{ "Event": { "published": true, "date": "2022-02-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-05", "timestamp": 1644105781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1b234b12-b759-4947-8ee5-8d2fd634ef29", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c67f6d-86b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086688, "uuid": "fc26afaf-88de-4cf4-892c-cdc4c0cefd9a", "comment": "Malware payload", "value": "915aaf9b61f0d62c1fc2082198b324be", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086688, "uuid": "5da8a333-c36f-4b75-a9bd-04eaa4e2c82b", "comment": "Malware payload", "value": "01bdcbeb3175849c7e4c97cd8a0ef6637b56f4af91bcaa9242bb89ada55e01f5", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086688, "uuid": "02491249-e0b9-4744-ab89-5e149a2962b2", "comment": "Malware payload", "value": "e2bf913ffca85e796ecef0564a896625dc748332", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086688, "uuid": "8edf0b16-ba3b-4119-a3a7-bc3c76f6a8e1", "comment": "Malware payload", "value": "862a2d7799807cbeffb9efa662f7d11a630d1229235e9ace1216c4061e680747dd86d5e3618137ac920885b248865a93", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086688, "uuid": "4573b66e-f4c1-4816-a70c-53dccc55e1a8", "value": "T166615425F90E9198997370C275B0AAC9A4F6C0F2A6350DD4AD88CAB7E8B7F4D94300DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086688, "uuid": "fba95618-dc7a-4915-b651-d36b94b42c64", "value": "96:SyA4R0bDkFEONPa1P1DKsYtr0BF7WJdF7WJu:nitiruFqJdFqJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086688, "uuid": "a5a55cd0-985c-4240-bedb-25334b329351", "value": 3255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086688, "uuid": "efbb289c-41a8-4198-b729-0c2ce762db1e", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086688, "uuid": "116b4756-fc60-45eb-843c-8e7b1fbe4b39", "value": "Bother.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12643cf7-8682-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644065375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644065375, "uuid": "c9d62cef-8838-4fdd-a4fa-b9a838ae00cb", "comment": "Malware payload", "value": "e04392eab97032bdf718580783074c94", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644065375, "uuid": "4beb1c33-097b-4138-b525-ffeba7548d29", "comment": "Malware payload", "value": "01e6db709b1ca16d82e320af53482b2411c010e9c73fad6ce6b46db1d239c493", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644065375, "uuid": "25e0f178-416e-4d59-b98b-e23426721617", "comment": "Malware payload", "value": "70ff3be017acfe735da47dd2a6ad478ebf8b4314", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644065375, "uuid": "44a798e3-9496-46ab-b941-3f1dd404d4bc", "comment": "Malware payload", "value": "4a70968cd9e4b3f5caa4660a71224d2197650bee9f34f7f0b062d1c414ee622e54d30ec1a4720d65c68cb4cf9545e9ba", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644065375, "uuid": "897ada2c-7159-42d7-b9ee-7e3b46c8d479", "value": "T1CCF423101319D57EE6AF613880878F50E7260C3563A58DFF5F21E9362BB2368AF84D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644065375, "uuid": "b1108a47-058f-4802-8b84-6d837b13fb2e", "value": "12288:sPZno5Vz7XEc59Dp8FACNqBRjwFZB1gLHzbedNRPu7LjMYZN5q+3ONOBzhhwqAUr:eo5VPUuMvNqBNwrB1gDOu7PpZnp3ONOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644065375, "uuid": "66bf0dba-e0bd-43f9-af2a-afe0cfe06048", "value": 783086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644065375, "uuid": "7431cea8-4a2d-44c4-8930-5b53f31b0ea8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644065375, "uuid": "c4a490b4-d9f7-4476-a828-8a852a7e0fe5", "value": "SecuriteInfo.com.Trojan.GenericKD.38736941.14706.10456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcded41-8698-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644075088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075088, "uuid": "374f88fe-eb9c-4b44-93f3-46b9de565a5d", "comment": "Malware payload", "value": "1f766ea9e592fb25e132e7c956321133", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075088, "uuid": "26d670e7-f72e-4c6e-a980-104f2a2fb28a", "comment": "Malware payload", "value": "0228149fc99d9323a5f2cfe773e1fac2652c043b1e591d4270472b08df7d85e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075088, "uuid": "93732bd7-9f3f-462b-a46e-c7e852974aa2", "comment": "Malware payload", "value": "288d1bedde713c4cd3b52b298027da219c63e8de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075088, "uuid": "f8bf2333-a04e-4c5a-8841-d4b7a2688b48", "comment": "Malware payload", "value": "e5a8b2b7c119f1dcd42bd3e87f88533579e562bdce0335d5c81f2ed3222f047ce5a9cbd470616da3663aa2ae41a92dc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075088, "uuid": "1b6bdbf7-f87b-43c3-8f84-44ce3b1795e2", "value": "T1765633B17E06A524E826C23EDD1A5D7E768BCD65DC9C065C92782C236E3ECB31C1E06D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075088, "uuid": "c1ae4bd4-8b77-4a48-9fe4-f657f9783813", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075088, "uuid": "555f56a2-4772-4675-81d2-fe30e7e69ced", "value": "98304:6YrsO5o7FVVn6l6TyAmgC/l2vIWstC6UhrxiMS+2MZ78lVAR3bAZ89VUS80:pQPV66e5urs06UhwM/MIR3l80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075088, "uuid": "8204dd1c-92cb-46cd-9d32-d4a39b70971d", "value": 5914528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075088, "uuid": "5621cedb-dadc-4efb-9209-325e1f5e9d6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075088, "uuid": "4dfc9c25-2b53-4392-81a2-f179aaadaae0", "value": "1f766ea9e592fb25e132e7c956321133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fa86f8-86b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087708, "uuid": "cf074c8d-ff2d-4266-8a73-504d82d16930", "comment": "Malware payload", "value": "23f6db768eacfa01a352a657acb26c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087708, "uuid": "e118d7f5-8c0d-4a52-963e-db33a0cb8dd2", "comment": "Malware payload", "value": "02ba78586f826a7f6e249c846dadb63466ed101402d59ce763aa148e4713fc54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087708, "uuid": "ca549c88-cc78-4f36-93cf-df105b625bda", "comment": "Malware payload", "value": "bc83ebddddead5521afeefd9e9df47e342f05153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087708, "uuid": "beb76b0a-6703-4264-ace8-53c773f0672a", "comment": "Malware payload", "value": "db77bea25f0ea57de8e046dffe6ab744e3b27810b23fd741a7bb6bc2a070f5e18d8aaefe8ad5a18fe43b06137fa8888e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087708, "uuid": "a4392fab-9a35-49d4-beba-ae55d880602a", "value": "T16DD1758A278099DAE7808F7108C78F31FD7188F2496987064FF46E2E9D763517E1E5A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087708, "uuid": "5414e987-3ab2-4a2b-9dcc-e4dec9088cdf", "value": "186ed1be461a57a0190dd03b6e05f12e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087708, "uuid": "01b29801-43cc-4af9-9954-29f5839ae267", "value": "48:OEPc0mCyexcDPDKIjoFEjgj09jggPVSVipdxXjyBIuVcKQltt:nPjmCUDPDXawY0agN2ipDjyDVcKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087708, "uuid": "111a8e9d-4222-45c0-8750-cd5504b0d6a6", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087708, "uuid": "047e94e7-3457-4d96-8b7b-6e831386c729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087708, "uuid": "0b3ea2e5-6de1-46f2-8046-4484d876b258", "value": "Winmine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d005fd6-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "cd3bce32-ee17-48d1-9bb2-477f57e1c7d5", "comment": "Malware payload (Heodo)", "value": "c46f2bdb5f2b89ca6e672ededc2952dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "45c28bae-73c1-488e-91c0-c4ea8100dc92", "comment": "Malware payload (Heodo)", "value": "03c89c05b11839f4e946e55c6def8eadce20243116d1fa60d3cf1b2cc66bd630", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "923a06a8-afdb-46c6-86d9-1fc428e2ccbf", "comment": "Malware payload (Heodo)", "value": "c98dcbd40888a61d21e4c6ebf5ad48d81d8ce4e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "9c068cf6-aba7-4b0e-8143-a252aa487ed2", "comment": "Malware payload (Heodo)", "value": "32344e9ccee4bc0e1435219b039e4dcccbfb5a82023603539039dbf208ade6dfdca806038971359d413dd8783983e370", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "08b81427-df87-46af-b524-9cea85c45b53", "value": "T13435AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "b637f181-dbc0-424c-9489-abb64bbb0b40", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "47aba4e8-f4f0-4d84-88ed-637928506eed", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTHFIIm2m40:wfv1GVFF+765nFvFf6dlzzSjFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019866, "uuid": "f466619c-8098-49b7-8fb3-0622338d075c", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019866, "uuid": "f5b6a6b5-cb2f-4be3-afa2-762fdda17583", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "3485fa3c-3456-45c0-86be-f86eb351ae8c", "value": "emotet_exe_e5_03c89c05b11839f4e946e55c6def8eadce20243116d1fa60d3cf1b2cc66bd630_2022-02-05__001057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96e6a54-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075211, "uuid": "31184def-1a45-40f6-8146-b4302cd91641", "comment": "Malware payload (Heodo)", "value": "f9079c25850ecefde3303f5ed83d4a1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075211, "uuid": "b56a71e5-90f9-44f0-a2d4-434040b7af99", "comment": "Malware payload (Heodo)", "value": "05158d5c66a338a21e6c9384d7a0b9f0cbb3f78573ef71bd7fa47872ad452851", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075211, "uuid": "d6d329f4-983d-4d50-99db-3806210cb437", "comment": "Malware payload (Heodo)", "value": "10f50c201ad138323f2102139f64a4d2e0cee2c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075211, "uuid": "0a969151-ce57-47b3-bfbb-b0c20419dea1", "comment": "Malware payload (Heodo)", "value": "479ab453d8c6002e110bcc5b2103c3fbf16b630a2f83d93fb3dff5f0f54f2875ac8e94e0dd618cf6cf4364c41ca150f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075211, "uuid": "f9b729e9-7019-4c3f-b9b3-9d1649c096eb", "value": "T1A025AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075211, "uuid": "98aa19f4-2cbf-40a0-8551-0eb832c5357c", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075211, "uuid": "7742db56-4d7b-4f5c-95c8-9925556de615", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxefFIIm2m42:1ZsYB7vLsnZI1Hb9DRFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075211, "uuid": "2acef016-053a-4d3b-9384-277ab59610c7", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075211, "uuid": "26c9153c-cb48-40cb-95e5-e5ca268643e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075211, "uuid": "f88d21cc-3abd-46f6-9118-fb7c323a4a9d", "value": "05158d5c66a338a21e6c9384d7a0b9f0cbb3f78573ef71bd7fa47872ad452851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66717c4-8698-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644075099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075099, "uuid": "2098eabe-82eb-408e-8ed7-ef67e09c5250", "comment": "Malware payload", "value": "20aa1c3fc3d2dc04a4b81deef92858fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075099, "uuid": "a4edc2b6-21a4-42a6-8349-af3de09eb7f9", "comment": "Malware payload", "value": "05624102a4432c069b4731553fe2fe3a9143161cf4e38ad5b8197378dbda1300", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075099, "uuid": "f9fb57b8-dcd0-4648-83f5-0372c42b1d26", "comment": "Malware payload", "value": "b7e5772f62cf35a995d2d5125af8e4b8d44d431e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075099, "uuid": "8ecfb805-9951-4ac6-b797-6cb2b2a32c26", "comment": "Malware payload", "value": "3b09b8cf38cb9e1a5d0cedf9dd1cfcb42c67e796b33b7ca0e3fc220fef8d405ea1c19cd2e936335704e8bd7e4ddfc58e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075099, "uuid": "a660a424-9995-48e9-a3b4-071ed87a5092", "value": "T1307533130E34AD58F9FB6B30AFD58480A2195D357DBBD3AEB74E1BD628C15B429C810E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075099, "uuid": "f01847f9-8b11-46cb-9ee3-5262744b2d34", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075099, "uuid": "33894ec6-07ff-4a30-aa84-39c896040fd3", "value": "49152:3iKtfwQlwubVwFuNRfZuPy++LcYhczvc:9D9vRPLJ2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075099, "uuid": "1d14cd3d-1cbe-4b98-848f-6efa3c6815dc", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075099, "uuid": "cfbe86e8-792b-4815-acdf-3bca42cc3604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075099, "uuid": "2f225880-c621-467d-9009-118fd526a826", "value": "20aa1c3fc3d2dc04a4b81deef92858fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e865a3f-8670-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644057637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057637, "uuid": "c511b6db-55e0-4fcf-964f-9a141a25e42d", "comment": "Malware payload (Formbook)", "value": "ac2d30b113d92601e73696d1d040efea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057637, "uuid": "1ede4812-27c9-47c6-a7be-2e05dd0c5526", "comment": "Malware payload (Formbook)", "value": "063bf09348146a1457dc8af4d77c84c069bc848dff7c4e7fb63eba2c250461d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057637, "uuid": "ea6fc172-e86e-4706-939c-ee6ef88cd258", "comment": "Malware payload (Formbook)", "value": "044b3bba034ce1f8059af9073c321817b7996e21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057637, "uuid": "7fd772c0-d2bd-4494-b9c8-15799802e3cd", "comment": "Malware payload (Formbook)", "value": "f239af415b004f8bdef2bcee363e2b8edfe26cbdeab0591268518420ae5654af7b8b63bd29f6294f0d92060dced15d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057637, "uuid": "b0416fe8-e3cb-4736-897e-555c4173981d", "value": "T19644127271C3557FF69B0A300977837AE7B7C7101A70015B53910EEBA6202E769367EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057637, "uuid": "ca889268-a110-488f-a9bf-c63a826ade35", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057637, "uuid": "771d3ed3-e765-4f78-9c93-d8796df86b55", "value": "6144:owgt7B0clcbc3xCBaKHIOwh7JsOFvaeSYl:k7BlmbUsM2wh7yyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644057637, "uuid": "7c1b11a8-2d0a-4276-898b-aa2c2bbfac0c", "value": 253577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644057637, "uuid": "097580c5-82a5-419d-950c-23fd312cc121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057637, "uuid": "29d3c98e-698a-4b89-bda6-e821e55df07b", "value": "shipping_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec918e0-8674-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644059463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644059463, "uuid": "687b0489-b9ee-49dd-b309-02d15c2031af", "comment": "Malware payload (Loki)", "value": "a04948f3a7cb16f0eff5c49b5459e903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644059463, "uuid": "c357eca8-1e8c-46ce-a618-aa42edb62af1", "comment": "Malware payload (Loki)", "value": "068cd80ed7545f2ea2e6f4fb06f986ca6a65d360d4c316ce9dfa95ffd72f2fd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644059463, "uuid": "054ee3a3-7e47-43f2-9472-6a3b066df5e0", "comment": "Malware payload (Loki)", "value": "d24b1a2a35900da8888df59f466cd1f45365b3e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644059463, "uuid": "a6f42b45-25a4-45a1-9a01-0d7401639eec", "comment": "Malware payload (Loki)", "value": "aa4e9eae47a03035ec983ad62285c82506f48a4427f74c8903e8aafc165a15558a1168d93a3b2d0591bd921bb6c04a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644059463, "uuid": "49c2d1b1-fc51-4231-8f9c-ff023f93c87d", "value": "T16634E110B781C072C81FA475552DCBE15B3ABC31287294977B96272F8F713E1AB3A74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644059463, "uuid": "c86d404a-99bf-4b1a-a51b-c487397b826a", "value": "ec9e7a13a3ae99d72c69258e6951d2e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644059463, "uuid": "1fcf22dc-8594-4025-8dad-6da2447dba32", "value": "3072:GVEOykXlgLSyuDzZn6i5SqxV6bhzF1UgN7rOsW09RzL:YEmVgL4Dz9b2BJrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644059463, "uuid": "a9a0b669-4ada-4b7d-86d7-88729954f1c4", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644059463, "uuid": "6c4de223-df6d-48cd-9efa-dec13d3e5874", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644059463, "uuid": "b6914b6f-95e5-48a6-86ac-5f589de54d4b", "value": "a04948f3a7cb16f0eff5c49b5459e903.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b8d8c9-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075227, "uuid": "50b4386f-37e3-424a-b4a1-032839ffece8", "comment": "Malware payload (Heodo)", "value": "3cc7ae8b0f46dac123fae3a79d2a2edb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075227, "uuid": "e18e8417-d46d-437f-80b2-81a15fc40acc", "comment": "Malware payload (Heodo)", "value": "07942e0578baf62be93d86d3daa04bcd0a9f5cf4f178077940b897ebf67a0a53", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075227, "uuid": "a4891139-939b-4cda-b0dc-9f562f0112e1", "comment": "Malware payload (Heodo)", "value": "c4eb3900dc0b1467092546eb448b122d9346475a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075227, "uuid": "44d8a001-2e3e-4fb0-a37f-3a9e600e2a5f", "comment": "Malware payload (Heodo)", "value": "ec4a2a4dcd24ce5786246877cebb12a36c56f308c8004a6a710cbcfd38f62a6a939625d66a2baa7957796f09557cceaf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075227, "uuid": "d91ee329-19f2-492b-a4c7-4ac08886fcb7", "value": "T16025AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075227, "uuid": "533b617d-2c3a-4e88-aae8-7703063f64d8", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075227, "uuid": "ef93e7fc-c361-494e-8b68-4b07c84e4c9f", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxifFIIm2m42:1ZsYB7vLsnZI1Hb9DlFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075227, "uuid": "a8d196ed-a4d0-4f4d-bace-25563f7f4d5c", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075227, "uuid": "6fa7f0d6-ceeb-43ff-aa7f-a9d32b93c778", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075227, "uuid": "23bed06c-ba13-4d36-937e-13575e03a185", "value": "07942e0578baf62be93d86d3daa04bcd0a9f5cf4f178077940b897ebf67a0a53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e26667e-86b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088587, "uuid": "32981229-56f7-4b38-acdd-af9a2f499296", "comment": "Malware payload", "value": "11a0bbde92829b076f87468f081acdca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088587, "uuid": "5e68a4e8-cb3e-4f68-ba23-f05ab8fd48af", "comment": "Malware payload", "value": "083f77fdf8759be690fd610e5149ca4742f05664dfeccf5a1bdc27b287f22f4d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088587, "uuid": "4f4b8ffb-99dc-4864-9b22-d011b8853222", "comment": "Malware payload", "value": "614d6fb10159158c8dd44a0b94a1fcab7698fa5f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088587, "uuid": "9b3c6525-4dd7-46f9-b1fb-a1aa5a6b0f1c", "comment": "Malware payload", "value": "e78766c407b8f60f3084d4dc2778791e0e990714c11292dee35b21b4ca602f77db08a38f4d2f1e9db73ace1ca81eb2a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088587, "uuid": "6807e248-981a-437a-adbb-c4bffc9f89bc", "value": "T11625AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088587, "uuid": "fe1aa87f-2b85-45d8-84bf-7142aea58b46", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088587, "uuid": "456efeab-1843-4e64-b1b5-bdfee39d8d3a", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxbfFIIm2m42:1ZsYB7vLsnZI1Hb9DWFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088587, "uuid": "28413eb7-d289-449c-bcdb-6887683138dc", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088587, "uuid": "1d829853-e018-44eb-abea-cf7516101803", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088587, "uuid": "6653705f-7551-412f-9afe-115e4c459a64", "value": "X.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7fe364-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075141, "uuid": "a07fb45c-2658-4a3e-9c97-7e39bdd5b9b2", "comment": "Malware payload (Mirai)", "value": "a81d708484d8f9aad8a70eb5d83899b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075141, "uuid": "d4df6bcc-fbef-4ac5-9ebf-b95966053619", "comment": "Malware payload (Mirai)", "value": "0871be7f062cb9557787adfeee9b7946b28995c185f3c816d169aa7896b55d69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075141, "uuid": "e0632d58-7145-49b7-994a-c3fbbe0b3c2c", "comment": "Malware payload (Mirai)", "value": "aaee527c07c96e7e516ce60d91f33c81a45a368e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075141, "uuid": "c15106fd-ed1b-4732-81ec-13de56194458", "comment": "Malware payload (Mirai)", "value": "d024d2f73e3555d029f10a4596f1b712f9ed3ffafaa8f3d80e7f15b956dccf2bca9f10b3515b7400655bd231c2206c94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075141, "uuid": "6e7aba18-ea86-4fac-ab4d-9bf3f48b557d", "value": "T113A35B86D742C2F3C4430AB1029F965A0532FB3A8E3B9EA6F75C7CF4AB129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075141, "uuid": "ef571d08-682a-49b8-b2e3-1c4a1455fde8", "value": "3072:QHaKKPQP39VjGWXF8T7pV7EGytVj5hQT6bBXnf0OzTyoQQub:QiQP39VjGWXZ9tVj5h8gBXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075141, "uuid": "67553f31-fdae-489d-a314-c5d1be8636fa", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075141, "uuid": "dadf7829-2cf0-458d-8930-5cf26da0f8e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075141, "uuid": "82f12d2e-6822-4f72-960b-ce1ecfc1aabb", "value": "a81d708484d8f9aad8a70eb5d83899b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178c7ae2-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075262, "uuid": "0e45b076-d3f0-4ddb-a667-1d9e1e937d8a", "comment": "Malware payload (Heodo)", "value": "f0dbe0369bd246eba038edad240581fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075262, "uuid": "1a6a1e77-5984-418d-acd4-e04e00f107c2", "comment": "Malware payload (Heodo)", "value": "09632968b719155d025a96eb2d9300cfaa1342f1ab49a6168b855a877b3c77a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075262, "uuid": "327e2ced-4757-46d3-9844-88d0ec075bd2", "comment": "Malware payload (Heodo)", "value": "98f616619e399a31e3d7c9cb35ec18626d8be171", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075262, "uuid": "4f7a5232-85a4-4fe0-914b-8adb2f3ff829", "comment": "Malware payload (Heodo)", "value": "e50356042f630d52f703863f97cecbf31aa8e4679ba5a4d3047fd63c7834f62783eb73cb18e73664f06bac6a5d4b4f65", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075262, "uuid": "6020b453-a7dc-49a1-a4d2-d9a9ecd25a82", "value": "T19225AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075262, "uuid": "cbb375c0-527d-4a40-a4a2-fa636aaf9a51", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075262, "uuid": "d81f1f18-4fcb-4dbd-bb4c-ac789c636bee", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYx7fFIIm2m42:1ZsYB7vLsnZI1Hb9DmFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075262, "uuid": "4ba27ac4-1223-43af-9f48-ca45df8bda92", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075262, "uuid": "82a4b86d-8e69-4e73-b77d-fb8a7b985dcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075262, "uuid": "d8222bad-621a-44b8-a40b-5e4bba50c680", "value": "09632968b719155d025a96eb2d9300cfaa1342f1ab49a6168b855a877b3c77a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3df5d80-86cb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644097053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644097053, "uuid": "797d1c6a-423e-49c3-bc4b-9b0c0131e821", "comment": "Malware payload", "value": "ed3524c82f86956fb88cf51c70472f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644097053, "uuid": "06dfb5ca-bf4e-4771-b1ba-22f4f45ef6a3", "comment": "Malware payload", "value": "0ba7dc012a6d64f8759b1d30629f56daa130bcec36e42c318cada88a2ad1d351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644097053, "uuid": "fff7dc6d-da9f-4832-a51b-97a62063fa72", "comment": "Malware payload", "value": "94ce82cd5835ad6e55601616996838141ec0ad94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644097053, "uuid": "da6da3b5-e448-4050-b381-1f77efebfaa3", "comment": "Malware payload", "value": "7aed986c96ac8ab5ec3e96ab2d1e04bc6eb799941a2f7cdf68f7fb098122053239b3fad8a2674b7fbecb797164c5cbb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644097053, "uuid": "6ec96433-c651-4859-8bf4-f46696e0bfcd", "value": "T16184CF00BB90C035F1B712F8497A93ADB92E7AB15B3195CF63D526EA06346E1EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644097053, "uuid": "51652e58-2b9c-4fb8-9cbe-5e04c0863dee", "value": "1a3cf179d845c62d49a765b8e54e41fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644097053, "uuid": "5c1cb75e-98b9-4bb6-9de5-80bfedd0455c", "value": "6144:jkyySzXaaks8VCYfWPon3AIsC6NCLaOSY/2+G6CMpfKs2Or1YvUwG:jDXa6MCYfxn3AIkCLaA2+G5MNKvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644097053, "uuid": "3694b64f-5f09-40a5-b6a4-0b5d1fb49d86", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644097053, "uuid": "0aa62a75-2380-46f7-acc2-18af0344a88e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644097053, "uuid": "f7f40cd9-39e8-4a87-ae0f-ab53f73927c5", "value": "SecuriteInfo.com.W32.AIDetect.malware1.17035.19551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326cc6f4-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075307, "uuid": "6cab5ce0-5b2b-4842-9e55-41c8a6cb246d", "comment": "Malware payload (Heodo)", "value": "4622b3f90cefc05935f6d8494e83ea26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075307, "uuid": "d3b52a88-d247-499a-963e-4db6acbb9b45", "comment": "Malware payload (Heodo)", "value": "0c1484ceb2f8e23f5b68a51565248ea5ab05633941690297fae8efe14e9a1732", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075307, "uuid": "7f119097-af02-422f-819a-cf1b46ad5224", "comment": "Malware payload (Heodo)", "value": "bdf40275d59fdbc458c59cce54be708a60dff3d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075307, "uuid": "dd37dfc4-12fc-421e-a528-4a32202a840a", "comment": "Malware payload (Heodo)", "value": "f9373ce46257730893c93fd3fd26c965d4a1ff2f7ab78b1912eb87732d151156ce052ef853307d2990c4ae5771b14277", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075307, "uuid": "a29bd381-66bd-46a9-b9fb-993d82aff7fb", "value": "T10535AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075307, "uuid": "f987e903-d766-4276-a211-b3d14d62e68d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075307, "uuid": "486779b7-5847-45c9-a106-e6e4c7c8d5ad", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTDFIIm2m40:wfv1GVFF+765nFvFf6dlzzSHFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075307, "uuid": "4532dbb3-d8cc-44d8-8106-0c671668f0e5", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075307, "uuid": "17495a1f-b627-4e80-bde8-575b58acc088", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075307, "uuid": "3938b003-663a-43aa-ae6a-ee6c34d1d64d", "value": "0c1484ceb2f8e23f5b68a51565248ea5ab05633941690297fae8efe14e9a1732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c991cfef-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075131, "uuid": "0ce14a9e-d53d-45bf-8649-7540d5816bb7", "comment": "Malware payload (Mirai)", "value": "1cf8e7c2605e2d900d6a4d2b74eb0102", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075131, "uuid": "41414d30-7c06-4fbd-8754-a664e0f334f3", "comment": "Malware payload (Mirai)", "value": "0cce4c2caa1272043e1330c5dbbb6d83a11d98f924d7bc7b9c2130ca0199f76d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075131, "uuid": "e23a5147-1bed-418e-a453-63309bfebe89", "comment": "Malware payload (Mirai)", "value": "7b556f40e386be9abc5d230d46cde9d23494bc51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075131, "uuid": "9826c103-5abd-4afc-8afc-4e3f570d897b", "comment": "Malware payload (Mirai)", "value": "0e368be7023a5ea0c761672312c96ed02e91fcf261c3736d7bbff899e76a798bb9a502291b3751adc28e810e6c2dde05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075131, "uuid": "be806b58-ae9a-42d7-9e0e-dd54bbcad237", "value": "T1BDE3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075131, "uuid": "1053b9a9-5c94-474d-976f-bb55a489c859", "value": "3072:G/JlNTm6eq+tYP65hdSiDV5URxuZq+1uPNd5R:G/JlNyq+mP65hdS6URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075131, "uuid": "41033f4b-7316-4f45-a4d5-229f43602e85", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075131, "uuid": "8db1688e-c0eb-45c0-874a-708a364a631c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075131, "uuid": "df1a72e1-df6c-4398-900d-1ee8e8ee2407", "value": "1cf8e7c2605e2d900d6a4d2b74eb0102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4226ef62-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644073615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073615, "uuid": "ae6ac6ae-5d01-45dc-87eb-31780b4c3fd2", "comment": "Malware payload (Heodo)", "value": "02a86caaa68325fe3d2a1851e3b72dc2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073615, "uuid": "a031782a-e458-4ed2-b2fa-7975e283b9ca", "comment": "Malware payload (Heodo)", "value": "0e90c045e47d06ea51955a36436a330e316c6abc1b7f52dce6fe0ed8a3a3f0da", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073615, "uuid": "95ce430a-d3be-4216-970c-0fddcbe6d23d", "comment": "Malware payload (Heodo)", "value": "723ac89a2c86554610b606324b9bd64c6bbb1ad9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073615, "uuid": "c66ceb8e-7c12-4547-9c0e-f43f3c2b102d", "comment": "Malware payload (Heodo)", "value": "4043435d081d66fb375bbb9b42f0c18185fe53a0b960360f9c905be1f3846c9c571ec16e0047b8aa44c68bc77ae724cf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073615, "uuid": "a719c5b0-58cf-4f0a-88dc-2fbd54d3be0a", "value": "T1D7E37C157255D9FADA04233109CB8BFA3627BC438E7183E37249F31E6F776509AD2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073615, "uuid": "9f6b47f1-9f8f-4f48-a3b3-097758588114", "value": "3072:EcKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgX4LcR:EcKoSsxzNDZLDZjlbR868O8KlVH3yehH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073615, "uuid": "02d55514-342c-4275-83cc-26b641d26360", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073615, "uuid": "8d126aee-b1c9-4343-aadd-10f9d577a162", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073615, "uuid": "a26825b1-59c8-4177-8c6a-f97c784e2ad3", "value": "OPEN ACCESS EBOOKS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d2c7ce-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075150, "uuid": "904728db-ea9f-4dc2-98c7-90cdb89c118e", "comment": "Malware payload (Mirai)", "value": "73121f27d5ca5cc71a18fcf53ac6a860", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075150, "uuid": "8cc21a99-f3e9-463f-95ed-b189700e50b8", "comment": "Malware payload (Mirai)", "value": "1401623067344f608a331852a3005a3e960c172ca754a8a4337789a21151f379", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075150, "uuid": "445d932a-fbfc-46d4-89bf-f3e09fe46297", "comment": "Malware payload (Mirai)", "value": "89cf8a7fdd6d2fbb2ac8eb88ffd5e4ec53125e7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075150, "uuid": "aa1c1e51-bfed-4dd1-8241-cd707696f0b3", "comment": "Malware payload (Mirai)", "value": "7338a966cd4bbe7e62077e1d47117854f4e5f75b9c64153322542339a96abf55b3be33204c81e706c0c920295cb6dd88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075150, "uuid": "14f6f8c4-fa18-4f78-95f0-cec7a34e8ab6", "value": "T145C32A273B231E23C0C9507102E31331FAB9DB6938B953E7E9D16D9C2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075150, "uuid": "bb2751c0-e7a1-4071-8219-a986f0a45799", "value": "1536:Pc8yIhmQdktkzsDfQFhLtN95eVjtsivRY3tcphakLx9xlEhk9/skYEP/UDjSQrDZ:y6JLtNPQEWphakLZak9/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075150, "uuid": "b12d5c8d-57c3-406a-888c-a992aa7c78d1", "value": 126961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075150, "uuid": "2c44ce24-ec61-453b-bba8-2a152c4715ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075150, "uuid": "4c63ebae-a964-4a52-a49e-514669183f30", "value": "73121f27d5ca5cc71a18fcf53ac6a860", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be04d2b-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075323, "uuid": "4e2d7911-1b77-4c6f-a69c-639129dea43b", "comment": "Malware payload (Heodo)", "value": "9dfef948a6b1d4faef8a6f410b3f8b26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075323, "uuid": "0d1d338b-be3c-4159-82bd-f9b61b1563e6", "comment": "Malware payload (Heodo)", "value": "155b8841386ef7225ddabc01e216554117c59323d54ef4b27ff406c736fa50df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075323, "uuid": "fc5292d8-1151-4d48-8b9f-c3b13ce66169", "comment": "Malware payload (Heodo)", "value": "8e73c210d76815e282773c29de255c61f111e278", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075323, "uuid": "f4f422bf-f5c0-47c6-8044-bd02c8f5b1aa", "comment": "Malware payload (Heodo)", "value": "a16f4e4be763faeffa83185e5aa97dde188b9a835eb1f9702df5ebc141a4155d14b9ce3fd3842a5cf03beb56672bc698", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075323, "uuid": "8ea53e28-32f1-479f-a038-44b0b72bf398", "value": "T12925CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075323, "uuid": "fe70dd0a-a571-4841-a6a8-490089bbe60f", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075323, "uuid": "7cc12f9c-2ab6-48c9-b962-6a9a593559a4", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPdFIIm2mHv:exyq2kpWGWRCLWeNWO1tylFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075323, "uuid": "5766b0a0-21ff-43ea-98c5-ed10a8889045", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075323, "uuid": "0f5c84f6-9b5c-446f-bc02-fce138800b9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075323, "uuid": "ef28d8f5-24f2-429a-b02b-42b8dbc88a9d", "value": "155b8841386ef7225ddabc01e216554117c59323d54ef4b27ff406c736fa50df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca3039b-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075324, "uuid": "e2f544e3-b8cc-48e4-8a74-564956dbb7a9", "comment": "Malware payload (Heodo)", "value": "20713ec2d0a2fd3aa948477b20323fdd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075324, "uuid": "58329e66-cbef-4f22-9c4a-85b1cc08ee76", "comment": "Malware payload (Heodo)", "value": "19581c9939e2394d2952f9191c54a708bd6721131adaff68c37567d2848b8f01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075324, "uuid": "aef92067-5f5c-40e2-a5a8-1c1fa1cf5edc", "comment": "Malware payload (Heodo)", "value": "a9a2cf861c133fa5bdc208099c41736eeb8836d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075324, "uuid": "a1a9ed10-1465-499f-a3b4-157ba10c1cab", "comment": "Malware payload (Heodo)", "value": "eba7519c1dfbfb807202a7f9cd22659324fd864b297c235917d934726522c4b4c42e3c8cac17cfdac2c23159aabf0922", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075324, "uuid": "7a67aee5-ddc3-43fb-a3f7-06e02680525b", "value": "T1AA35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075324, "uuid": "7e18123d-68b0-4456-9a4c-eca13acc1cf1", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075324, "uuid": "66e833ca-893b-4ab5-a927-bb7492abe986", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTnFIIm2m40:wfv1GVFF+765nFvFf6dlzzSzFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075324, "uuid": "c24ab3db-dc1c-460e-a366-12e24d4e73c9", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075324, "uuid": "e674afb4-0026-4f5d-8f4b-a31847614182", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075324, "uuid": "f1a9cb1c-0fe6-4072-8c98-2a3cfd38e745", "value": "19581c9939e2394d2952f9191c54a708bd6721131adaff68c37567d2848b8f01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba6fc24-869a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644076074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076074, "uuid": "c5f3b25c-ef7e-4f27-b1bd-aa8beb8a5745", "comment": "Malware payload", "value": "b0b243f5f8177da039c477f439d40b97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076074, "uuid": "a6f03fc1-d588-41a3-bda9-cfaea02c3ba0", "comment": "Malware payload", "value": "1a597ff0090a8631f642c4b9223939fbb3535ebc8b001f1223aaeab9fbaa8d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076074, "uuid": "f32a137c-4ae4-4d72-9f9d-84934db1eaed", "comment": "Malware payload", "value": "a70266c61c18b8d1fd99a0108e6c776f29b6144b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076074, "uuid": "46334013-03c4-46e0-8cf7-b957a32e06ba", "comment": "Malware payload", "value": "55e753e6261aaa9ae3c9bf5b0eb66caa9537a1e511ec5cd6963613d507ce76d27f4ee63081af7298ba947c234cbb3701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076074, "uuid": "82841be1-a4b0-471c-970b-8161c95d8062", "value": "T12D5633C8677BFB97FA0C11FA5F59066E0E685F69E0E04AB61214ADC320DCB546E20D3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076074, "uuid": "66ac6e9f-b5a5-4b55-a8c1-0a7583df1217", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076074, "uuid": "cd0240ee-9a20-4516-a122-ad70e67c57bd", "value": "98304:2FJ8UjCiaqoZ00hqELxTRKqtqDYIz0YytsM/rxm99R15ZUFBUoI:i8UjCiaNX93tqDYIAYytJ/N4bvk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076074, "uuid": "6732b01d-bbe4-41de-9eda-76c3b4510a35", "value": 6038857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076074, "uuid": "6b539b16-4aeb-4b41-87d6-46826b760865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076074, "uuid": "76b1db9c-e6e7-44bb-bf52-f7cfb750bc5c", "value": "b0b243f5f8177da039c477f439d40b97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78efdd0-86bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091959, "uuid": "3376a9de-e607-431f-80e4-eee74284d2da", "comment": "Malware payload", "value": "84a74bcf024ac4779d20e2b667bc6da6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091959, "uuid": "6653eefb-7b7e-4bdb-910b-4152cf35204f", "comment": "Malware payload", "value": "1a7bf1f46660a66d226c7a00b06c7c320b7ee0e23f79d42ce5608a18ed789813", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091959, "uuid": "ae551079-ba43-44e3-832c-b03284819b8d", "comment": "Malware payload", "value": "99cbae9ae51381d5f7eb637b12d42e790f48db33", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091959, "uuid": "75347f47-bf2c-42bc-b87a-0e6b0a40337f", "comment": "Malware payload", "value": "91304767fdefa560e9f0f2b127a6476c842e5a6581c504ea79de9c21c5344801206828170a53bc4d675f31e5170beaff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091959, "uuid": "b794dcd5-a4fb-4d0c-94ab-fdda12f5a068", "value": "T1FCE23111B2E6DA16D6D532320EFACFFA6734BC51AE52C31B3154731E6C38A90CE52B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091959, "uuid": "e3aef0af-b50e-49f1-b6ae-49cd0af18c25", "value": "384:Th0alllllPrL9bsr4H2O3jndaog4DKYtU:TvYr4HPdaiDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091959, "uuid": "5981ff94-c62c-4997-a714-f79e89debfa5", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091959, "uuid": "12429575-57a3-4212-9688-a6be90ca535c", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091959, "uuid": "6f058107-d2fa-4d5a-a808-b361488bbf19", "value": "W97M.Kodak.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e046b454-863c-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1644035656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644035656, "uuid": "4ca8a8fe-fc2e-4370-b399-8aba17aa78b0", "comment": "Malware payload (Tofsee)", "value": "4bf4f9b07ca8b37449bc8fbaefff4afd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644035656, "uuid": "0ae1b790-2540-42ce-b22f-4957baeb9cd4", "comment": "Malware payload (Tofsee)", "value": "1acb97deb33d0123a097579ad87131b20f9b4bceabcc220a42b2a9376f462735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644035656, "uuid": "caf70f67-c1a9-43a3-b458-fd03dc7b95cf", "comment": "Malware payload (Tofsee)", "value": "17669647a1574af1300274ebf48eadaeeaf68269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644035656, "uuid": "9b22c9d5-119a-4371-89d6-9d2bc8f17f57", "comment": "Malware payload (Tofsee)", "value": "c3284cc1e71ce259ae453502e0e1c820fab71ed010a734bc692f01a1e0f1a98820e630e5c19138452f321ad8e12e6606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644035656, "uuid": "fe50fde7-fa7d-4cd7-8b5e-c87f29e40412", "value": "T196E3178E139E2C7ADDE30674295C3EE1A975BE44B1CC3ED127DB6B469F48C443B99088", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644035656, "uuid": "e996c887-9674-46f5-874c-e6c3be74b4e1", "value": "27aedc99efb42fccb2b4869208cde7d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644035656, "uuid": "1d51843f-2b02-4d29-916e-28c002bc229c", "value": "3072:QTqV/QTdNN2G11i1gyJ5jUrDSE4miMmtF1hGxvWBo4O:qdNNx6gq5jUa3F1IxvWBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644035656, "uuid": "53140625-9be6-48bb-b30d-1caedb1af69a", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644035656, "uuid": "f1fab05d-7e87-487e-8ccf-b1378aeff167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644035656, "uuid": "ced25cc8-f001-4e08-b46f-47b90d945343", "value": "mycoolnewscreensaver.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69139ce-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075180, "uuid": "ccf9c866-007b-4468-a1ee-e4cfadbfa92d", "comment": "Malware payload (Mirai)", "value": "65314c881b489385a8297cf9c299ac13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075180, "uuid": "429ca5ce-e392-4520-82fe-00ad64f4bcef", "comment": "Malware payload (Mirai)", "value": "1bc89492da4f4e93e571e2466c5fb44e1ff19c0585d82402077ef8dbe8264a89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075180, "uuid": "03deea4b-db03-41da-931b-bd4558173bee", "comment": "Malware payload (Mirai)", "value": "116d7d662c96bcddecb292022df5f28987d0a08d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075180, "uuid": "5a9098e9-8e22-4e4f-8d61-ea762b20f83c", "comment": "Malware payload (Mirai)", "value": "08bde7643066c5a315fe9bc66e4a9155aa04ac8d6f51535f4b2e03a13868fb9843a488e06d275493dc917a3cbf7c4b4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075180, "uuid": "489e13bd-00a3-4028-8d3d-1bab03c96748", "value": "T10FA34A829740E5B3D09306F5129B8B150133FB3F4A6B9EAAF35D3CF48B159C17221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075180, "uuid": "a40aea64-7a6c-42b6-b2f6-7d8f3fcac1bd", "value": "3072:PoYMmdU2Uh917j8D869ACPhDdAURyv/y5hzTTPtinf0OzTyoQQub:Tdxu917j8D86pDA5vK5hPTtinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075180, "uuid": "65687cb6-27ce-4041-b4f1-e23bed2d4865", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075180, "uuid": "0fb92936-9060-44a0-9266-bfc22846fcfd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075180, "uuid": "10b1377c-04d6-4fcb-9323-deed41476e6d", "value": "65314c881b489385a8297cf9c299ac13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9d515b-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644073611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073611, "uuid": "67e7b285-88d6-44b1-8fd5-261a64adfefa", "comment": "Malware payload (Heodo)", "value": "55eb013316a472dd6864fd09fd131074", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073611, "uuid": "aff6086d-6086-4f23-be5c-437b728f2ab6", "comment": "Malware payload (Heodo)", "value": "1ce5a81909cf7b19cf2ecc1a4b3035f374b0c1fdeeb8e7eb36b04b78f99f8bfa", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073611, "uuid": "9dfff5f6-f2c4-4adf-82f3-50e2046702de", "comment": "Malware payload (Heodo)", "value": "9501f3a5a2d15baffad52d91ebc6e3322505e675", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073611, "uuid": "d48bf2e1-a67b-48a9-85f0-5c3a360ed49f", "comment": "Malware payload (Heodo)", "value": "8d3fa3679dec6ea3c2ad6dafd829c7b9632c0352e14363f45943aa22cbf1579ca5a0982df1d3cc55b31453ada25b136c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073611, "uuid": "a60279f7-3956-4100-8462-4a3b5c31e43c", "value": "T176E37C157255D9EADA04233109CB8BFA3627BC438E7183F37249F31E6F776509AD2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073611, "uuid": "e412e32d-6c98-40df-b018-c31364101c61", "value": "3072:UcKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4LcZ:UcKoSsxzNDZLDZjlbR868O8KlVH3yeh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073611, "uuid": "416a3d95-8e82-40b4-879d-d3312351f017", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073611, "uuid": "8374c400-a302-4294-b864-e2b3dba72ccd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073611, "uuid": "5e9822e8-e14e-444e-bae1-bb067a39d536", "value": "Opast Publishing Group.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b39146-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644020144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020144, "uuid": "ac22189f-bca4-4be8-af84-64d37572b579", "comment": "Malware payload (RedLineStealer)", "value": "fa9abc629c67c188f165366e2fe30971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020144, "uuid": "ebf1f974-587c-4542-a027-5a58f457e8fe", "comment": "Malware payload (RedLineStealer)", "value": "1e4b2af07cb9e6478dbf5051e1839a1f944e950a6f2dbadc94446928e46e7d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020144, "uuid": "fdb0711a-855c-4d30-8bc7-6e267310f2d4", "comment": "Malware payload (RedLineStealer)", "value": "f3bee20db3275d737e18a28f9020379e73e5a226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020144, "uuid": "628adcb0-0334-48ab-bba6-4049f0850f3d", "comment": "Malware payload (RedLineStealer)", "value": "9c11272beed5602e455e32ff6e76995a178150359936314bc11be116f4ca85f3ad811a65828110c4bdb8c8db1295073e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020144, "uuid": "68fe8b6c-8e4d-47e5-843e-086479b250fb", "value": "T1552633527FE6E5FBCE0726310B1C6B71B2F9C3590B16419B338499285F2DAFAD12B424", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020144, "uuid": "7c14cca2-5d02-474f-9572-7970ebdb33ba", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020144, "uuid": "09975f6e-2fb4-4168-a604-2d63021a9ee4", "value": "98304:xKCvLUBsgGUCDirYz+wxR8ro9hcBsVsbv2IeDBIQ6JAcp1:xLLUCgGGYSwR8roQBsVsTteVIQ6T1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644020144, "uuid": "95779fc1-fc88-414f-90ca-f4616a54e2b5", "value": 4429143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644020144, "uuid": "60d81bd5-390b-4b18-b40c-61b7ce8682ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020144, "uuid": "f466b52c-499b-4599-ad27-f100575160db", "value": "1E4B2AF07CB9E6478DBF5051E1839A1F944E950A6F2DB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26863028-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644076146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076146, "uuid": "6ecc08e9-bb89-4a3c-8a4c-4ed672f06f82", "comment": "Malware payload (RedLineStealer)", "value": "a1d23cb7b60c07d4ec73aeda26f10110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076146, "uuid": "659ca38d-4271-4bdd-95d3-56d160078e0d", "comment": "Malware payload (RedLineStealer)", "value": "1ed5934c95292cf6d732ae068e1ef5e5c057088b199031e8be45eaf26a475c67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076146, "uuid": "140be96d-b665-4112-8c6d-c28f63e6eafd", "comment": "Malware payload (RedLineStealer)", "value": "53b0a096623960451990436474f4228132150de3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076146, "uuid": "23ff7b41-462f-45dd-a18f-104c3587a4cb", "comment": "Malware payload (RedLineStealer)", "value": "795309150d71658e65cc5456a8971776f2de7eec81892567454129c596a1cf622a4a2110e1ac4b7c927b9d58d8a59f5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076146, "uuid": "d650cd1b-e97b-4f05-9f74-94d892953052", "value": "T12125E8DE51D5D849CDEE27F00DFBA88CAD7094C6938763EAA32C95F0AB423D2654D4E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076146, "uuid": "57685d07-4b7e-49da-8c81-efd2a8383b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076146, "uuid": "29ba1c02-68be-4283-8d31-91ddabe98c98", "value": "12288:/pqlyQYIZRszTDIysfhSXhYTaIC9jJrcFH9Hp9e4NoNLO:/fQTKnIyibaJgxH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076146, "uuid": "22abe954-6500-4185-a222-0eb11b147163", "value": 1029896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076146, "uuid": "602075c6-67a1-4f7c-a5cb-63ac7da0da07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076146, "uuid": "3b2cbc62-4049-4b4c-83fe-c6c09f5fd140", "value": "a1d23cb7b60c07d4ec73aeda26f10110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85d041c-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "0d66e3ed-a360-4330-b60e-c50d1e8d15d7", "comment": "Malware payload (Heodo)", "value": "f3464f2810e54bd1eabb6cc46c3d9e09", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "e4a4bb55-55ff-4293-9812-9059efc39c02", "comment": "Malware payload (Heodo)", "value": "1f89b4fdd5dcae8a0ff786de939d1570cfdad3f8f8b69d6d1dc005daf6d75859", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "996701e0-86cb-437c-bfa2-aef786184ddf", "comment": "Malware payload (Heodo)", "value": "e04e5e8bd97fce0fb10312ae3afd61b509f6244f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "d92d39e7-22e6-478d-b114-f904c3321d95", "comment": "Malware payload (Heodo)", "value": "84f79d06f1285a12e25d0d2a2bdd4feebbd0af9dc91439fb8f42b5fc2f1c56a9448138ed692e76eed934cc49d716f063", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "8e810f31-ff37-4929-9bd1-8099e511d415", "value": "T14225AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "0d90c84b-ef2c-47b1-9bfe-ccc72ac59a33", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "388aef29-1b47-493a-88a9-37f22da3478a", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxSfFIIm2m42:1ZsYB7vLsnZI1Hb9DhFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019724, "uuid": "355f72e3-012d-40a8-8e1a-aaed095dd3db", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019724, "uuid": "1cf0b3ab-b524-4ea9-81f1-d9875d2e0b5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "e7a98f91-79e3-4788-bc47-ef4eabc5d636", "value": "emotet_exe_e4_1f89b4fdd5dcae8a0ff786de939d1570cfdad3f8f8b69d6d1dc005daf6d75859_2022-02-05__000837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1403f2fb-86c0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644092006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644092006, "uuid": "74958e29-d9ac-4e5e-9815-16f0de9f7c37", "comment": "Malware payload", "value": "b90254895d6169a8d111a508e2638c51", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644092006, "uuid": "d5868154-cb79-4239-8333-d47aad1042c0", "comment": "Malware payload", "value": "205eb306ea3a1453fdd43b55bbef3c0dd7afa823bb070972d86106fd11920d5d", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644092006, "uuid": "6bdd2838-d741-4f2e-8816-91a0b3d254bc", "comment": "Malware payload", "value": "7669c66d338b4208536c32924bcab95996cf8c3e", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644092006, "uuid": "0d7c09f6-e2ac-4f3d-9989-195c41dd297f", "comment": "Malware payload", "value": "f1666640cf3a83621aea12798169a02decfae626b5de74f6503eef2123e1e6a4744e1a357a3ded9a0cb90f91d7c1687b", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644092006, "uuid": "6e06e03e-710a-4b97-b895-c672051c11f7", "value": "T12141F084EC59C4B8A4B631C3381D588C83E617A7E874E559388CF981A7349D856B53ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644092006, "uuid": "9505ea4e-e6a2-42a0-8e82-40adc3bd4b22", "value": "48:yJtebXVnZPJ+gPS9UoON2Fuh4u7NCsAgAQLwoFpMTjCqtYi:yJk7J1Jv6R3uh4u7NCsAgAQLBFgeqtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644092006, "uuid": "f3ee04f9-4750-4d12-9a23-2a3a8f03170e", "value": 2357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644092006, "uuid": "a8c6683f-2644-4ed7-9884-215668b3c640", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644092006, "uuid": "f14c9da0-eed5-47c0-a226-219ea425ca68", "value": "germinal.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e043a50-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075327, "uuid": "49fbab24-edb6-4412-89f6-b96b2a84db27", "comment": "Malware payload (Heodo)", "value": "11a39dc94a0ee0649d2680d2af6a555b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075327, "uuid": "ff595614-fea1-4ed0-8fb9-0bd84a4f0880", "comment": "Malware payload (Heodo)", "value": "2082d96fc244b5bf20ea0aafe77339da84355d8c662ccd8a97892b38dae8d754", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075327, "uuid": "66ef104a-7758-4d94-9128-ac81ca50f7d2", "comment": "Malware payload (Heodo)", "value": "b841a7be533e99810e888a5f76814281cb50c355", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075327, "uuid": "2563ee54-c3d8-4b75-8aff-a2a2a1c8129e", "comment": "Malware payload (Heodo)", "value": "b5eeb76effdd7ad3ca560dbb102261038d60155544a1fd55906a394fa97d4bb9a23b4253ca42ec14aa36fdd4b58dc515", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075327, "uuid": "1a24c16c-77d6-41d1-b499-43bc80278a34", "value": "T1BB35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075327, "uuid": "e0eeed1a-f8c0-4f48-8047-69f1fa1cfb32", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075327, "uuid": "88c28eb1-e534-45e6-9a48-df7352e90daa", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvT9FIIm2m40:wfv1GVFF+765nFvFf6dlzzSRFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075327, "uuid": "6cda065f-ce29-4770-a2f0-937cb4863a13", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075327, "uuid": "8acd1be7-cf99-4465-be1a-f40ccad0b60e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075327, "uuid": "2b509cf4-01b2-4428-b9d2-df70a7220a57", "value": "2082d96fc244b5bf20ea0aafe77339da84355d8c662ccd8a97892b38dae8d754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f382e8d-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075329, "uuid": "29cc3a89-e24c-4c89-904f-55de44e39bb9", "comment": "Malware payload (Heodo)", "value": "ba7de8fabd6c39c6a45de261a9c4703a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075329, "uuid": "64d344eb-910b-4cd8-99e2-0c9cc7c0a0ef", "comment": "Malware payload (Heodo)", "value": "226794c0233f6fb475e4da59325d1705aff300b629a5d4b58cc4d03c0336cd78", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075329, "uuid": "89f3e1a1-1578-48bf-b7e2-04f579a5acfe", "comment": "Malware payload (Heodo)", "value": "e6186ac9f4c10eb890bfb762a39e0bba209dc7a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075329, "uuid": "cdf7837d-ddf0-46da-aaa0-0082c309adec", "comment": "Malware payload (Heodo)", "value": "5b6274ae4948f0a70cfac43304fa41eda01432b9cd058ef4f1c4375a8240cdc552c6d3c2cac32e3d0d59b9a6571f0713", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075329, "uuid": "9a0b4fbb-a414-4cf3-8009-3e2e45b3bfc9", "value": "T16F25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075329, "uuid": "92b82d26-2164-47fe-8adb-f5107d14b420", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075329, "uuid": "3bbe165d-8ebd-46d0-99c0-ed0b24d068c8", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxgfFIIm2m42:1ZsYB7vLsnZI1Hb9DXFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075329, "uuid": "0fdd7771-71b4-4c5d-9afc-a6eb51c97678", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075329, "uuid": "5a755eca-c337-47c3-ab21-c3d065653881", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075329, "uuid": "0fc37b2c-ddd9-4be2-be82-fdaee503e35f", "value": "226794c0233f6fb475e4da59325d1705aff300b629a5d4b58cc4d03c0336cd78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e9be77-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091211, "uuid": "bd0d929f-b4e4-4a79-96dc-4a5f121e5400", "comment": "Malware payload", "value": "460f48b7d7bde2517c1a9a9042682f28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091211, "uuid": "22c05b6f-c484-45c2-8b42-61f8367f6897", "comment": "Malware payload", "value": "22849ec7055723021053d033aab3e22ee63c4174468aac1e4f70886b0a0f2cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091211, "uuid": "b6ef9067-93d5-4828-8cac-d20373c9fa12", "comment": "Malware payload", "value": "f6ced460439e443aa957c2765328f3b99dcdd252", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091211, "uuid": "f86f6449-d772-4b56-ab6c-e1a7bffb7353", "comment": "Malware payload", "value": "6d2ad48ace75701607f5c5fe33089f27136bd4c62a34b3b37d99b1b126aec3b2ee283fd62653c75e054f43ac4d19de81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091211, "uuid": "1bb9f02f-08c3-4e0a-a7d8-94285eb49469", "value": "T14DD2F1339C9522E2CDBDA5BBE8240893B3B98AF040D94E005D2D03B67E7A1A3DC2D448", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091211, "uuid": "d778e73f-2b96-4e2d-9dc8-19e8cc493f87", "value": "64c92797938d704041eebf1f78732f09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091211, "uuid": "3ebec8dd-84c4-43a7-9e07-bca688a66b80", "value": "768:2OmnZUlSVXAz2DpAC9RD/HYM9pGG7KQRg5kL:2OmZUlEAiDBHjYCGGuT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091211, "uuid": "da384130-1135-405e-bb2b-f7b4a499d521", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091211, "uuid": "ea5deff0-460f-4b74-a8b2-904a286bda56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091211, "uuid": "1e44f20e-cb9c-41bc-b2e1-a65395ceff51", "value": "singlung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1703a4a-869d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644077211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077211, "uuid": "191948fc-f33d-4733-ad3c-5571dab06df1", "comment": "Malware payload", "value": "5a9dd9a47442067049ff7b1cb726edcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077211, "uuid": "286c70bf-36f2-4601-a427-3ed399c210f1", "comment": "Malware payload", "value": "22cf3626d49aff732cf49c6c119c23acf78658ac703719dfb8ee5f83fcb9708b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077211, "uuid": "a00f0fed-c667-4be4-8f40-66b7c4b1600c", "comment": "Malware payload", "value": "5035bbf824f2c57e810161813da53393fc7e322b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077211, "uuid": "830bed37-d768-406f-8f46-464588bed5cf", "comment": "Malware payload", "value": "d6393254cc9afa143d6aac458fa7338b6f23046604693f1520e42efcf1e6462fce86c82aa551630e87ed8ac38a395b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077211, "uuid": "67fcc586-099f-4933-a897-82015e58980e", "value": "T1735633124F39AED2C5394EF332C60E05D52E1A39DECCC8F43656A01CC985F96395AB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077211, "uuid": "0b67a4e5-ff97-45ec-9edb-900e3bb50b25", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077211, "uuid": "3fd52a8d-c7e9-4df5-8b7c-a83e4e32fc9f", "value": "98304:vFYqe0SqrRxglenKCgTN9m0Bs9m2s/LpacClst5bjyJ1ttaxDkiQQ:je0SqrRWOFgTDm02909LbG1tEf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644077211, "uuid": "81c6b51e-36f7-4c66-b78e-38e737d27d45", "value": 5928340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644077211, "uuid": "05e1224a-bc9c-4047-a02c-8345790795a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077211, "uuid": "9efca389-75e1-4cd3-a7f9-af71b6a5c17b", "value": "5a9dd9a47442067049ff7b1cb726edcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6706625-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "34f23bd9-1c86-48c0-b65d-cc5a03d2e665", "comment": "Malware payload (Heodo)", "value": "d654e0b99540880a6f1b692e9f0fce8f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "62bbb9a7-710e-4562-a45a-62019e20e9b1", "comment": "Malware payload (Heodo)", "value": "22d9f80038e7b1bbcbb5f7aae007a2865720e49de8bc1ca6516988855e19f0ad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "831b83b0-6033-46f4-9c7c-53d28fb8d395", "comment": "Malware payload (Heodo)", "value": "fddb1393b94f2e15d676f5c93986a4f09f97d36e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "6489a24c-4da6-44fe-bfa9-66fa962fbc85", "comment": "Malware payload (Heodo)", "value": "8af73feb9d96ded238a42a4e45612fcb6c2a6670a6917d09d69810266e6d65603ada0c8d892d1eff63819093c1fee450", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "f21b1bb5-1a7a-4676-9638-f189100973b2", "value": "T12625AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "f696d148-463d-4950-bca2-3338f93a7aa2", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "89f5bc94-8d8a-4a66-af6e-fd129f82087c", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxqfFIIm2m42:1ZsYB7vLsnZI1Hb9DpFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019721, "uuid": "2c953a11-5f10-4cef-99b9-0f0115141a00", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019721, "uuid": "cbd7cb4f-82f9-4856-bf6a-5159dca720c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "6549006d-fab0-439d-a52b-81f3b4a86e26", "value": "emotet_exe_e4_22d9f80038e7b1bbcbb5f7aae007a2865720e49de8bc1ca6516988855e19f0ad_2022-02-05__000833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28f7c7d-86bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091950, "uuid": "802deb7c-7024-469e-be3b-7bd1a7c7151a", "comment": "Malware payload", "value": "8cd23603a72f1dcbdf22e03d49c17f83", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091950, "uuid": "3c1bd019-1aaa-450c-aed4-d23612c0695d", "comment": "Malware payload", "value": "249f86322652556606ef051a617fa9a473cf6ec0c8cccdb5a7ee7082c430695d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091950, "uuid": "43c10694-544b-4488-9e8f-3b1826b8b6f6", "comment": "Malware payload", "value": "f970fea6b876ba8d133900ceb55a14bf0c307335", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091950, "uuid": "b9bd2c12-cb93-4871-bc41-a324c7edfdd7", "comment": "Malware payload", "value": "4421e18fb405d16ea36617fd4b2142f965ecd4664880a987d7a843b105d15bce9e3258a045c642f6d65edc4eefb6d762", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091950, "uuid": "99f7c80b-b831-4242-b13c-bdef2111ec5e", "value": "T13EF27500B2D5EE13DB5622320DDBCEFA67397C81BE4283173285776E2E39A50CE95791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091950, "uuid": "d017b764-9405-4eac-9456-836628c48ee2", "value": "192:41+TFFFFFFFFFec60S4cyVrX3br5/97ObBgre1rytS+faEIP9fDDaDFeO3jvFUZ:4EIti3vh97OBGAynS9JO3j2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091950, "uuid": "cbddb561-8314-4033-b59e-9756038443c1", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091950, "uuid": "be32c0f1-971c-4151-a4a9-88efac3ced0f", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091950, "uuid": "7a267692-c234-40b1-b865-9e683c7cdccb", "value": "Blood.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6b86d4-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644076161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076161, "uuid": "997c1af6-c3f0-4b00-b1f5-056d1ca9ed2e", "comment": "Malware payload (Heodo)", "value": "f57ab8d98f64f3d0e546b2705196e6c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076161, "uuid": "0a4fc60b-cd96-40f5-8e52-60bb633016f6", "comment": "Malware payload (Heodo)", "value": "24a88de99b7b497aa79354841dd9453d3e6aab3a7addc53d1d617b6376a7e455", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076161, "uuid": "d43503b1-5ab9-4bcd-aa64-dfaaa095ad35", "comment": "Malware payload (Heodo)", "value": "ce09b8aa501d5bf3bda03e64e4cfc6f24c050c94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076161, "uuid": "577d5e27-5769-4331-a05e-a439e1e29687", "comment": "Malware payload (Heodo)", "value": "094ecfe2a1e12e9fd72e5cd1eaa7ba76c121f0bcefeb6dca46584930cc2fc73680759b773e92ae9ef622c71388ffc858", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076161, "uuid": "84758cd5-9dc2-4467-95be-dd1d0f912aa4", "value": "T16D25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076161, "uuid": "025aa4c7-bb55-4125-b99d-2ad79c2b74c7", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076161, "uuid": "7eb1da88-7a7b-4d92-ae47-4da15d255cbd", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYx1fFIIm2m42:1ZsYB7vLsnZI1Hb9DQFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076161, "uuid": "6b48efed-966a-4509-affd-62a282fd0939", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076161, "uuid": "c8bc5c91-1855-4c28-9c4a-3ff6e0dfab86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076161, "uuid": "e1f0b672-06e4-42ab-82da-9de356f6cd73", "value": "24a88de99b7b497aa79354841dd9453d3e6aab3a7addc53d1d617b6376a7e455.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39ea543-8681-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644065216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644065216, "uuid": "da4dc18a-0815-455f-bd77-f2b25d28fe98", "comment": "Malware payload (Mirai)", "value": "6a9652c0c09378adb986db139846654b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644065216, "uuid": "12cdd274-0226-43d4-8906-95377ca2facb", "comment": "Malware payload (Mirai)", "value": "2583cdf6d4d37eb414b8537f02858125e2eb3f3948af6b5bdcdeb25ad2165538", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644065216, "uuid": "8da3a760-f967-4050-aa1b-904d5ca32464", "comment": "Malware payload (Mirai)", "value": "706c8f5719d051f6c1dee750bed281badece431c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644065216, "uuid": "1e5cb32c-9189-4839-9e03-6bf568dc72b0", "comment": "Malware payload (Mirai)", "value": "959a787f2f3c8685bcd634dd5e73871c99c95ee58e4d91a2f76da8957a8a96d8637762e249228c2720d2a0c97502eeb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644065216, "uuid": "30c895a7-c977-49aa-b7bd-67d575ce08d5", "value": "T1E5B32A0B48616A7BC00599B135FB55342736BD210E4F0A9A696C76B447FF8CEF00FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644065216, "uuid": "8000f427-5f1c-42f1-8624-a260d0f945a0", "value": "3072:k4Jtz02FwPwsiHtGBEQYZZz6j8gN5hLu4lHFru/unDASwWoF:kaz02FwIsiH8BEQyXgN5hL/5Fru/unkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644065216, "uuid": "33143050-b7b6-42d3-ade5-209626d2a0f2", "value": 112257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644065216, "uuid": "08e35726-955f-4059-9b98-a5c0c86ea236", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644065216, "uuid": "d128e9cb-0c7c-477a-96ad-8c47e67d28bf", "value": "6a9652c0c09378adb986db139846654b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4091bf3b-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075331, "uuid": "24b0bbee-916a-4f15-a968-a3242097e6d5", "comment": "Malware payload (Heodo)", "value": "23e84ccdd1f9cc25e52f10a4dfcfb4a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075331, "uuid": "10d9963e-0a22-4c35-99fa-18f10b1a028a", "comment": "Malware payload (Heodo)", "value": "25c85a49d5dad8a80a8d83b72fced27d24a94a34799251f173e6b91f5509d05c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075331, "uuid": "4a05ed6b-5a1a-4a13-b121-69b6a07670a9", "comment": "Malware payload (Heodo)", "value": "ab2b23441c8116310a3ba50fb3b7284f32101224", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075331, "uuid": "c68b9028-e70c-45fe-a806-3f7202fca041", "comment": "Malware payload (Heodo)", "value": "2de41e2b1976eb49a2327fe818272ab3d922ec7114e6dcd108b56ef26cc059bc253749235b75436c9c335bc0cab0bfc4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075331, "uuid": "fd540487-bd9c-48de-b3cb-aa77a7dede15", "value": "T14725AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075331, "uuid": "834c2c3a-4999-4349-ae99-2da85de87774", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075331, "uuid": "fb07b5ee-004f-4f6e-bd79-b6bd2dfee605", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxffFIIm2m42:1ZsYB7vLsnZI1Hb9DuFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075331, "uuid": "c7ef34dc-3965-4bb0-b9b0-e281a03e01bb", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075331, "uuid": "f52cb2c6-2967-49af-855f-40964bf5767c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075331, "uuid": "7d290b9c-8fd6-48c0-a3ce-3df9d0f06dcf", "value": "25c85a49d5dad8a80a8d83b72fced27d24a94a34799251f173e6b91f5509d05c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fbf4ba-8626-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644025976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025976, "uuid": "fa7b6bc6-a438-49a7-bf97-1130fc30619c", "comment": "Malware payload (Heodo)", "value": "35d6f9d4e08009350f3e236515d9e918", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025976, "uuid": "5bc49202-d648-413f-b44a-1a45ef7d229c", "comment": "Malware payload (Heodo)", "value": "2628d0d476db2b7663bdb2f13b4e029de5985cd23ad4eb4588039d82e783df95", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025976, "uuid": "154a105a-4151-409b-9075-6d47cec28e88", "comment": "Malware payload (Heodo)", "value": "060ec45ccfc2ba4edf3f0f77ef43e9c8c7e8a422", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025976, "uuid": "0e7ee4bd-569a-4533-b7ca-0892644828d1", "comment": "Malware payload (Heodo)", "value": "d27a3e1080f2a45c78560bf309d3c4a4c5bea06c8b79a2d23d5de054019a4adb6eb0b3ca8e709b7f2515c4c77c57ba49", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025976, "uuid": "9d2f8797-e28c-4813-8ae4-902b6e490ba7", "value": "T127F4BE816E9A40E9F60329362076A2570FED755607F0CDCBDF89E4275FA1CC1827A8BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025976, "uuid": "260a631b-fa1c-48eb-95d3-939c4ee5109f", "value": "12288:kvi2GsFIyZQPVBpNwX4iOwNvte64g1lWA7eLsuAq6Zujk41vO5S5bLHtgMoeZ2Bj:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644025976, "uuid": "21fd0596-5d2a-4440-b87a-a0f79c2482ba", "value": 737708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644025976, "uuid": "9f05361b-7166-48d1-8fcc-508405054c54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025976, "uuid": "a4e0514a-692b-448e-8329-8179067c168c", "value": "emotet_exe_e4_2628d0d476db2b7663bdb2f13b4e029de5985cd23ad4eb4588039d82e783df95_2022-02-05__015252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92f8b7a-8668-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644054515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054515, "uuid": "834b73e4-1586-4bfb-9615-b36fa5e24cc8", "comment": "Malware payload (AgentTesla)", "value": "c8b9518614f52982ee175f42413addbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054515, "uuid": "3c0a5fa3-551c-4c70-b694-3d5f03f29ede", "comment": "Malware payload (AgentTesla)", "value": "29c59a3e0ff7c434c2834b86c3114c28ccf50328e0e2605e3c0bec3f5e9093a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054515, "uuid": "2b7882c2-20d0-43f8-a176-a3c4cf584ec4", "comment": "Malware payload (AgentTesla)", "value": "5b0e4d2aeee1125e99d3cf1669bf7670797975cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054515, "uuid": "1e3658a0-6125-472a-9dc8-2b1d942a9b87", "comment": "Malware payload (AgentTesla)", "value": "1c3a2d00464041fe63ac430bd00f3a48661f6dc67ad68a2a4f5561c6619151282b8cda765d5317f9f831431b6f0afc01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054515, "uuid": "3baa46f2-a842-4075-8e50-3619314e59b5", "value": "T16F9401A53484E857D6D63635AFE1CAF9A375AC884E200A1313F47FCF78FE28B6114166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054515, "uuid": "ea7db515-7714-4937-9235-c4aa5088d76e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054515, "uuid": "ffd78f8c-cb55-4b24-808e-d6011eb0b5a0", "value": "6144:Jw8pfQAGe1D5p5i4k2Hi6nEze5Qz7JZa8b8kuk09MNIKUh:z5QtO5p42ZnEzj7JZa8P4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644054515, "uuid": "f38d372a-0986-4cd3-abad-1f0f21f85051", "value": 442005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644054515, "uuid": "ec24a870-4bac-41b4-adf6-fac7028611ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054515, "uuid": "68bab958-27cf-453f-9e89-afd7da7288b7", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c8ba8e-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086829, "uuid": "83e24ab1-1848-4958-b2b4-a3937ba61411", "comment": "Malware payload", "value": "fee8a8a543264ddb70fa00cfbd10625b", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086829, "uuid": "57d36719-ceae-4ca0-84df-e5db435573bc", "comment": "Malware payload", "value": "29d428eb91fc118a1f7ce2cd0ffbfc6b9e95bacd4089eb6ac3cd1f9c0152ad49", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086829, "uuid": "157cd541-37a1-4c6a-8bc0-16c5da9ccf15", "comment": "Malware payload", "value": "800f9ec17e06d88ecbe5979289e4f67847770561", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086829, "uuid": "41665e2a-1914-4672-b593-402b772b97de", "comment": "Malware payload", "value": "0333b4f0ee0abaf015e0060a08ea2e4ee2bf9865ae8017bc8925327ce30e9fa209bb360e76c39ab616b8ffe25b2d9aed", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086829, "uuid": "62f9b2e1-012b-493d-8b96-b1da7fbf13d3", "value": "T1FD416408F91CE4319922B8C264745E4269E6C873A4394FCCBD468061F0B2F8FDAA44EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086829, "uuid": "47441041-2c54-480a-9e78-e3b32b39a1e9", "value": "48:qzY1AGQ7YNAlXA0Se0R0igP0o0oRNT2jpJmgfHi3XctUQ+6G:JAGSFRA0Se0R0x0o0onGPHGMtNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086829, "uuid": "bf206571-7b34-4d33-8ab6-f22130540ac9", "value": 2226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086829, "uuid": "8f0406ec-79c6-42f1-af8e-cf08d0b144ec", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086829, "uuid": "a7e1eda7-f092-4e7c-bac9-f8fa11455503", "value": "macrophage.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bbfad9-8624-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1644025276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025276, "uuid": "b791f59c-16fc-4dec-912e-e1eda941f2cf", "comment": "Malware payload (CobaltStrike)", "value": "c3f08d24b043938521e28c2eb82538ae", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025276, "uuid": "003ab048-05c1-4779-8329-6c826a580834", "comment": "Malware payload (CobaltStrike)", "value": "2a2edba07e82b994bae95816fd2b122c53af573ec88224434e18a4b4650aca7e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025276, "uuid": "70b901db-d3f1-441e-82f4-78dbadc14919", "comment": "Malware payload (CobaltStrike)", "value": "6ebe6f704c10f0853d788ac36186313a8c2af5f1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025276, "uuid": "4800d2cb-8d50-44c9-9bde-9b67c1ae61f2", "comment": "Malware payload (CobaltStrike)", "value": "fc650f997b8302e1736f1beb0e0c45a9e911c28a4a8eb7a141766a67b9a5bbdd9f80831337497c0234df5780a86a5be6", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025276, "uuid": "e0cb5360-aae9-4f41-8356-2ae98d186846", "value": "T1B7457C85B687BDF6C846473404E253256F76F0409336DB3B3A2CFE380B5BE949E62A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025276, "uuid": "2dbd38db-f004-479f-b355-ff341ab8d9bc", "value": "88ac4bb6aad6785fd60ce5a52cd294f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025276, "uuid": "034f58d4-25da-4dec-af67-1140a716acda", "value": "24576:0oLcm5wuOO0/BlEQUP+2C9teg06aiYEh4SdkYQvHRn5bvVt6F:DLYKS2CbegvaiYEh4CkYQvHRn5bvVt6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644025276, "uuid": "5f247102-0631-4c94-8da0-52e5656f9c85", "value": 1229064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644025276, "uuid": "db888d2b-6054-4747-b9b1-901d200adb9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025276, "uuid": "a3a800dc-a9af-4068-b36a-f09f76c50d9b", "value": "c3f08d24b043938521e28c2eb82538ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ced4fc3-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086948, "uuid": "4e3ace19-5287-4aeb-889a-014e19fd2c08", "comment": "Malware payload", "value": "1defedea5174374180d660693622fb90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086948, "uuid": "c0ff6348-21c7-4e23-953e-76c405b2af89", "comment": "Malware payload", "value": "2a54025910de753c01bb75f146d947f11bb604c5b468094469498bf2b636b800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086948, "uuid": "98a5f351-845a-41ca-af5d-9d3ff26cd943", "comment": "Malware payload", "value": "f8047ed4d150dfd6ae9e8fd5cd6146c960570f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086948, "uuid": "25db0338-db2b-42b8-b444-1cfddcfb78b0", "comment": "Malware payload", "value": "9b0ef2f5568af8bdf7380e8a7d82a6b7b55533d52e26a80aee712ee3d80605d98b53318e74e6decc53ba8065c1212a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086948, "uuid": "baae0249-ba68-4e4e-9ce2-836627edd268", "value": "T1421285032B70FCA8D681C1B240C6F93CED31F99354A8979047D4AE4A3D36AE8DD1916B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086948, "uuid": "2169656f-a0c6-405f-88c1-2191802a0c4e", "value": "843f10e754d72c95e1e6358923f5bbd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086948, "uuid": "b538f754-30aa-4194-8835-5391509d89a3", "value": "192:nPcYoj+49QShcZkgJLyHEeTyTYZKUptK:Pe+4aSYvuykZDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086948, "uuid": "99e48863-f4fe-4ad8-92ca-bc3d582ce815", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086948, "uuid": "8846ee23-9401-4c32-ab94-48755bceeb01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086948, "uuid": "7388069d-1f8f-4385-8bcd-275b61791002", "value": "bush.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c669dce5-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "3d23412f-6eb2-466e-8387-b462489c5745", "comment": "Malware payload (Heodo)", "value": "b10fd33fa5fbb9d3d6cae051c0a676e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "df3908dc-7743-4b4f-97cc-083e3dfdef27", "comment": "Malware payload (Heodo)", "value": "2d34a206491a19f993d563d8a076fe4b7d78bc02bd740133a7f63c80027287fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "3d0eb724-f52e-4484-9603-e400e18a3c16", "comment": "Malware payload (Heodo)", "value": "489e2859e23667db5c84bd6be44a51419c853da9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "c317099a-96ec-430d-8e94-8f6aec6863c6", "comment": "Malware payload (Heodo)", "value": "c60607a7370afc7ea5b5b916e14a24d313ee26ef2d644314328f3954a469a7be357dcb57b1a32669a59ff72c0bd49a4d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "aaeadcbc-e9e3-4eb4-9054-e5dab8d497e5", "value": "T1C525AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "f4b1ee89-1b1f-4329-9e90-8838e74c4041", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "5a3ec70e-e372-4213-b4c6-bce6b95a3420", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxvfFIIm2m42:1ZsYB7vLsnZI1Hb9D2FIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019721, "uuid": "236494e5-0339-4d97-b621-43be7c6eafab", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019721, "uuid": "f2367422-1860-4639-aad4-6d584c17e5bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "b31a1993-b0d5-4dbe-b4b0-41e3a1437816", "value": "emotet_exe_e4_2d34a206491a19f993d563d8a076fe4b7d78bc02bd740133a7f63c80027287fb_2022-02-05__000833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c58033f-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "ca6cced1-9b94-4eea-98c2-c5434a746df2", "comment": "Malware payload (Heodo)", "value": "cef4d7579f9e10b2c446abc8828ab8a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "17de0508-bc0d-4f61-a51e-fa0d74ded324", "comment": "Malware payload (Heodo)", "value": "2dfd7f514bc888c5f0f0630551d8bd272343f83abd0e2c87ddc48398c9e9ef27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "8418ec2f-5149-4ee7-9637-8fdeba87b429", "comment": "Malware payload (Heodo)", "value": "85a02dba8d085139a2e7a17e70f0df5028bc8f1b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "47b2fadd-2115-41e2-aa53-15ea0ed4adbe", "comment": "Malware payload (Heodo)", "value": "8fc49a9192825f7fb92588eb02aeae0a9b229e8d00c358d34037fa7965ea12f6dd171295bc885b973d4b99b13ec44383", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "422e2041-31b7-4dac-9e9d-a88ad4e23b38", "value": "T10B35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "e93a74a3-bd6f-460d-acc1-04dfb94ad8e0", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "d132f408-97d5-43b8-8c8a-de77e7b1df80", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTeFIIm2m40:wfv1GVFF+765nFvFf6dlzzSSFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019865, "uuid": "f9aa5044-5d6c-45d0-a726-655c6cbbd0d5", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019865, "uuid": "6496ad87-d1cd-45e6-9a27-752b79901178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "524fccbd-bf0d-4613-b977-79a435b337c6", "value": "emotet_exe_e5_2dfd7f514bc888c5f0f0630551d8bd272343f83abd0e2c87ddc48398c9e9ef27_2022-02-05__001056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aceeba6a-8696-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644074224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644074224, "uuid": "92302710-11a3-4aa5-b836-429da2f4df4a", "comment": "Malware payload (Mirai)", "value": "00968ee137aeac2f5aa8c80c10c72fee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644074224, "uuid": "877dd3fa-9334-40db-9411-a80fe3c2c2e9", "comment": "Malware payload (Mirai)", "value": "2f9763f23cc13bbcbeb4c67c0115e86d13de0f11cdd267549779fdb58da46a2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644074224, "uuid": "73c5d0ce-a403-4ec1-bae9-b65390767aaa", "comment": "Malware payload (Mirai)", "value": "d07807c0aa1cd0f4e6f4b0c2fb9f75fa57240912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644074224, "uuid": "ab2b6639-8cab-4be0-9a5c-beeb30d04cd6", "comment": "Malware payload (Mirai)", "value": "049f7ad122dd3fe5f757127378d79a9bfc9fc78a021b43ef81053d44f6d7e8f9183293a25af9fde5c82bf7ac54c7a61e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644074224, "uuid": "28645430-a099-44fe-bf34-241bb608beb1", "value": "T1FDC33B97F800DE66F80AEA3601D70B25B630FB714E531A72B35739669E362E47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644074224, "uuid": "ed4553c7-1fff-4c72-a83d-a2cc7fd62757", "value": "3072:d4NdBkJ7gyBMwFy5g9ywevJ3uPpRmmvI0PDGnSQNER:d4TBkNgyBMwfywIJ38PmmvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644074224, "uuid": "50da1e7d-0f4a-46a4-89c6-44b8ac8cba76", "value": 118326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644074224, "uuid": "a1f25f02-1cf4-4533-b142-ea4e2215c7dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644074224, "uuid": "9ff306be-3383-4854-9b1c-1d930c31add5", "value": "00968ee137aeac2f5aa8c80c10c72fee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e097b5e-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "87ce4cfd-87ae-4021-a67d-7d9d73f45103", "comment": "Malware payload (Heodo)", "value": "846dad8d4463943d2de6a6539a3fc1bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "e26198ab-257f-4b84-9933-7205d667ed1c", "comment": "Malware payload (Heodo)", "value": "30f2a183b84dd73fb6f80056f5ec592589bc327f6c44db867eff2107671410ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "5cc28f43-2bc0-4360-ab98-75433380832a", "comment": "Malware payload (Heodo)", "value": "d64235bccc6aa20bd53bdd979f5728d196463556", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "d89e205c-9bc8-49d7-9aa4-822b230ca12b", "comment": "Malware payload (Heodo)", "value": "a3118946421012e99b301e7c26701993e2862426238494049c9fef727eaea0ead9555ff8708336aed7e6bbb40be555ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "e0ccd709-1963-4a56-a6f8-10ded494d3d9", "value": "T1FD35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "955ff1bd-c57b-4bc5-a1c9-0e35ccb0452f", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "faa6d9d4-513c-4cdd-8d8b-e36532443dca", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTLFIIm2m40:wfv1GVFF+765nFvFf6dlzzSXFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019868, "uuid": "721ab578-f206-4666-b61d-2c1a47028ba8", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019868, "uuid": "c9ef760e-d40f-40bb-8ddb-21a13a0deb93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "33797508-6db5-4c11-b1c4-bb1fcadeca6a", "value": "emotet_exe_e5_30f2a183b84dd73fb6f80056f5ec592589bc327f6c44db867eff2107671410ea_2022-02-05__001059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9f786e-86b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087751, "uuid": "52df818e-a5e7-4d22-b08f-b044ccd2f5da", "comment": "Malware payload", "value": "6c34ae09cd4a20604e59d00e1d401481", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087751, "uuid": "b47e5606-6533-44a1-9a12-ebcae42cce64", "comment": "Malware payload", "value": "3244e75a15f7338ace7bc61a0fbd13b47e9635a9c3187b05047c25657b61d848", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087751, "uuid": "3a17901c-81a2-4c0c-a149-e86b27a76eb3", "comment": "Malware payload", "value": "78ec0635231ca05adb1edab86e6068999e479462", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087751, "uuid": "30c0b94e-946c-44c7-b5db-20ec7f3c510a", "comment": "Malware payload", "value": "aa38de86402eb6b5d64b0a1e89f508a069867990a6a3dda0df72448adad40217ef079a1261b5cc4e6e0e19742cbf8136", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087751, "uuid": "b32b11b3-f9bb-428b-8cd5-694f73beca11", "value": "T1E4F0C0162312F3D98BD2434729E54532EF1884E21D39678C4E5CC59753E69360F4D0D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087751, "uuid": "a11307bd-b919-4d2b-83d6-42bc48b4aaa4", "value": "12:9vWdgzn0kK/WkaWdgfsc8nUAZMsd7RedB90t83l:9Agj06IGq0szgr0eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087751, "uuid": "13a65803-bae3-40fe-abda-882425fd10ee", "value": 553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087751, "uuid": "88f22fc8-13f0-4c5c-8848-b53536660969", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087751, "uuid": "c9edea66-3cc0-48c1-9e03-988b9d6f096b", "value": "envoie.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248f044b-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086880, "uuid": "e0a4ec3e-57d7-41e4-8cda-748e5fb3b122", "comment": "Malware payload", "value": "0244946701868333d86d9205449f3e25", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086880, "uuid": "503a3c33-b234-42f5-925a-276cf3cec834", "comment": "Malware payload", "value": "3305b1d8b5b09c67380c57a4f34d2da39388102282b7e75b8188b766d85dc2f2", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086880, "uuid": "fe510a9b-44a6-40ac-b4db-6f1cc5db70b8", "comment": "Malware payload", "value": "c62b90c928f5d80cbd2bdeeca7e4bece74f7efed", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086880, "uuid": "7126be86-0529-4a6c-9e5b-ce322f7c0a6e", "comment": "Malware payload", "value": "ddab07d55faf243d0ec18dd53c45125b4f7407a23678b311190c2bd8aafa9a47108d36ac2d030108de4229fbeffb2049", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086880, "uuid": "3c2b945c-e303-4256-912c-5201b07bdd93", "value": "T19F52147E1CAE237B92B4EB8A8FE48087F090AFAB31105E15B5E717469149A1271D533F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086880, "uuid": "e7259e69-eaec-4514-a260-95814ff45e36", "value": "96:eE3nCvfCe5SH3ZS1xzE86UeJLlaZ5N+wFydtc+fcjDpJeEfjoSG5f5M5p51NIsNJ:eEKfTNaRq31NzhPNRgl223rDSFKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086880, "uuid": "9d6bc18e-f006-44e2-9f91-4f4365b94f8e", "value": 13894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086880, "uuid": "93a96712-5177-4e85-9519-6ddf3493db6d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086880, "uuid": "e85cdba9-124f-48dc-b337-719171769dfd", "value": "YVQAVQXD.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6cdbab4-8696-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644074214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644074214, "uuid": "d821bfef-63dc-4fef-90bd-497d6850bdaf", "comment": "Malware payload (Mirai)", "value": "d714349500f9cc24ca2848c626e31384", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644074214, "uuid": "e56e9ff8-67a8-4dec-9d53-71bd1e9d55f8", "comment": "Malware payload (Mirai)", "value": "337f8dabd72d0c89b7ef7cae1c2bb2b6aa71dcde6c1946e14788e8a2c8d1a341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644074214, "uuid": "5d9785a5-1087-4b38-80f3-65ba4bc960d3", "comment": "Malware payload (Mirai)", "value": "093c84298dc0845a12235e2606cbfe2d7f21e61d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644074214, "uuid": "cc73a3e0-7db4-4263-b36b-628648d9730a", "comment": "Malware payload (Mirai)", "value": "21268d14b34384fc1173de98bf279c32894954e128c2992b7da6c6a67412287a4302320dd5aef2e6d42f1a7ae2b17be4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644074214, "uuid": "bc3f845e-5ba3-41c2-91b6-bbab255dca9f", "value": "T16AB34A57671C0B43C58B5AF52C7737F187AEEA7112E221C5E40EBF801B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644074214, "uuid": "5b77f7ca-803b-4346-a2b0-d6db2e78100e", "value": "3072:9vXHdQ3iQNf8NbWNZpq5hClYtZ2QnI0PDG4gQNcR:9PK/f8NbWpq5hCle2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644074214, "uuid": "346526d5-5f11-41fd-9606-f5275d506c2e", "value": 116377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644074214, "uuid": "85dd749c-8443-4fbf-90d1-681500d93b09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644074214, "uuid": "44e9de36-454c-424f-8f5a-78fc4d16e65f", "value": "d714349500f9cc24ca2848c626e31384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75474527-86bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091740, "uuid": "fe52a41a-7db4-4891-b44d-ab23a4281aef", "comment": "Malware payload", "value": "2dd95121e5bbd18ca1601d69cc736014", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091740, "uuid": "fb497526-694e-42d9-b9f5-0ee702dc99e2", "comment": "Malware payload", "value": "34e12826940655a4bf9f7e175fd04f5e582b2742e225945d3f6ffeea99fa40c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091740, "uuid": "56412019-de34-4cf0-bdf9-285553167b0d", "comment": "Malware payload", "value": "87828b4465729de816c837e0a3ef9b62412d0d00", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091740, "uuid": "3e403302-17ce-4eb8-af3b-40e24cd196da", "comment": "Malware payload", "value": "1f45078203fad0637a568c3f46e077fdf69ff5397d881405296f0688478ab20d686316414e240e7aec8592b6d1e5c688", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091740, "uuid": "aae1a324-76f3-42a9-848b-0105adece9bb", "value": "T1A15111A7CCB038308A27C0BF5D57A19E9ECD395B191D3878BA7D40781FD09D540A14B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091740, "uuid": "bf4a465e-92cd-456f-9995-6b6e193d1a89", "value": "48:+81i0XG8Y4fUTuEZIQu09cs0w5H+R/p5y2CC17T9f:xTW8Y66uYID9sBiRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091740, "uuid": "ff4209e1-55c3-419b-9ecf-d76fdacfe30a", "value": 2443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091740, "uuid": "b7fafad9-10a5-42a7-8fef-7bb417439d6c", "value": "text/x-script.python", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091740, "uuid": "2c09be2e-606a-4c96-a35d-fa08f2931e2e", "value": "darkscrape.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6287da-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644073606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073606, "uuid": "019567fd-8f06-4c58-be0e-408660f8e166", "comment": "Malware payload (Heodo)", "value": "5845d1decff133598d0eb7b2a76275b9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073606, "uuid": "dcc0fe13-ead4-4e2c-98cb-e1d0c9eddb2b", "comment": "Malware payload (Heodo)", "value": "34e3fc26da0eb53a43c83e7cdf85f100a7d1ca52470eafa911dd496875c0e522", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073606, "uuid": "a5800b3e-a8de-464c-94b1-b954e9fdf308", "comment": "Malware payload (Heodo)", "value": "f26c4d558019840ce5487eae033c60a54cd04a22", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073606, "uuid": "3feea016-69fe-41ef-a136-41a1b2d3e905", "comment": "Malware payload (Heodo)", "value": "acea92ea4a680673225ab97ac5c51e02233de9bb341668a55ff7872bec1a42ce966b247f5c2b6b93c9f017fd13a7378d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073606, "uuid": "6fbdb95e-3749-4fb2-bb8b-5221ee92825e", "value": "T1E0A3BF4DE1130EB8F2E5D43AC1485E103BF702CC9842BB57B688896DBE582F9165F57A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073606, "uuid": "88e50fe8-0094-4300-900b-efe01584f5c4", "value": "3072:XhR9cVA3Mqu8hahYIfiQOVOveshVf4KwJQikmGo6:XhRG+MrbtO8eOaDPk1o6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073606, "uuid": "5b2dedc2-9064-4982-ba8c-2dfed82e00a0", "value": 105427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073606, "uuid": "d094d458-953c-430f-9dc0-5f1c6bf6c870", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073606, "uuid": "438a432e-6dcb-46bc-86d3-6e1d41216a13", "value": "List 04022022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f656f510-86ae-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644084655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644084655, "uuid": "3551b44a-c326-4a04-96de-8d0d34926ac9", "comment": "Malware payload (AsyncRAT)", "value": "3ec38241df4d2077cbd6167e2d4020db", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644084655, "uuid": "4fa0a06c-b280-4db3-be76-f8e987a52176", "comment": "Malware payload (AsyncRAT)", "value": "35e366b4c3acb7b4539e83cb0a489a8b31872193183084b1099f9ec638a70f34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644084655, "uuid": "d84b0606-8ff9-4670-a7e4-f5af1c380233", "comment": "Malware payload (AsyncRAT)", "value": "262459e1ab3c626521ea3ceddd6d660f6aa37adc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644084655, "uuid": "64dc84f8-ff19-418c-8bea-0ae2f377ca0d", "comment": "Malware payload (AsyncRAT)", "value": "7f9e442901af3df867187a2d84015278f9aac0d773fce6e8ebc7ee3b51c83022aeec979d2aae20673aa10c977e15a52f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644084655, "uuid": "a97d0207-8e61-4474-898b-1b06408f61b0", "value": "T1111480CE5FD41CF6F1F503708BAD0A56C5327C605BE486AF258DB1693A23E80A5F1B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644084655, "uuid": "c30fddb6-7604-4c7d-899e-e367c97e6d76", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644084655, "uuid": "90ceddbc-2dff-4cef-9d0d-ea1e5cc53031", "value": "1536:1xmqWRQtRpKM5/gR94hUrClTe1Cs5gOcikYz3RuBW3JzUYJK8qzz:LBtaM5EWCrATe1L5RcnYz3hRTmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644084655, "uuid": "beacbcfb-c471-4aa6-8c33-45995da114e7", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644084655, "uuid": "9d547134-6c39-4056-ba93-1d470966488f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644084655, "uuid": "35e17415-6f52-4157-a2e2-4c072ffd7934", "value": "35e366b4c3acb7b4539e83cb0a489a8b3187219318308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e66f6bd-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "f9098ba4-efc5-4496-8bb5-a852bad41921", "comment": "Malware payload (Heodo)", "value": "406ff49d37ca742e1e0e60934fa40079", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "3f59398c-5ad5-458f-8780-d9fb3450f710", "comment": "Malware payload (Heodo)", "value": "360546b742e290d8e95cb53d8e77bbf0e233682bd0909f6dc6a81008fcfabc0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "140cc0a3-1bb1-44f1-84af-2adb6441756b", "comment": "Malware payload (Heodo)", "value": "cbd84c526ccf594b433b7dcdfa0150d64e0db9ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "b05898bc-0b07-4b57-af4b-a3924b1da7f3", "comment": "Malware payload (Heodo)", "value": "5c1115c7bef81cbb6f4dbb13de307dcfa8ee12417ca776506e53e547b2950b04d72fbcd3459fd1dc90b211785076ed39", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "76bde54c-58fd-46ad-9271-8375b48a8052", "value": "T18535AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "986f6a51-4966-4804-9722-bce50184904b", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "9ff6c3cc-be61-4a97-be1c-84a26e30c310", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTCFIIm2m40:wfv1GVFF+765nFvFf6dlzzSuFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019868, "uuid": "80913a44-009b-4861-83c9-92a9205f901f", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019868, "uuid": "cfb99ca0-11e4-4ec7-82b5-29e445568aeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "6c308ce1-8fb6-49e5-9fdb-7b595854118a", "value": "emotet_exe_e5_360546b742e290d8e95cb53d8e77bbf0e233682bd0909f6dc6a81008fcfabc0e_2022-02-05__001100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b95856-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088327, "uuid": "77ef2902-1625-4833-b8ff-3b565cbcfdf6", "comment": "Malware payload", "value": "762645157dbc893c564928edfed2413b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088327, "uuid": "e638567e-e334-4b5c-9e31-da739ef624d8", "comment": "Malware payload", "value": "36666797c56f8fba9a1839607990fb8a556a77bebd6fe8006640997d6c7cf522", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088327, "uuid": "107cef40-1de4-4e57-a496-acf8c2aa7e89", "comment": "Malware payload", "value": "66a67434fd6e3771666e4adaa28fd9b481f2b4bc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088327, "uuid": "a4da0041-ae3a-449d-a33c-ce2fcc45b8aa", "comment": "Malware payload", "value": "27379f36c362dbd9667f30a3a2e87c1156e2b37a40c553bd0dbcd9e68fde16f405bd42b584f8bf153aea9b6075450f64", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088327, "uuid": "1746787f-c081-4eb4-bd1d-75c6a7958b27", "value": "T1D1731740E016857BE743617145B4BFF2A6B73C7B6AD9050B2066B329397F3C0CA8277A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088327, "uuid": "fc74aff8-d0e2-4f30-a898-46f3abcfc001", "value": "1536:ycUroJsDKcosliIhjGLRTFNpwkeKEItiFS1:so4qhRTFNCkWIs81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088327, "uuid": "0ddedf0e-3de1-4448-8607-fb55fc4ed317", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088327, "uuid": "fd5d4227-463f-491f-8cf2-1c44c81983df", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088327, "uuid": "9f30b3eb-f840-4b50-8381-5cdc5f7d6d40", "value": "DocTor.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44aacc86-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086934, "uuid": "8f1ac1d3-b83f-461d-9da2-86592c654fc4", "comment": "Malware payload", "value": "0c6cd035d3c5b84b13d1f54d70bf5fb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086934, "uuid": "b5c66941-de0f-441f-9c84-a6ebca450169", "comment": "Malware payload", "value": "36ee4e185c6b791ae8d38118bd0e00ae3c2135c1bfcd7f3452165a18c96283dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086934, "uuid": "124f7a2f-9cc0-41ef-a7a2-ac8b29aba0ae", "comment": "Malware payload", "value": "80bd3e0ec9c6ab27997d7e55d4b0094ebeea26c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086934, "uuid": "7b264e97-8e4c-48c8-beeb-4405adb93b08", "comment": "Malware payload", "value": "0bffde3fd01a5b7f5e08a4331b21991b03f683ce9359ad20948a11c4ef1338d9c69e17a4a3839decc9d243ba3f42123c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086934, "uuid": "67587db9-ab93-4ac0-97cc-873e8d4216ae", "value": "T15DC11AC755787B67EEC34271747CA812B53F603003BE9BA18F0D24A32CD32815978B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086934, "uuid": "c90a4d23-7b0a-41bd-a6fb-4e731ba9050b", "value": "4d4eacdf80d6577d6931be3e9aff6d30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086934, "uuid": "82c62d30-ba65-40b6-be31-c3b8c0eb6c41", "value": "48:OEP7NaRr+cqzYiqA3vdqMUlqRvhSWqSeJY8JTapF6Bq:nP7NaRNqzYiqL7qRvh/F6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086934, "uuid": "cf8122f5-05ac-47ca-8d81-1d7f75c347f1", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086934, "uuid": "800a71d6-bcd5-481e-89f1-50e3dd92f821", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086934, "uuid": "e3e51f32-63d2-4ba3-87e2-ee4cb85f8666", "value": "Anthrax.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d76ee5-86ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644089785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644089785, "uuid": "a258d1b8-bc5c-4f7c-8fb7-9e8f23b7ef85", "comment": "Malware payload", "value": "d0364603a4c5b580db1e24250008ef7f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644089785, "uuid": "6ecda234-0705-46dd-a816-40daa31a491d", "comment": "Malware payload", "value": "37269aa8dc32117287c63a5f7e627bc7f629e827f86aa9fb35aaa0458ca04f5f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644089785, "uuid": "58b8bd66-06e5-45f5-9029-69b73d1c0f0e", "comment": "Malware payload", "value": "ebcc75bd4f19f9db3f4007f5389581b3edbfa7fe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644089785, "uuid": "cbb6d7bf-426b-4bf6-bd04-43eb12766113", "comment": "Malware payload", "value": "10c3e303cbcd3f663a3f514d82ad2d16708a7ddd2b1fa5e016d47254f3d806d7058a832c1bb43083e08c3f5868381e9b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644089785, "uuid": "fd4d59b4-d016-4b0b-9e0b-7644e9f8103d", "value": "T1A8B302285B796CB1E430373DBD9ED5A32C5806D1809C94B6744BABDCC534E260DBA2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644089785, "uuid": "f748c2d3-a723-4313-89c5-343cdc4bdc57", "value": "1536:Pd37axF49TLqYWSOY4o3C8VseP12QaGZKR3K87ftgfxSS66oXzOVZdIWaIB0x:F3fqaN4LcRtaXR3KUtE4sYzOXPaIBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644089785, "uuid": "2d8962a2-a9ed-4bb4-bc33-c2eb1ff786e0", "value": 117868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644089785, "uuid": "52b5564e-ec55-4232-88f4-972a4f0fc829", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644089785, "uuid": "b027d56e-7c8f-4ffc-9d96-a7aa651bfb30", "value": "DOC-05022022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2526bc86-865f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644050374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050374, "uuid": "0062cfdb-c1ec-4074-b2c7-ecf7cdc80f9e", "comment": "Malware payload (Formbook)", "value": "6ba89f64bcec77330f23b80e6fd2bceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050374, "uuid": "3bb4d9c2-ba8b-490d-b2bc-32beed35b436", "comment": "Malware payload (Formbook)", "value": "37381387ba545bb59dfd52eca6574b037020b32ffb1eb9d97419791ac6832b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050374, "uuid": "2d811261-28e9-49ca-bf73-308b3a037e22", "comment": "Malware payload (Formbook)", "value": "65a4b7f2919282372674ae58487b869aee450901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050374, "uuid": "b028f6bc-73d0-4c5c-b7c5-512370ff1b7f", "comment": "Malware payload (Formbook)", "value": "7230607b4c17950dfe1e5e4f01abbd06b3e376c533b0127b6168eea5b47bddf8ba58efc8a634313bbf3a7f7fef5f8c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050374, "uuid": "61507379-fe50-43d9-93a6-f2e4dfbac3b9", "value": "T160E47B9075A45B55E5B977FC1B29F87003B13D6B98D6D22A0ED53EC73ABCF021A40A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050374, "uuid": "5001c8a4-5c73-4af0-bff8-43f31ca84a21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050374, "uuid": "400ec5e4-aad6-44bd-a101-3dc27fc9f2aa", "value": "6144:1eeeGVoIolKmB9yRMycmVBJV8ed+ro/iXtuD6+fj04vRw0fnBAzzpt37yTah:JjVoHrMjHJV5YoWtuD6+frbBAzzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644050374, "uuid": "36336e3e-d89f-45ee-a153-75fc6f38058b", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644050374, "uuid": "0fe81b05-ae9a-4096-8639-ed6d8f7904ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050374, "uuid": "b7ad971d-f8d4-4510-be34-479b32392245", "value": "Swift_USD 41575.34 . txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7325f10e-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087012, "uuid": "3538e779-5500-40d4-960d-7f9e8eb3e2c2", "comment": "Malware payload", "value": "18651c3df28058b96d1297d1568d4fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087012, "uuid": "3c7521d4-7561-4456-b10e-44901d9f1b0b", "comment": "Malware payload", "value": "381aa23bd498276a12b3255a1539a9af9367f0fb105a6884a63cf923188c2b4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087012, "uuid": "0dde3dc8-4561-4d70-84eb-d0e54a0638b0", "comment": "Malware payload", "value": "b6689d3f64f47909b219b4a17fcae7c3f6567fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087012, "uuid": "4e320f64-981f-4851-acf2-4da4c5b7a500", "comment": "Malware payload", "value": "736651ebd82e32332e30fd6455012c2e0468d94d9e65a38b3d6da419ea04330c1218618b8bcc2aca9c56b5c0b93d063e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087012, "uuid": "36ba7105-8af3-45c4-8481-78c7543e5af7", "value": "T158D142071E84D8C1D441ABB04D8B8E27FDB690705624AB9B0FE1648E6C753A5FC3C56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087012, "uuid": "a39e8902-d4ac-4bf6-ba63-980cccbfd80b", "value": "88b0821d18805894d3d8acddd77e8d41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087012, "uuid": "e0e5b12d-2dd4-4342-992b-51fe34e036de", "value": "96:nPVw7NX0TolrTTN1mTjokSbuBtUlRR5jHhq4BW:nW7NX0To1TTD7RDHhq4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087012, "uuid": "cb590199-018d-4ec5-992d-c9e461087eb5", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087012, "uuid": "8de76e9b-b5ff-4a4e-a634-bb76159166cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087012, "uuid": "d2b0243b-5f5c-4c17-af50-c93d340de84f", "value": "Friends.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d205d19d-866c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644056247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056247, "uuid": "de8e8588-d29e-4781-a309-1a55afe36228", "comment": "Malware payload (Heodo)", "value": "fecff78885d1146fa4771b42987338ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056247, "uuid": "302ce80e-321a-4727-af7a-3520d10738f6", "comment": "Malware payload (Heodo)", "value": "38b7f5767595ab5652d97ce5f39a9ed70884b7992c93fd91825decf7239b516d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056247, "uuid": "2af5d8bc-04f7-4ad4-a588-48aa32c9aa2c", "comment": "Malware payload (Heodo)", "value": "0f8a49d93b8f23b00019a5ea6ccd4f2f50957193", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056247, "uuid": "e286a94e-7b9a-4cb4-b124-4013368e10f2", "comment": "Malware payload (Heodo)", "value": "b58aeba70a557ba009f48ddcaf9d4546671f96aa2553d073391313a60d3fad8803d50bc74dd287de68ad8c0f4433461f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056247, "uuid": "734c8fa2-75bc-4539-bd18-98d63743c77f", "value": "T156943B3C25619C30CBB638F765F956E7C18F6C368BDC1A9B5BFD01276D28E808938946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056247, "uuid": "0988a276-393b-444c-befc-e3eec12aaed6", "value": "81bbe15a668dc4ae3d5f7e44db90ba82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056247, "uuid": "7124ade9-5fb1-4bab-a084-19ef5a32de7d", "value": "12288:BKx9m9TwSW/eFj5PWWWWpUUUUUUUUUUUUUUUD69f:BUmhwSWW7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644056247, "uuid": "27e6a023-4b55-41ab-8ffa-ea0691461fca", "value": 420854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644056247, "uuid": "5202c61f-14c1-41f6-a259-f023658ff7c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056247, "uuid": "e180a64c-8aca-4d61-bb91-f8a717c92f66", "value": "emotet_exe_e4_38b7f5767595ab5652d97ce5f39a9ed70884b7992c93fd91825decf7239b516d_2022-02-05__101722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3a4038-86bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091941, "uuid": "4ee7b75e-301b-4eba-9392-00cab1d7657f", "comment": "Malware payload", "value": "b7f7ed86d457fec2493db21e8886b981", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091941, "uuid": "f337c383-375a-40ba-96e3-3bfe30f674bb", "comment": "Malware payload", "value": "3ab8f56286e915dcf5656d8ecba063be06bc9dcbf23139f67a5bac0a413494fc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091941, "uuid": "f8cdc22f-d6ed-4844-a6d7-fcbfbf064617", "comment": "Malware payload", "value": "5f1c2e11b84ac3df1e06f9dc290c3706735b8065", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091941, "uuid": "284726ea-b3cd-4ecd-a038-2feb75e56034", "comment": "Malware payload", "value": "22bfabc00ebc6e489141013009e5811c449b3025b589ce8862d8123a4d324ae0ed2f5ecdd0479170edcc32191483db6e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091941, "uuid": "1fa57022-808c-44c7-9443-7a9c5ed56ba1", "value": "T1E1037414B2E5EE17D75606320DEBDFEA6735BC41BE01831B718477AE2C39A60CE92B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091941, "uuid": "a3fb2225-689f-4b7a-80b0-12436fda93d0", "value": "192:pns6yzzzzzzzzw8WIb0dw7VEeETH2fzUmDvPfR5kIWKE7a8GdqlmottgnSja9g+H:Js2yQmLPfRiI9FemotuSjig+H30jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091941, "uuid": "067e9914-37a0-4a28-bd1a-6761b1aca039", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091941, "uuid": "a483d5c4-43b2-4df4-9558-635781a49ef5", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091941, "uuid": "2b9100f9-9c40-4a33-9f47-ba947ca1333e", "value": "HelloWorld.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db62e52e-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075161, "uuid": "d6794bfa-57d2-4a74-879a-e9c4e91f1893", "comment": "Malware payload (Mirai)", "value": "72817937ba47887daf8575823c70a324", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075161, "uuid": "76fe38e3-930d-43da-b8e3-b1ffe4be8d21", "comment": "Malware payload (Mirai)", "value": "3e06216a4c013f0cc866e83eae380469aea8c96717841edff636f19022a5fba6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075161, "uuid": "45091d61-5de1-4367-9622-686381f6f468", "comment": "Malware payload (Mirai)", "value": "38c2b0a0eb1152d6d9ddd323094aac1f54e16239", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075161, "uuid": "559bfe1b-f1df-4a18-8339-52ad9d3383ee", "comment": "Malware payload (Mirai)", "value": "6a35f22aac8a8947849479882ea082b6dd2d0f748ca79c6002d48154aa0213a2d5ddc3618d03f02091e6d79dd0ed8d52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075161, "uuid": "07968a7b-1c72-4a6a-8084-874881f63998", "value": "T1B3D33A05D8909767C7D227BAF79A428D73236B68A7D733115A28AFB02FC1B9D1D3D060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075161, "uuid": "84158e21-d1f4-4387-b0c4-b6082736a380", "value": "3072:PVfpQ+d+pceQGfCbR7ac2XRhWOiwzZeG7n45hLuz37mU6BZdD8mydQCYMhEFg:FbR7aRXRhoc745hLuz37CbYmydQCYMhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075161, "uuid": "3e797f0d-ade5-4b36-b1fa-89df02f15b28", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075161, "uuid": "a375965b-2ad1-4969-afdf-62ca96770ab7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075161, "uuid": "e02b33c9-1ccc-4a0e-bc33-fd9abdc57e40", "value": "72817937ba47887daf8575823c70a324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51318021-8654-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644045723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644045723, "uuid": "c0ac234b-0dbd-470d-8f7f-edf73bde0631", "comment": "Malware payload (Gafgyt)", "value": "0c3e05cf8ade66c7071b2e48b668ee01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644045723, "uuid": "b3a76b14-32ba-4091-813a-15bcd48fb7e1", "comment": "Malware payload (Gafgyt)", "value": "3e6afe701022cad79ae0521c3d28dc3586610fd3b573d76b16052ee12d6ad948", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644045723, "uuid": "4ed118c5-5f5e-4d0b-9310-9a2fd23bff20", "comment": "Malware payload (Gafgyt)", "value": "6d5000acebdc949c165cb9976f87cf6497a8eb29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644045723, "uuid": "a717d79d-ab6c-46d6-9a19-cb4224013bd3", "comment": "Malware payload (Gafgyt)", "value": "51f801e0c8c235447c3b089264015d06ae0dade16027f0e5a26b775ac3eb2e68ea4a3405d3030f0c07b0547511edc119", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644045723, "uuid": "38a8eb1d-4b47-4382-a363-91465e24c4b4", "value": "T1F533F1D74209C5B3E973E732D0730545F3A7E364CEA53961260CBBB21E6349386BA923", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644045723, "uuid": "9e3464c7-bda6-4594-b154-e96e4c8b0640", "value": "768:9/tQSbKB2URSZ5e1g251IuzUC8Njxq61tvaq3UIs/fjd3/D8B0fycQDkX0nD:QSbgcUg2TFe3xNs/5378B0aJkXYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644045723, "uuid": "67ecc02e-e759-45ef-9f8c-91e617407334", "value": 51532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644045723, "uuid": "5061a805-7e2e-4e99-b456-cb1021ec4be0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644045723, "uuid": "c0e2baaa-3a25-4b3b-b3fa-e6a55725ed6c", "value": "0c3e05cf8ade66c7071b2e48b668ee01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9077bdd2-86b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086632, "uuid": "5038319b-236e-4f0f-b7af-ddeaec765f31", "comment": "Malware payload", "value": "f3394c9d36263b10e37029031ffbb5e5", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086632, "uuid": "f64a92e3-754f-4a2b-bcf4-e5be0ffab270", "comment": "Malware payload", "value": "404e2308e0e046da4acb97bf4dc8ddd97c4589374343f9e18287722b2b352cc0", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086632, "uuid": "0168472e-dd5c-4d24-9ae4-c32aed619c07", "comment": "Malware payload", "value": "52c41db1986014839f62ef769d8f2e347a267147", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086632, "uuid": "aea949ec-d6c7-448d-b71e-0004d02851fe", "comment": "Malware payload", "value": "8f010945031e99aee8ab861b4a0a8ba516debcfcabd1d7c9bc085a5299aa8336d42a7db5564674f67d7f63214266faaa", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086632, "uuid": "2b6d9fe0-0d16-4175-882a-5f6edef0aa22", "value": "T179419D797E02EEC18692DDAA993DE10C5789C36734B29D0C0FA3F2E1A8E27C0C244748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086632, "uuid": "38678634-9d4c-41c5-ad8d-49f829cdce53", "value": "48:aIwN18IrOq8IGbO3wZ8IGbO3vWJ/OKbURIaXRZqwpbzo:sXGQKGQYHWI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086632, "uuid": "1fe31f8a-3d7a-4578-9643-cebdff152385", "value": 2070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086632, "uuid": "4ad07055-b13f-4498-bfbc-030cb13b47b7", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086632, "uuid": "4cac6c36-15ca-43c9-8433-781011d72a79", "value": "Quatuor.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5724a4-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "57d9420f-3ef0-4d37-bc7f-6dc0bdc8d996", "comment": "Malware payload (Heodo)", "value": "34972e2c555c639f1017913e3c803c35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "33b65c06-ce41-4a42-80b1-7a90060d3b85", "comment": "Malware payload (Heodo)", "value": "405a90f5a38d230c777abf5b744aa525f213981dc800aa4fadbf056627b448c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "86c61143-80d2-46bc-952a-9d5b7e98ad10", "comment": "Malware payload (Heodo)", "value": "b40a3f0aa0d6c6d0bb396bf4956d216c784170a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "16b57f82-7b39-4a89-a7b1-4c2b4df97f5b", "comment": "Malware payload (Heodo)", "value": "41d6dec6e978104afc10d6eddfa8d0e45b8cb19ca0b63526c8aabadab3e1cd00970255911ee573c06a9005b40935da07", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "98e86952-36f8-42c3-aeda-87bd477e3734", "value": "T19A35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "460f465e-a9ed-41f3-95de-2f5f8da8ebc9", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "c7e03536-67e4-4ee7-a275-e29babd89afb", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTRFIIm2m40:wfv1GVFF+765nFvFf6dlzzS9FIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019865, "uuid": "51039ea3-e759-4f42-b549-911b12007c09", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019865, "uuid": "c0c1cf48-243e-43fe-b7c8-2d83abd087bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "7313f221-905e-4b79-899c-eea19c168f14", "value": "emotet_exe_e5_405a90f5a38d230c777abf5b744aa525f213981dc800aa4fadbf056627b448c4_2022-02-05__001056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f692d29-86b2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086120, "uuid": "de97c753-f910-424b-9a1a-48faa261b3ba", "comment": "Malware payload", "value": "eb7bea183626119bc54c4ab1de80c606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086120, "uuid": "73f90e65-ccf3-4fdd-981d-38675990be62", "comment": "Malware payload", "value": "4091dd3ca88a4b61113a489e156ca5fbab3fbc531bea92d548c084423a756263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086120, "uuid": "e1f61d5c-e014-489f-a2f3-b5625728100f", "comment": "Malware payload", "value": "1f022ad7156e8d510168b7ba441afeb966edb828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086120, "uuid": "e02522ad-4b2c-4fae-9b34-08db5e1efb07", "comment": "Malware payload", "value": "7ba28a568965ffb107bc1163202926ec3b9a916fda69cd0c8171afc65d9e8f0ba68f4897835776fb27f77a59a689fed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086120, "uuid": "8b14cdb9-44c1-40dc-8e34-54db68e2204b", "value": "T111421C177A829DA1C8998FB467F2AE18FCA7E0A03375A69D33084DCB55370C0453D7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086120, "uuid": "fa2d60ed-cb56-4150-826e-7127e8b5f1a5", "value": "021bbc7d6ad34eb255b4f3ceaf536034", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086120, "uuid": "b97755e4-e9c3-4199-a3fa-74168c3d4eef", "value": "192:noodBphIwEbFxLYu/2DRfub57an7uQzHMpap3r:okdcFF0cb57alCM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086120, "uuid": "a0b331e3-9045-456b-98d5-d2a005d33b36", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086120, "uuid": "63fc0ffa-b48d-4cef-926b-04c6eb4a3c8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086120, "uuid": "d553df20-e051-40e6-947f-987237b7fca7", "value": "MALOTEYA.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c596de3d-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019719, "uuid": "a2d49c8d-781f-4336-b73e-961eaaa1c301", "comment": "Malware payload (Heodo)", "value": "aedbedd0dacd48cefea405c6d108b6aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019719, "uuid": "af509a0e-920a-4a2f-b699-4cf74943ca2a", "comment": "Malware payload (Heodo)", "value": "40dbf2176c0cd9e9ca58a3cccbb434176f7d0300287fae634e828f2e0754219f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019719, "uuid": "8bd324df-622f-4307-80a1-03e12f319fb0", "comment": "Malware payload (Heodo)", "value": "cdfaaad569c20a7aa4457f708c40f95930a6df9f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019719, "uuid": "df5ab5e2-19d1-4b98-ac4b-8898a50572eb", "comment": "Malware payload (Heodo)", "value": "d2e850a837081847c409f880dc4682721d0170f661711d76d23cb7f3149e0959fc27892d22fc5c2ecbef551e27b9e9ed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019719, "uuid": "91be0e8f-9ff2-4464-a99b-4e1152df2470", "value": "T1B125AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019719, "uuid": "3cfd9f1b-1fbe-483d-928c-700ba69624ab", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019719, "uuid": "6638d7c7-c669-4c4a-8da9-1315b01c1a13", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxRfFIIm2m42:1ZsYB7vLsnZI1Hb9DcFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019719, "uuid": "6569572c-d16a-42fd-856d-f0695abf2ed2", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019719, "uuid": "909f898a-00fb-41a3-b043-dcf920f6c72b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019719, "uuid": "4050f54b-65c5-40d7-bad6-1dea76279c03", "value": "emotet_exe_e4_40dbf2176c0cd9e9ca58a3cccbb434176f7d0300287fae634e828f2e0754219f_2022-02-05__000833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4265637e-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075334, "uuid": "f0728edc-479d-4c2e-a713-0c1a57cd0278", "comment": "Malware payload (Heodo)", "value": "479d14f0b8b9c1ee4863aaf95fd451b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075334, "uuid": "619d989e-9c45-4b1e-861e-cba1364d36c1", "comment": "Malware payload (Heodo)", "value": "410f19d61f4a0ef8f2ab236e8c12a1bdb56bfa686edd346134a63314ab22279f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075334, "uuid": "2df690af-be04-4008-a4dd-8573283761dd", "comment": "Malware payload (Heodo)", "value": "75c958526a3b200669f7f603b46126c8357d5c65", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075334, "uuid": "7934ac17-5896-492c-9b67-59133108390b", "comment": "Malware payload (Heodo)", "value": "191b1b7db6c723611d07c33e20b335d1abf4738059a3886723108ecc470ee5956731c71de2f1ff53e36b311f16e4ffc2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075334, "uuid": "363e3b76-d342-4ef0-bcdb-f1b237d9f709", "value": "T13835AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075334, "uuid": "f33c2463-eba0-4444-b551-d9a9f4cb6e87", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075334, "uuid": "ea7faa66-08f4-4f54-b875-a63b7a875ec7", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTcFIIm2m40:wfv1GVFF+765nFvFf6dlzzSoFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075334, "uuid": "f40932cd-5cd4-4e2b-a161-eb0ecb0430f1", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075334, "uuid": "01027043-f822-475b-a471-774033c1bc67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075334, "uuid": "ddd4e510-596d-4d5c-b55b-62353370d531", "value": "410f19d61f4a0ef8f2ab236e8c12a1bdb56bfa686edd346134a63314ab22279f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433c5c24-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075335, "uuid": "6bca28a1-d080-4b18-b589-76de892d0f69", "comment": "Malware payload (Heodo)", "value": "3bfaa87b2173de325941c50f9576bffb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075335, "uuid": "d725f3b6-0ac6-48de-a4e9-43d2e03661d4", "comment": "Malware payload (Heodo)", "value": "418f7abc2bc6c6860b95aadb7b9998568eec05d9be2cd98296ed5c358b79e2d1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075335, "uuid": "729d1a59-f8f4-44d3-a0da-d08f8c09034c", "comment": "Malware payload (Heodo)", "value": "ac01a13f419505721a1b8e150834ca0895d9aa70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075335, "uuid": "e3ecee87-97b0-4b00-b308-3c20df375e7d", "comment": "Malware payload (Heodo)", "value": "366cdb69486831e7a8d53b4da59fb45858be975de61bb8a7b27535a1a238d4ba975d9ca278d2359254e396bdd31bf1c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075335, "uuid": "519c0c22-afcc-494b-ac40-18700709e1dd", "value": "T13335AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075335, "uuid": "2e5306b4-db8a-46fc-b21f-ae0168b2da73", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075335, "uuid": "89d0ce44-5a83-4391-b86c-6b8b883a9cd9", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTpFIIm2m40:wfv1GVFF+765nFvFf6dlzzSFFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075335, "uuid": "b976a288-5765-43a7-a08b-a219be114a36", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075335, "uuid": "712eec3c-416f-4104-a0f6-8f46195e4311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075335, "uuid": "66d42bc2-e568-49a3-988f-868438300657", "value": "418f7abc2bc6c6860b95aadb7b9998568eec05d9be2cd98296ed5c358b79e2d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dd56ca-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "7635989a-b5cc-46cc-a481-135fde1045db", "comment": "Malware payload (Heodo)", "value": "29ffa1072d9309d3cc01a929fab7e2de", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "18c6bb3e-c15e-47d9-938e-0d83f791bade", "comment": "Malware payload (Heodo)", "value": "41d9bcf5b5bf513f128dd81cfd4d8aa05197012ac8ecf89733eb2015c92e3fcd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "4ca3e986-5a96-46c5-a9bd-0c3e10c0c86c", "comment": "Malware payload (Heodo)", "value": "62cc659ab4fd369d16e6f0f95d496d76bf256efa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "aca07715-53a0-492f-940d-fa05b2958ee2", "comment": "Malware payload (Heodo)", "value": "521bc731cdd58bef6a9119d2c0b7b188a9b82219f42f94ce8cfe218abaf82faa4d12cd9ff72b1cf939673472b36ddd7f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "623f4bdb-fdb3-42df-b044-d5506e767b59", "value": "T11D25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "10e8b464-80f9-4c43-a411-4be63fc9501c", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "178ccc56-bac2-40ef-abb2-1ea0bfcb063d", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYx6fFIIm2m42:1ZsYB7vLsnZI1Hb9DRFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019720, "uuid": "321283ed-68ea-41db-bd55-d26b7bd829c5", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019720, "uuid": "15e9f650-b9ac-4980-b12a-923796dc53c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "5e53318a-9b93-4b71-b2d4-5226f1ce9244", "value": "emotet_exe_e4_41d9bcf5b5bf513f128dd81cfd4d8aa05197012ac8ecf89733eb2015c92e3fcd_2022-02-05__000833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d97a29-8666-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644053724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644053724, "uuid": "30543d42-62b9-49e3-829b-91df78de5c8d", "comment": "Malware payload (AgentTesla)", "value": "8de6b08facbedbd101675907ef4adaae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644053724, "uuid": "77e6b55d-e90a-4d86-aa22-ad2842410185", "comment": "Malware payload (AgentTesla)", "value": "424c124b970ba979ba75657b3bc8b4f588053258fc86d433307d490aff985563", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644053724, "uuid": "19464a11-d143-47b4-a501-6097db41c709", "comment": "Malware payload (AgentTesla)", "value": "ef3f9528c2a5377f794519ef49bd3372c7c453a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644053724, "uuid": "55393457-ec24-4733-a966-13a5cd8d2bce", "comment": "Malware payload (AgentTesla)", "value": "1e7253b85982c3881d68770c596d0bc9d8d57fb2ed71b480aa8f41af6b99e828630489af65d4376c1e558dcc298cb32c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644053724, "uuid": "056544bf-cfc6-4f8e-a7f6-f2d159ff4ec5", "value": "T1BA35B59D321037DFC86BCC72DA591D64EBE0657B931BD28398A306ED9A8C957CF140B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644053724, "uuid": "7856fdc2-373b-437d-baec-59cac253da0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644053724, "uuid": "04aaafab-07f2-442d-8381-bc25a19b7fea", "value": "12288:9MZgu3e8aH+Zy0zYBmjdNdgaqUQOQ3FVFE/F00Aq1tKubm2Oe1U+Xferfsl3uorG:AguU0dNdTQPU/F00CuqxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644053724, "uuid": "61b0ea78-cbb4-4a09-b7e7-8d63572a8e9d", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644053724, "uuid": "3d70c4ba-58c9-43b8-a71a-08b07931c59f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644053724, "uuid": "f88da7b3-76fa-4e10-acfe-83a696c781bd", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111e6f1e-869b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644076110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076110, "uuid": "2449c895-e0ef-44d6-9baf-7f96677b7464", "comment": "Malware payload", "value": "a00b8f8bc69f5c71136f4f4dc60e6ac0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076110, "uuid": "a892d1cf-f5aa-4545-a84c-da3c3cb25704", "comment": "Malware payload", "value": "427abc2035bd94beb2512e021757f81b9fbac201eb72018296889a8509e56072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076110, "uuid": "888be779-c50d-4c45-9639-12236941385b", "comment": "Malware payload", "value": "8be1e7ea88fff28314d0d52ded564bdca8654ce4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076110, "uuid": "74d0d331-97fb-4319-b877-be50714da60d", "comment": "Malware payload", "value": "3d1f1ea10046eccf556273579f265bdc133c5935136dd1055f487760a27231d42f586453111b885f1a7dbb232f3227a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076110, "uuid": "ad4845a4-d5c1-45f1-be78-fa4a64f3d4a6", "value": "T16AF533FA9E3096B8C51CD6F0851F668878BFD96E7A05F0795C1F4A228C54E02D33A52F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076110, "uuid": "ca76a3f6-42fb-453c-a9da-758b9cd58b6d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076110, "uuid": "212f5c68-255d-4d3a-8531-25b79cc94446", "value": "98304:xKDWbWOckSntMTH1HjpF1Lb97UUiWnxuS1B34kF:rbKkwtMTVVFVybUL1JxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076110, "uuid": "26975a08-ee06-4a63-b908-c7cbf98a665a", "value": 3455163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076110, "uuid": "d59c1066-e737-4b56-93af-694f0c5feb47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076110, "uuid": "a273982d-82f1-4334-beb3-1ded7ad506fb", "value": "a00b8f8bc69f5c71136f4f4dc60e6ac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b2135a-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075338, "uuid": "2d52aa00-ce30-45c3-8d30-2cc8c95288c5", "comment": "Malware payload (Heodo)", "value": "b37f50aa5a22538a5fef9a47a80e542d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075338, "uuid": "fc7c504e-61f1-479d-a0bd-c00e9735ed40", "comment": "Malware payload (Heodo)", "value": "430718fc79c8fa2213e740b0e643b9e44f30716fdc2914989da2bbe95eab642f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075338, "uuid": "ea1dbf35-9def-4958-bea4-018583e42ce8", "comment": "Malware payload (Heodo)", "value": "e9c36e8ec9fd51661f0bcb3fcedf8961848e62b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075338, "uuid": "08529501-9930-4c50-9ae5-d96798bfb365", "comment": "Malware payload (Heodo)", "value": "c323cb286365e71f2ffa198fc1a74f5a4d1c9a07ced6fd05017d28dc1de8183514a84df39d6926a4db389becea8f12aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075338, "uuid": "c3e4aaf8-081b-4e0f-a64d-c00574df19a7", "value": "T15C35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075338, "uuid": "34cf88ad-c486-4d5d-b77b-fafc847f788a", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075338, "uuid": "bd7a60c4-677a-42e5-a6da-89c938f9c933", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTGFIIm2m40:wfv1GVFF+765nFvFf6dlzzS6FIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075338, "uuid": "ecf1c4d3-1349-4d94-8b32-e40839f173f6", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075338, "uuid": "1cc9229d-bbdd-495c-a0c8-e220dfc23f03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075338, "uuid": "af9e3122-6453-4a9d-84b6-3c23bbdf41c4", "value": "430718fc79c8fa2213e740b0e643b9e44f30716fdc2914989da2bbe95eab642f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddccbe2-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644073608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073608, "uuid": "1597be13-3136-42fc-9019-cb2e1e268e21", "comment": "Malware payload (Heodo)", "value": "167bd280ba98a5c6f680e6e53e8e31f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073608, "uuid": "bc086a63-cb77-4ffa-b946-fc1805f40b25", "comment": "Malware payload (Heodo)", "value": "43b4ed4ad8f1db64c9c1d3401f647f196f22881e0b640f837988b7dd52749ed5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073608, "uuid": "5212829c-90a3-4296-8f75-80aada14055c", "comment": "Malware payload (Heodo)", "value": "e1dcc4586da6eaa7f75873682c148cf0bfd496dc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073608, "uuid": "e79de4dd-9e00-4012-8f14-3954c190bda9", "comment": "Malware payload (Heodo)", "value": "838eac39c6fd633dc7ce6f640705995ff63f8fd202008b9f011cc2ee3831fac9ff6ecb0a23b0738eb9d9ad4f935b7d24", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073608, "uuid": "cc7dd598-85f5-4b4f-af76-1130aec6a940", "value": "T1F6E37C157245D9FADA04233109CB8BFA3627BC438E7583E37249F31E6F776509AD2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073608, "uuid": "a3fdc0f8-2167-4456-a19e-930cca59dd22", "value": "3072:KcKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgX4LcF:KcKoSsxzNDZLDZjlbR868O8KlVH3yehL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073608, "uuid": "7c83821e-023b-4fb3-9f1f-c75b41ca354d", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073608, "uuid": "7f4d3b8c-1f6a-4d48-8422-2852f4ec4ff3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073608, "uuid": "d74e2720-d845-43e4-9965-757a182ad633", "value": "Ommega Online Publishers.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd4d822-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "540b0d8d-da08-424d-aafa-e38dae9370d4", "comment": "Malware payload (Heodo)", "value": "0eb41f6fcd0336786b85a5ff1123485c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "979f1af4-9eda-4479-a909-6c3df9948f6e", "comment": "Malware payload (Heodo)", "value": "43edb9169dc4349e7593077bf55d8f52462e3a349fc411ba621b28314769b22c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "229e4670-07d1-4afa-ba45-e29994ec16af", "comment": "Malware payload (Heodo)", "value": "3eff30b697c974ee0ef4390c69472adaffe3d072", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "cebb7e45-e673-40d9-9a3a-da2608e68bde", "comment": "Malware payload (Heodo)", "value": "78a29e478a0dfd3ef27a6831b91793abcddd5fe75e7b9a15b2d6f95e946746c0e41698ace9b5d59a07a0261bebf72e69", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "ded11a67-4338-43b5-a3a9-579bec0911a5", "value": "T1FD35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "8b215358-294d-40fc-bb02-b31a7c1453dc", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "849347dd-f40e-44d4-9dbc-868d9eb569b0", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTcFIIm2m40:wfv1GVFF+765nFvFf6dlzzSAFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019866, "uuid": "0422712d-30d1-4a4f-9e00-2a730606f3f8", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019866, "uuid": "26183877-0f53-4cbc-ab3e-4d0e5b0b86d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "eaf8f6d3-46a5-4bd2-96ef-7921bd111395", "value": "emotet_exe_e5_43edb9169dc4349e7593077bf55d8f52462e3a349fc411ba621b28314769b22c_2022-02-05__001058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ec2dcb-8689-11ec-9275-42010a9c0029", "comment": "Malware payload (NetSupport)", "timestamp": 1644068770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644068770, "uuid": "bc81d50b-59d8-48f5-93a6-e28963852852", "comment": "Malware payload (NetSupport)", "value": "140b590a7a3372c660744c03dae14b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644068770, "uuid": "5b86c0c3-c0d4-4960-a260-4340f36c7ecb", "comment": "Malware payload (NetSupport)", "value": "4462791b16636d3c286bd48038c417dc8341904b676840aa5ee638380f133d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644068770, "uuid": "808cd2cd-b433-4772-8ac9-b36c66b2d557", "comment": "Malware payload (NetSupport)", "value": "8527d29c3df131b059b72ebb1bd52e66c50a9f5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644068770, "uuid": "aaba65d4-fa30-4bff-a535-a41a06fb3c88", "comment": "Malware payload (NetSupport)", "value": "15feb03865ad2a085544fdcc95bc4d32b231af2dc47198ac23a5cc24c612212a84ff1ac3c07a3e6dda261115d4d846ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644068770, "uuid": "8e290681-527e-4c84-93dc-f668d895c577", "value": "T139953383B3E758F9D7626731ADFA7B51D4BBF939397264848B23025D39215C29A08F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644068770, "uuid": "71a4aaed-cf67-45c6-b600-ef18cec8417a", "value": "dbb1eb5c3476069287a73206929932fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644068770, "uuid": "ceeb8874-9ce2-46fb-82fe-ca2703097f0c", "value": "49152:tL5gl+/VBlA15JEKnBPEDY08BTGvSNElvgb:tFj/VPgEKneY/BTXNElob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644068770, "uuid": "3ed749d3-3e6e-4f70-9c76-83d4381de7d9", "value": 2001209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644068770, "uuid": "0dd41911-2f2b-454f-b1f6-c6ae9c4aaf47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644068770, "uuid": "624000e3-3c6e-4957-8bbc-2b9ade5f9a34", "value": "4462791B16636D3C286BD48038C417DC8341904B67684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732ae347-868f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644071121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071121, "uuid": "5f206a7f-ce3a-43cb-91d2-877701271892", "comment": "Malware payload (SnakeKeylogger)", "value": "9d3ac23068a6bc1c255cdf34aaf3b87f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071121, "uuid": "c51a263d-edb2-45ab-9fac-81c94d51e94a", "comment": "Malware payload (SnakeKeylogger)", "value": "45e312e4970ffbb379bb5a35a5e8b0ba0551da19f45f98ff77bc6d386128ee03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071121, "uuid": "7c489c5a-bb58-425f-8ab3-e80cd3391425", "comment": "Malware payload (SnakeKeylogger)", "value": "e580f11cf35f13b0acb735d8bdea16b08a5b7236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071121, "uuid": "e50a5ff1-652d-405a-b49e-556d9e39697e", "comment": "Malware payload (SnakeKeylogger)", "value": "209c4e8e0b570ad04858379ad2cf065cbf37b398e78cd880d375b4ed422cd8a4cd416e48767543e6b4f8eb76d3838630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071121, "uuid": "27297a75-0724-4a37-ae9d-a12659c8d888", "value": "T10F6412263794E92FC9AE2133DCDB2E0457F87597A597D31A66CC72CCA4633E30506A8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071121, "uuid": "ce16156a-6c6e-43f9-a15b-7764b54e3fa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071121, "uuid": "8384e47b-5ea4-483f-b011-9eaeec2c1bf2", "value": "6144:vPHEzMkM9zW0qod86Kz7HXQngVAJn4xhDPlJgNLW6vDh/:vPHEzTuqKC6gQg+2fbet/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644071121, "uuid": "53936a37-7e00-4efd-9ca9-28d0e79d81ea", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644071121, "uuid": "4795401a-7bb7-4021-ab0f-2461e179043a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071121, "uuid": "b7a359b4-0a79-4ce9-a96a-7edecbda0b0a", "value": "9d3ac23068a6bc1c255cdf34aaf3b87f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ab1597-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075339, "uuid": "b15437b9-12ed-47a0-a115-5ee05f90f4cd", "comment": "Malware payload (Heodo)", "value": "8266266dfdff0d59eae24d0260159c6a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075339, "uuid": "28610c1f-8d12-491d-acb3-d94be8175f82", "comment": "Malware payload (Heodo)", "value": "45f2b258fa7586ebed93c8605e9f4ad7dee408c5260d6942f2e8c68d48945662", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075339, "uuid": "48578ee8-07f4-4ba1-9d68-7de85acb9469", "comment": "Malware payload (Heodo)", "value": "e786ae74c4f143bd6059c5528b08464c0ced058b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075339, "uuid": "f2fd9aeb-63ab-4583-afa9-7595d50f75e0", "comment": "Malware payload (Heodo)", "value": "9692344413c94c34b0670c69beec558885b2a23a54f5c2760e5ca15db3750da865933f87393cb12d3988cdc37a3abcf8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075339, "uuid": "8024161f-5ee4-4ed4-be86-59fc5fcb8c93", "value": "T13C25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075339, "uuid": "eb995033-38a6-4943-aadd-519789f0127f", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075339, "uuid": "a42d8e27-b085-4f8e-bb54-027fa3439d5d", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxEfFIIm2m42:1ZsYB7vLsnZI1Hb9D/FIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075339, "uuid": "65bf02b1-cefe-450a-9c19-e885b1b53f3c", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075339, "uuid": "d7f66a2b-e121-4ab0-a29f-9d4f5e2fd76f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075339, "uuid": "5dcc6fc6-8f57-49f7-8dae-ac843ff973df", "value": "45f2b258fa7586ebed93c8605e9f4ad7dee408c5260d6942f2e8c68d48945662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501c5581-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091248, "uuid": "c9b91a36-892d-4209-9adb-883030deebf8", "comment": "Malware payload", "value": "079275bdaf0058642f3b062b3aef4de3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091248, "uuid": "45baf588-34af-4fab-b860-1925a06ad5d8", "comment": "Malware payload", "value": "46a11a3b520a234a4408010d57a0bd28589526f3248e16fc71ccf4cf8db31595", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091248, "uuid": "c5da7720-d3e0-4546-b62a-e0e36fd6e494", "comment": "Malware payload", "value": "0fe4a31077176828ec545b7ca3c5e92ea59a7352", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091248, "uuid": "8f47f1ac-1c64-48a3-af6f-09204ca1c223", "comment": "Malware payload", "value": "e9d8d4cb794a4dcd275173155b2022fe19fa41ab2342ec1f19976075bfb606b48384b604e09b4a6d5c0a64b0b7698c9a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091248, "uuid": "4dae125a-1581-43d5-9a29-1ea4eeedb7be", "value": "T1CA53822936A6D607C373C6704DF6FAD76634FC626DD0861B3D82371E0A7BA019D82729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091248, "uuid": "0a6f7091-3748-40fd-948a-66321d898b9d", "value": "384:qvZgWrvDkQFOkbTYwdxnidwI0ALbguKz72zh3m+M2O00jOtKmy5AKuJ1C:s2QD/OkooxzALDA+bfKxuJ1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091248, "uuid": "cd3bbd6a-66d3-4010-8e38-878be3b2c760", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091248, "uuid": "2359eee6-3ce7-4b36-a97f-56eb9dd2d70c", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091248, "uuid": "3fdbd281-ec9a-4b93-bdda-2ceef75a63c3", "value": "Twin.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f8ce86-863a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644034507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034507, "uuid": "26f3f210-32b8-43b6-bb27-8b6e35edd00f", "comment": "Malware payload", "value": "dd37c06a353b9873cffefb86079d7ab0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034507, "uuid": "5b68e37a-227e-4bf9-8f77-641428705714", "comment": "Malware payload", "value": "46c71fa9cdfc8bb072a8739ce03a6e824b4cece53e149382f21e2d4640cf7838", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034507, "uuid": "b672e4da-8a6a-468d-9f5e-471f199fe26f", "comment": "Malware payload", "value": "af002d6fb72ba23dd65b9ba0a9ec3b6afc67fa4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034507, "uuid": "0eb6d27b-8747-4155-b200-1c3bb75f1b35", "comment": "Malware payload", "value": "797a4ef8c2e83ac9a06a596211a4d50e0fe7add04952da3f478cb67e6b9b4940b454ce95b09d2b11294c61bcd3b1a6d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034507, "uuid": "ffe84aaa-65c3-4862-9234-658fd33df656", "value": "T177E65B027AE0DD29D0756732C7624CB073AA7C59FE53C3DB18ACBB9A3571B426D0472A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034507, "uuid": "abeebe35-ce16-487c-be08-397e16321664", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034507, "uuid": "8e9a829a-4db9-4307-a589-909cae90b093", "value": "393216:/ngBZW4F4ta4CMY+qa+4BEOQCoW1fj6aK4:fgXW4F4E4CMc4Bs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644034507, "uuid": "876f0094-4eda-4ea5-b47e-f1d16359ea04", "value": 14538240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644034507, "uuid": "ab03c612-f1ae-445f-ab60-9911e7eb6fe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034507, "uuid": "447c100f-5851-4e11-bcd8-1266293a6be9", "value": "dd37c06a353b9873cffefb86079d7ab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847347d1-866d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644056547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056547, "uuid": "63ffe7d0-3a42-45a5-8eb6-04ea5304590e", "comment": "Malware payload (Formbook)", "value": "da77969ead7e90e19b0720ca0573276f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056547, "uuid": "bfc7299f-86fb-470c-a358-451ea56bd850", "comment": "Malware payload (Formbook)", "value": "4748460c7c757eda69a0340104939b382231567cf559315494901fe2b122900c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056547, "uuid": "fed82657-f3a2-455e-9a17-09df0b970865", "comment": "Malware payload (Formbook)", "value": "1236c7b91fb17edd29a0c0a9a2b9ee32d7fec64e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056547, "uuid": "20b2cb4f-2975-4dbf-a000-b39573130715", "comment": "Malware payload (Formbook)", "value": "fb5afcc6ce6a831205429522aef752fe57ff948c88411db0c48c4d1c491bde54334fdddb36c0354d12aad8ff6480f59e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056547, "uuid": "f5d78a68-e5af-4ea3-b929-16ce133c3342", "value": "T191C4BEB0B0969554F1A6B43C5F69F87803727EE398D7062523E93E0777FCA131A0899E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056547, "uuid": "7f2b77de-6de1-41b6-a41b-c6a7542f96bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056547, "uuid": "3826e0e8-bc4e-42e9-8dfb-fba59a782831", "value": "6144:EENSLs+vjZGNqBeAbC1a1218bQ5/eJhjDMOUCLW0cGa+iq/MRUxhaf039dfgCU7U:1SLs+0meAbC156cwfU92ERLf89dog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644056547, "uuid": "997a8e4f-4d37-488c-99bf-10be29c171a1", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644056547, "uuid": "d1798353-50c7-4d6d-b29d-8ec685bbbd4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056547, "uuid": "ce9e2d31-4782-49ed-a1ea-09942c692dd2", "value": "MT103 Receipt. txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ad7784-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019723, "uuid": "3755778d-f10a-4ec7-b2d5-3e4f43d4c64f", "comment": "Malware payload (Heodo)", "value": "e6609c8dd61d69e741ee9556cce4e1e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019723, "uuid": "2994ec76-4ab0-44a6-9c2e-3535f4bcc47d", "comment": "Malware payload (Heodo)", "value": "488fbfdb3fb3dc3d862fed72ed0aa551f6d1e4e66289fdd6779ec9f672142a47", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019723, "uuid": "46cc5c06-44f1-4bc8-8952-848ad778b352", "comment": "Malware payload (Heodo)", "value": "0fa511c67cbe9043a650047944df07eb6d228183", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019723, "uuid": "8682ac5a-b91a-46c7-bf0d-05b621188206", "comment": "Malware payload (Heodo)", "value": "d0ae6758f4601e00611d99b265978ded5b8b5c97ba679d448f2679390f6797547f7a0c1d24cab74ecde5c944ab998408", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019723, "uuid": "d967c10c-fa1f-4039-a183-41a27df208d3", "value": "T1A525AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019723, "uuid": "b7a8fc74-b596-48d7-acab-d8737fc454fc", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019723, "uuid": "3949b1b5-c4aa-4a09-ad7b-d46057c40a50", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxUfFIIm2m42:1ZsYB7vLsnZI1Hb9DbFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019723, "uuid": "27e9dd1f-98fd-4654-ab8d-e10ff675d1d6", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019723, "uuid": "91d27351-ac81-4e07-8d70-5c999457257d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019723, "uuid": "d90c2ae7-e403-4958-b891-fcca671422b5", "value": "emotet_exe_e4_488fbfdb3fb3dc3d862fed72ed0aa551f6d1e4e66289fdd6779ec9f672142a47_2022-02-05__000836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d1a19c-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075170, "uuid": "4c7ea851-755f-4c0b-9d85-0ea23994f69d", "comment": "Malware payload (Mirai)", "value": "e2b302f5497b12c5e1cc5374f72bff65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075170, "uuid": "a7e07e8a-7c43-44c1-884c-3407b38ce0eb", "comment": "Malware payload (Mirai)", "value": "48f72842d897e37c8f9b02e3b792720587d53111a5d1b63f11274fed9f0de252", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075170, "uuid": "f7c8f3cd-a231-4e7a-8212-b054e8416f17", "comment": "Malware payload (Mirai)", "value": "65a72db6691f24e1a8381c2d6f873491a1f25206", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075170, "uuid": "ef3d7c97-cd69-42fc-b480-9042a1a10bfa", "comment": "Malware payload (Mirai)", "value": "46923fd292ce86a60c17fa982cfe30600e3830fd8fc632991f50bf84f73aed70fadd0509e7fd9694dc9b3a194e52c088", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075170, "uuid": "e445ab13-3d31-40d8-9e71-ec12eb0b7e83", "value": "T159C30805FC404B27C7E23BBAF79E438D773666586BD733116A295EB02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075170, "uuid": "56efeb99-4be5-4f23-9eb0-6283f65fe198", "value": "3072:UJDq+6lJQTnoo3PKeP3qkx7aV5hLSeuXe6DU2oC9DQlD6ObAF5R:C3qQGV5hLSeuXBoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075170, "uuid": "cc79e428-2ae5-497d-9a14-36a27325445b", "value": 120779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075170, "uuid": "fcf2997f-e45f-4cb5-9678-1ab09ff07727", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075170, "uuid": "1cf4a481-f24f-4a11-acf3-86c270f7dd4e", "value": "e2b302f5497b12c5e1cc5374f72bff65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb4c6aa-86b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086763, "uuid": "67965397-1caa-4ade-af94-0efe9a3dea2a", "comment": "Malware payload", "value": "4ec0004fb7f700df736ae4d3c2c22919", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086763, "uuid": "64cd9327-e24b-4d6b-a034-6d61a1138bfb", "comment": "Malware payload", "value": "495049d52f98bfeb1c56fed4eae09c0365f33c630f58806d4a46d1862609a12b", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086763, "uuid": "940ec1ea-ce82-4ae9-a4be-1f2f116ae003", "comment": "Malware payload", "value": "464dec7db3865638af142f5e8929fcd49e5af667", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086763, "uuid": "24f5d09b-dde3-49e9-88a3-6b0f2d4e7fd3", "comment": "Malware payload", "value": "b61331355ba22a125202c6524441ef3f0a2331cef2e305a9b6b1dc5cab8d67c6ed82e597dfe7cd2f92577b4115708ffd", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086763, "uuid": "6ce70af8-1bc1-4648-bd81-3f76cd893766", "value": "T1A781EE10FE00D8AD8863A186B452A8CED23146E7F5A08DD53D5C9872EB35FACB0744DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086763, "uuid": "bdbe71e5-a80d-4d29-8fb4-ea47724c731e", "value": "96:JQA4ccUlqJU2vbqKDK8KqKo0CDaVgjNVpyJBSEutKVuT2fGQ:ZAJU2v+KDK8KqKo0NgxVoJNKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086763, "uuid": "0218f8a9-2a2b-4071-827d-d60c2215ec7f", "value": 4085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086763, "uuid": "3a0bb1b5-cb94-4fb7-936d-02e8c2e81880", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086763, "uuid": "46718c92-621e-43b0-b52b-907ffdc86fdf", "value": "embargo.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857bc175-869d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644077164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077164, "uuid": "85bc6640-64dc-4dd0-bbef-746e3cd0d776", "comment": "Malware payload (RedLineStealer)", "value": "acc41c1813b8be51f743722983a34433", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077164, "uuid": "12a5a050-e6b3-465a-8e23-86508ac337b7", "comment": "Malware payload (RedLineStealer)", "value": "4951979c61129c8e58a18dfa428d3a0fa872f6b9c28101aa5d12d4c71fa45ced", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077164, "uuid": "8081748f-c064-4e3d-a700-63ea6523859b", "comment": "Malware payload (RedLineStealer)", "value": "71102086fb7b74b2312a0dc6ee53e1db39c7d6f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077164, "uuid": "9014efbe-6a88-4835-b309-eab007df59f4", "comment": "Malware payload (RedLineStealer)", "value": "36a566c529f811262df7212982d7488bc04628e204e202cb6165954bc53231b8ddc57a207066e82834161e89c0a5e782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077164, "uuid": "b8b483c5-77e2-4c16-a1b7-dad3c3fded14", "value": "T1BF65331B71B2050DC4AF3DBC0BE58B6594CB923C7A9DA27BB30E1E5941E8633E78548D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077164, "uuid": "ed355172-1894-485e-b6ab-8b584d70a417", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077164, "uuid": "da52fbef-d784-419d-99af-74a623ef0850", "value": "24576:0yrCaMjb42s7OKKuwYEaha+UprOWaUTy/Po1zTJWkEaHNYK3Q7oy3NVzLi:FrCaMP4z72u3jerORUTy/4RWNamU6NVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644077164, "uuid": "7d4b0398-c364-4d05-9317-394148de3dec", "value": 1463296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644077164, "uuid": "7fdeaf9f-f3b9-4d30-9865-cae0d1704b72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077164, "uuid": "dfa6cbb3-60db-4c3e-b9dd-0bfd9f051bfa", "value": "acc41c1813b8be51f743722983a34433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268788cd-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091178, "uuid": "82b8343b-b6df-4361-aa64-901e53220efb", "comment": "Malware payload", "value": "bfce6a179fa853c4c0a5bffc6b8c8f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091178, "uuid": "1de3293d-5290-4d7f-96cf-81204e4ecd77", "comment": "Malware payload", "value": "49dba7924254a61f7abe42ea0e003dfedbc033d50b49277d73b96d7e06b1736e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091178, "uuid": "fdc3df8a-d920-4ee0-97c8-3cf0a568f86f", "comment": "Malware payload", "value": "6c8f1623c5471d556003928c15bf670175fc4d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091178, "uuid": "748b806c-02bd-4225-abe2-d349896efbde", "comment": "Malware payload", "value": "36b790cccb46362ddd31b4823925c3b705ec8c387d8ff3f3a1ef0cbab831b4615af57af7d0b9c93f9d95f9a83af37905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091178, "uuid": "7d015f44-2e3a-4d96-8cac-746120bbc0da", "value": "T150D2F2C3784CC2C3CFC16AB60A1A8DD43331D2543EE71A8A07577074BCD8977E968A99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091178, "uuid": "ca7438be-2e13-465d-bd72-908e7be861a9", "value": "57a5f17fdb496fd18f0ffc2e16aafe57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091178, "uuid": "5b2f3244-e45c-4ce8-b65f-b122a4d1400e", "value": "768:SPAOUzPhiGUGzgn0DooHD09f1x01/oAPi:SPYLhyD+fDmG/xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091178, "uuid": "39d47e94-7289-4aaa-ab78-678fc043ce19", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091178, "uuid": "c3d40c24-8f2c-406f-b7af-ddd2ddbdb6bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091178, "uuid": "8e978ef8-eaa4-4a2b-9d0f-10ade85d8815", "value": "Last.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4039495-861e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644022804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644022804, "uuid": "7b1a6113-1ad9-4a5c-b1e7-7c9f797f5c99", "comment": "Malware payload", "value": "36c1d0b15077d6a63c59e16e7f9d35e8", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644022804, "uuid": "ec1d6c58-30a4-4ee4-bd7e-83a7bc797014", "comment": "Malware payload", "value": "49f8916ad8729c6089cadc04bc75d92fc8c0fecda382262b4adf2d89ed99f1d1", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644022804, "uuid": "de06c14c-f5aa-44b3-834b-895a28ab154a", "comment": "Malware payload", "value": "0848bdaed2067289838b0a06438624bf15e71b49", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644022804, "uuid": "3134e816-c67a-4f58-b029-487c0c7ee1b6", "comment": "Malware payload", "value": "1dbf84e47695f5f43a9881c86f8335c638061a31f5fa4cd3678821cbf2b576eab5b0d28dbbdc9bf90abf51dcf8092c45", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644022804, "uuid": "c13c2598-3cd9-433f-bcc2-5b8affabfeea", "value": "T1C206330C239EF8FDB89A0A6C3B2289B0C5E452F5DC4225F396391544093E57E5BDFA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644022804, "uuid": "e35ef1a7-03b4-43e2-a6e0-dbb650adf92f", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAD:0XSxVJG2fLAqFOfT9sMYNM29SAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644022804, "uuid": "6fe3f895-d38b-47ce-8902-edfce795a051", "value": 3866624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644022804, "uuid": "ee8992d0-3c39-40c4-a922-9e929ac70e56", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644022804, "uuid": "0838dfb5-cf46-4a42-b051-1724aa8941f1", "value": "49f8916ad8729c6089cadc04bc75d92fc8c0fecda382262b4adf2d89ed99f1d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89db9ef-8666-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644053708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644053708, "uuid": "a30f9ce7-c629-4d70-960f-5f3c9cec9fd6", "comment": "Malware payload", "value": "9670d870074386e728e13f4721ceef81", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644053708, "uuid": "d35a47de-1753-45e6-9a28-39cfec8065ae", