761497625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497625, "uuid": "d45bf167-8f33-4785-9f85-dc9ccbf28346", "comment": "Malware payload", "value": "7339d721dde53699b3cea3b60992bfaf", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497625, "uuid": "3472dd55-514b-4479-93f8-7692f4f203f4", "comment": "Malware payload", "value": "f2a9fc32c7237ba4fc66361b45744e46a2a29dafb4435b7644f987592d6d14b0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497625, "uuid": "fa3d9a61-9ed6-4b5d-8ca0-e0fe673ab4d7", "comment": "Malware payload", "value": "86848dda5193633222dae4e64544f81263d71c3f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761497625, "uuid": "cade0f45-782d-47bc-8330-d0af6c05abd7", "comment": "Malware payload", "value": "7b00e69b066279fda23eecb9a41bec3b4ade6c5234e905203181a7c5c2dcb3aa2c7378374cb87e71326090dc6ff29be8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497625, "uuid": "4ff7f39b-04ec-4114-a958-20f61723035b", "value": "T1F6C01201D52DC35A5DDBC97A81B141144FEA650512015A2167309D1876441F8C3BA193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497625, "uuid": "e667c07f-99f6-4027-830a-aaef071a7ac1", "value": "3:jaPFEm8nmmIIE1FeKSSJJLNy1oM3KbQqPJH0cVERSHmRPaHF5wVBE/UGqQQR2EEy:j6NqaIE2KBny1R3KbQO0cA1aH4E/ULjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761497625, "uuid": "10400ada-048f-42af-921b-64f2833f0236", "value": 190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761497625, "uuid": "784b5d76-3781-4c4c-93f7-562dd181b69b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761497625, "uuid": "31111611-bbcf-4bc3-b806-ef88989eb1f3", "value": "Update.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc71b38d-b229-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761455331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761455331, "uuid": "5853f03f-bd0d-472d-83de-cc08337aef4c", "comment": "Malware payload (Mirai)", "value": "4dd05622bebb6c4176eb24862c80b322", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761455331, "uuid": "18b9bb45-e8c5-4047-ad0b-f5bb234d85eb", "comment": "Malware payload (Mirai)", "value": "f2cc4b87ce96d79f73365cfd237f7315c01de55947e4480792f4fdaf7d5d8baa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761455331, "uuid": "5729a026-8327-4310-825f-d39300a6b44a", "comment": "Malware payload (Mirai)", "value": "5c4e06f773ab7e829dfa987918f1b3ca68b37b6c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761455331, "uuid": "242cbdc3-2953-4283-8db2-c65d566dcb34", "comment": "Malware payload (Mirai)", "value": "1a3b89423b8c8d5478ebe02f9a75e3a469cc4f4767ef0b0d7195f6f7e3cfbb54a4cb371adfd3cc1f4a0bc8c452989779", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761455331, "uuid": "47316f06-426f-4386-9c72-03480f8afc4f", "value": "T1EBD1658F11458731DF09CB4E77F47234920FA1D2BACBDB94B994482D4FC6D8C6685EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761455331, "uuid": "d4ced884-77b7-49a1-a0d1-abec963a415d", "value": "96:ZVdGRURlR2JMgOabiB6FuZK+GRKTgEbwW:SFuZEEbwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761455331, "uuid": "e7d04c0e-3ca0-46d7-a47e-7a7167d130bb", "value": 6282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761455331, "uuid": "5e9253a9-3bc9-438b-922f-801c11ff0b39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761455331, "uuid": "ad2fba80-34ca-4554-a378-86ec7da49dab", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ec93d7-b2bf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761519716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519716, "uuid": "b86697e3-bb8a-433d-8083-6b67f1d23ae6", "comment": "Malware payload (Mirai)", "value": "faf275de4c5e015747c2d1d11eb151bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519716, "uuid": "7fff3fbb-9cfb-4656-8f48-bb3c1e2eb7db", "comment": "Malware payload (Mirai)", "value": "f3cb97f6f17314b73abd7d2b07d08c555a41c18198aa1f975fbaba78a5f38c43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519716, "uuid": "6e4230d8-b68f-4f33-847b-6d7b93430eff", "comment": "Malware payload (Mirai)", "value": "2bbb06f393389d74879badcee8d66a625d716399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761519716, "uuid": "804c68fc-6b2f-422a-ad3a-bfbb4602ca10", "comment": "Malware payload (Mirai)", "value": "3caf5341a3c853ce0c0a251acc4943be2170bb275b21adc3507cc57b6e9b9e7393067d12d4e6114108064923d68bd95e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519716, "uuid": "51aaac1e-bf9e-4eba-97bf-d8dc55c12a36", "value": "T10E03F2A817114ED6D38A80B816E583546EA40F970093BD9DF7F7FBC3EC4E0A4D5468E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519716, "uuid": "b5518921-9054-41f7-9cb2-6a2af3c36069", "value": "768:qvPYk/J6ougy1pn3d/q4AlKm1PQAAGqOKl0DSqT/3Z6JgGlzDpbuR1JcG:qvgk/E31pntC4i1lqOKfqLgVJuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761519716, "uuid": "43cbdab8-5578-4986-b6b1-2bf000724cbd", "value": 41144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761519716, "uuid": "b8934c95-0fd5-497a-94ab-e9e1b90869dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761519716, "uuid": "40ba7f19-d6f2-4e77-98b8-ade0aab6e9f4", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6154dc02-b2bd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761518689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518689, "uuid": "24c4bca1-ba28-4d9e-b49c-f4dff305c84d", "comment": "Malware payload (Mirai)", "value": "c95ab357acee0abe804a1578c8313ce1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518689, "uuid": "ca3fedd0-8348-49e7-851c-0394dfa6b5ab", "comment": "Malware payload (Mirai)", "value": "f4c871020e9a95da6f3561c2e71653d79f3459ca466ae4d628d0dc4a95b2baaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518689, "uuid": "b892a383-c6b7-4551-8a0e-db4fdd66580d", "comment": "Malware payload (Mirai)", "value": "794fc57696279e90a129e03ca91cdb1c9d4f9c80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761518689, "uuid": "88bdffbc-38d8-4746-8eb8-4acad34a1951", "comment": "Malware payload (Mirai)", "value": "212574673b303b862d7fa648908b698a423f980eb178dd5106ed17073a5bc68449dab9c335fbd57b2fafefc64160ddd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518689, "uuid": "1743e9b2-559d-4044-ba11-ff4cdc5aaae2", "value": "T1306309C2B8C2891AC1D0637FA76F759D3361F3D0D2CA3517E8970B11338669A0F66B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518689, "uuid": "2bf7c973-ebbf-4009-987e-7bb5713ef957", "value": "1536:/bv1NDdCINseVcFZkzncEPnbVuNVMbMb6k:/bv1NDTWetpuZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761518689, "uuid": "37509de4-6f1b-4a12-befc-4c8ed9dcf6e2", "value": 68488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761518689, "uuid": "e6d3ab57-192a-4cfc-8714-b6562da4177c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761518689, "uuid": "275c6099-462f-481e-898a-311ca9f861c7", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338f3b2a-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499715, "uuid": "1a82464e-2e00-4c3c-91d4-d294e4f78c12", "comment": "Malware payload (Mirai)", "value": "c2fe24e1669c8397c28f939320ab4f8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499715, "uuid": "7a6549b8-b1fb-47c8-bccd-30bf4109fe5c", "comment": "Malware payload (Mirai)", "value": "f7202643e713c63237b49425ae1d95d28a89be3ae28f58c29fee684e7f905cb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499715, "uuid": "513d44a1-ad15-490e-85bb-28d6fd34ceb0", "comment": "Malware payload (Mirai)", "value": "061d7497c33f8abe4d10c36f5b3311d7070f0fc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499715, "uuid": "58137185-be05-4e44-8460-98baf0b8b66c", "comment": "Malware payload (Mirai)", "value": "7cdd40a23474490cc3de0260df38d11c99e3cdd4900e412bf8682d99f3a576e347b225637f674ba768a9ba8118c171b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499715, "uuid": "b3eb5ac2-992e-4ccb-a0c2-004bb230737c", "value": "T159934AD7FC00ED7EF80DD73B4453490AB230A3A11A832A766247747BED3A1985967F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499715, "uuid": "a3018d95-bb41-4157-8a86-b0cdffacb5c8", "value": "1536:1aseTpSPNFZKN8N6vCK+oSzycwJntxOh503vn7fF/nTYgSjvVQxgq6:8sfFZK5CnoMycwJOhCfJMgSjvueq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499715, "uuid": "aa9d6b58-45bd-44c8-86a5-9ca42e2e77bb", "value": 90568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499715, "uuid": "031a726a-73e5-4c9f-8515-f490b1d4b4a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499715, "uuid": "50aec3df-cc8a-4229-aa69-ecee9d65dee5", "value": "kvariant.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f29874-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761516917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516917, "uuid": "195ccc93-a6f2-4d35-b2a3-f7a6a265ebb8", "comment": "Malware payload", "value": "187e6746f347ee2a8372a5ba991ad58d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516917, "uuid": "38de621b-2501-4a06-8787-6d0b6c170c76", "comment": "Malware payload", "value": "f985ab3cd12c5abf919ceb61a40444cf072cf2ed5ec41698d3ba15fbb888d908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516917, "uuid": "efdf8ec5-253b-4cf3-bdc7-aac37917af63", "comment": "Malware payload", "value": "6f38db7f95285c9d184c2d501c746b44ab36eae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516917, "uuid": "7bab9e03-d05a-47ba-871a-870164845494", "comment": "Malware payload", "value": "3bf83065d40ad700eaa63fd85a000f8af246917355673456b2b13a505f08beadd0f75537a5c78a2d245d3e17c356741a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516917, "uuid": "2681c6c0-f770-4d1c-91bc-cd74c68d2aa1", "value": "T17F46332423ED6F84DA49B57808D120976F45F22D415C68CFDC5A0FFF650929A82FAEF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516917, "uuid": "ce6c8bd2-7679-4f64-9167-d6c80a82e73f", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516917, "uuid": "e9d7ae7a-0b15-41af-a107-eb7f7b2db09c", "value": "98304:LQzBeg4YirncJODfpi5Sl69Q6OJ9APpuau69AJnEQOXp9GII4S1eqdQuU1m:kBVgXDfpXICJGoWUE3pYX4keqdQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516917, "uuid": "ca79dab7-9f79-4b1d-bade-63e37aea672a", "value": 5384208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516917, "uuid": "2db6034e-ce50-43ae-ac16-6b96ead1a87e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516917, "uuid": "ae27ef4f-8944-418d-aae3-7720185e68d7", "value": "111_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f405469-b2b9-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1761516995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516995, "uuid": "ed580fec-9aa4-4962-af46-3da70ca49c87", "comment": "Malware payload (QuasarRAT)", "value": "f4cc54763cbf0494510742590b799d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516995, "uuid": "bb105518-8a99-4e6e-bf54-67a3416c7809", "comment": "Malware payload (QuasarRAT)", "value": "fa22249ff51657484072c83e53e154212f12d7659a44feb49e16982dd4ebf552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516995, "uuid": "95954d7e-4cf0-41a8-9912-8befb78e1c24", "comment": "Malware payload (QuasarRAT)", "value": "150e895fbf2085222dd76c2ef6595a4b04be1761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761516995, "uuid": "b9a409b5-d7e2-41a8-9335-8aeb22acfb67", "comment": "Malware payload (QuasarRAT)", "value": "2d319c2e71ba36b8c1c27060ccc81e7d33dab78ed497363df32ca601cd89a8632035e5e2205c7463389cec6c49a7bf0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516995, "uuid": "f24337ed-b220-4857-a042-d162bfc274e2", "value": "T16C188D4253AA09D5EAFBEA3485E65D03D773FC062B3881CF72481B261F336E09976B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516995, "uuid": "76539141-cf6a-4b65-912a-44dc546249c4", "value": "00097805748014a0566196bbe0e1e104", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516995, "uuid": "1bbb8342-348a-4246-ad59-a4099cc12b16", "value": "393216:CQ4X85BIoQkg6NJXjN/yNDyAV5qWEpgC7WsZtR2RKrkcN9TZLQcgMek3XReVz/bB:Ch1UMqWKTe1HDb2HbUpnf8RRtgPdBsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761516995, "uuid": "7ee8b668-4a64-48f0-9016-4503e927a390", "value": 87252480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761516995, "uuid": "7d75318a-7899-44ae-9797-a986e14124cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761516995, "uuid": "0628f3e7-48fc-46b6-80b6-09daa7c642a7", "value": "42x9ht_aporia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1e7328-b289-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1761496290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496290, "uuid": "74f2299b-98a1-4b90-a7eb-cc3473441ad4", "comment": "Malware payload (Rhadamanthys)", "value": "11cc32b6c1b758675c857544b6e73292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496290, "uuid": "dca9ec0e-15d7-4645-9013-0e1d2cb6f3dd", "comment": "Malware payload (Rhadamanthys)", "value": "fd50841bd9c2bb0e7cd21f2b841661ea86f4b5b5c980b0ec06598359032d9271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496290, "uuid": "6dc1393b-353a-4a9c-b6fb-d8beb2f7d3a0", "comment": "Malware payload (Rhadamanthys)", "value": "5685157bc6ffdf388c37827d33a9730f0fbc2121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761496290, "uuid": "fbe15944-bd17-4cf0-8bd0-32ea61c23adb", "comment": "Malware payload (Rhadamanthys)", "value": "f49b1dc138338415fe8bdeedeb42a5669dcc3fb5656f3f72a4276bd2ff45dc3d00f8f8db9e1b80bb2f27405a9d6e2fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496290, "uuid": "c4dbfccc-fa9a-4796-8464-451fa73d3352", "value": "T108953337CE78358DCF8B1A7D9C6B91501A2D752411E826C9009F13B81F6BED673BAC68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496290, "uuid": "5c3b8427-003a-4a23-9112-a9f99e2a5319", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496290, "uuid": "4b293b7a-7e4f-4129-83bb-f1efd6812d44", "value": "49152:aha6kQvRfDf55tdv4DdgjnNne9+5/G7xnYIoK/uIV3n7:caPCTt2snBec5axYIxui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761496290, "uuid": "07af332a-721c-4647-a4b2-74fc4c9df711", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761496290, "uuid": "df8b0e26-cd33-4aeb-a691-16c91c0ab5f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761496290, "uuid": "2de7ace9-f4ce-4a52-be61-c9bc94db3a7a", "value": "fd50841bd9c2bb0e7cd21f2b841661ea86f4b5b5c980b0ec06598359032d9271.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38446c39-b291-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761499723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499723, "uuid": "a84fae77-24d4-4491-a262-ed03c2723ca7", "comment": "Malware payload (Mirai)", "value": "e396867c481117d9b9add5c05a309285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499723, "uuid": "0e097edb-3888-4cf8-af2d-1d1d5101f122", "comment": "Malware payload (Mirai)", "value": "fdf7e9487262714fce82021b5bcc751fa70f86c8a8e7e6e3c6ab5303a8ed6d1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499723, "uuid": "d4520bcd-363b-4f1a-9a84-c4037905698d", "comment": "Malware payload (Mirai)", "value": "391f8a14333f9251c68cd85f2b7cdc80f9b4dfae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761499723, "uuid": "b6a6f842-13a9-4aba-af7a-1a9ba143fbae", "comment": "Malware payload (Mirai)", "value": "c6e59043000794b457ec258be04e63f74fa044dc66a4a8f81c798b64247c6e1f1a0e7d9fa92a97c25f9507b0778ab55e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499723, "uuid": "5c63b484-2eae-4005-b8ea-7ee0daca755f", "value": "T1F5835B32BA79192BC4C4647A62F74321F2B6478A14FCCA1A7D720D8EBF6461036177F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499723, "uuid": "7d543dec-51c6-4e91-9312-b46cee72265b", "value": "1536:5U0PeyjJDHxYyHXjvDT5WyrutMBrOvt6dLfy:5zxYQX7DNWIBUYV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761499723, "uuid": "058391f8-6f82-4253-8bdf-ff9fd97da36e", "value": 86132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761499723, "uuid": "01402b00-af20-4c4c-a60a-e979357346b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761499723, "uuid": "bdca72be-9024-4b12-9fc3-020a04485cac", "value": "kvariant.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43da1cc-b2c4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761521862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521862, "uuid": "fed1b104-525b-46d4-a1ed-115a4d3f6077", "comment": "Malware payload (Mirai)", "value": "a1d0af6e4f10267d0a2e34f7f817d416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521862, "uuid": "a411a16c-278c-4116-b231-09153c9d9618", "comment": "Malware payload (Mirai)", "value": "fe806e894a9e8a7b5632cc2bebb52661f467b6f1642ee24ec973e017581c3e86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521862, "uuid": "d111a1ef-ae29-4a9f-aadf-da6e050365cb", "comment": "Malware payload (Mirai)", "value": "b264fabffdb1c448303cbe2c7ed502ec3fbd5174", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761521862, "uuid": "d520605a-7770-449e-8be7-a21e039bbad1", "comment": "Malware payload (Mirai)", "value": "d2fc08a44de77b3b0820119d2f148857ae5b8fb06e58c6d2dcff602af6ce10fb47520f987518199d67e1eeee6d6e9af2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521862, "uuid": "56e8eab4-36b2-4a74-90b2-2b90580574dd", "value": "T1E1835C52FD419603CAC121B7FB1E428D776753A8D2EA73439D266F60778E91B0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521862, "uuid": "e4638dbe-3193-4852-8070-714f645f4927", "value": "1536:bkKUHhfaj+7CT24NOh8mnITOQ4K8WXg3MiJ4emf:L6hyj+7j4EhxnITQKPXAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761521862, "uuid": "cbcbd36c-fc9b-41e7-a7e9-fe9fa5c39235", "value": 82628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761521862, "uuid": "e8b2b8d3-0901-4964-9d74-2073eb1fe0ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761521862, "uuid": "e1c75ade-f9a2-4e65-91c0-b153d0a9b5e9", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fd3382-b278-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1761488988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488988, "uuid": "b62b6d56-69d0-44b6-b855-b49960fa2c1c", "comment": "Malware payload", "value": "ab7b59678dfc8ace90f9cf2005f4b33f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488988, "uuid": "c01c83b5-3b43-47fd-9ffc-fb049c4c522d", "comment": "Malware payload", "value": "fe9c847e7852c461d11983080ec03596171c84d878e1d000b030571f4286bc4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488988, "uuid": "558ff1ed-69ff-4df3-ac0c-1bb4a9d3330b", "comment": "Malware payload", "value": "e45baa6ad6e1ff74d35383c9cd1e031b700c7f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761488988, "uuid": "5f08cb6e-fd42-493c-939e-94f7fd185ed2", "comment": "Malware payload", "value": "7a8f2d26e8469ec56ec364cf9945d6ee5eb9ac0b99c79b3a35590e0662b2f02bf58f137e5e833a9457d320dad2fafe4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488988, "uuid": "408e96fe-5ab3-4663-84bb-6966206bde1a", "value": "T19CD49E09E29805F9D0EBED78CAD3A906E2753C591F30CA8FD3A715561F273A0BD2A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488988, "uuid": "f2b12910-6e23-42e1-b4b7-f015adad36e6", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488988, "uuid": "d91a62f5-3614-434d-8631-33789b46a44f", "value": "12288:EyveQB/fTHIGaPkKEYzURNAwbAgeZp3y5Me8VYF:EuDXTIGaPhEYzUzA0wv3y5Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761488988, "uuid": "587d14e8-ab5c-4998-b0e4-65602f0176b1", "value": 633166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761488988, "uuid": "cea8b4c5-d3bf-430a-8e29-b5fe7117a9de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761488988, "uuid": "8b04b2f8-c7f3-4263-81cd-27e9923076b3", "value": "MAS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d1a8d4-b286-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761495266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495266, "uuid": "8e782210-eb7c-4f44-8f5f-22de6285f8ef", "comment": "Malware payload (Mirai)", "value": "f27f6870af359d6966aa4b26e04b8fb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495266, "uuid": "ac9a6b26-79c9-4792-8960-7c232fc1cf6a", "comment": "Malware payload (Mirai)", "value": "ff35ec93488c408f30af4c15a0d606ca6b1794452c477dbb8a607b33ea85e9ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495266, "uuid": "658399ab-02bc-4bc9-bb6f-4b128c00a351", "comment": "Malware payload (Mirai)", "value": "25621efc168a081e4c139e310a1c12675e66a1ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761495266, "uuid": "58880105-d2f0-40bd-8fef-770638c13846", "comment": "Malware payload (Mirai)", "value": "7a0351164f8620bd2c9d352c63d5dcaf8ffa5de4d7e7033b88e1259eb9bfa19864c4453953d4d9d7967c51b6e3ee170d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495266, "uuid": "725c16a0-b0ef-43e0-b17c-6e77919b3779", "value": "T1025302F892CD9BF0CB765A7707E7A2C79728CBEDB2502B62F1C09B50A16744E344221D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495266, "uuid": "bb7cc3dc-5d11-45c2-b812-9eede99ab5db", "value": "1536:dX38sCOKwHZ9YIcNIoERS7eamHJpdMdZ7c9nO4u+qgw09y:dX3/zOwqeDHJpecnO4u+qgw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761495266, "uuid": "7784d40e-c0de-448f-8cb0-3f51c94e1d02", "value": 64216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761495266, "uuid": "da4af41a-d8bd-4eaf-8a80-c42d53a3105b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761495266, "uuid": "e32ec22f-45c9-4960-ba7f-ac8b7bf9762e", "value": "Orbt.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83ffbe3-b27e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1761491804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491804, "uuid": "13e19d77-c71a-4748-8859-1f558fc0d937", "comment": "Malware payload (Mirai)", "value": "5a7c7fd936ea06cf226ee8396ac42678", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491804, "uuid": "3c2ffbcd-08e7-4a58-aabd-6bf82ec276d8", "comment": "Malware payload (Mirai)", "value": "fff572b86d39a05d27d3566d4bd0817ff2dd726ffd7d58364ec9bf66d7eada56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491804, "uuid": "9c0b82d8-a407-432d-8ef1-9db09b145e57", "comment": "Malware payload (Mirai)", "value": "0601905fa687b6c6471aa11319f346b978938e60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1761491804, "uuid": "1a5f62d6-3450-4f4e-a0fb-3112c719a665", "comment": "Malware payload (Mirai)", "value": "0f4c49390eb8d70795c099f519c167916c213f45354e0138c46cbe4fdf1601a20003f649f11369c0156d6b3c74cce82d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491804, "uuid": "1b754d6b-3bea-4558-b7d3-ab2ad5dc4730", "value": "T1AE13C495BC824E3AC4D507BEB57E168E332027E792CBB3139D208B613AC560B1D67F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491804, "uuid": "63bd9ce1-5dd2-4cd3-8356-2def0c7fa88d", "value": "768:G4KdtKMHjPXWB75m832gdf6IK63fSG2bhK3yFDt+HBXHLnTFIz/z9UdqJxrp9LYp:SdtKMH+m8YIK62bhKkwHL+TS+79LrZm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1761491804, "uuid": "bbe6611e-d359-4735-b95e-b5f0f9cfc1ab", "value": 44500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1761491804, "uuid": "5196562b-481a-4ca3-996b-d0910545c026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1761491804, "uuid": "36b52c30-f830-457a-a454-eab78763c6c5", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }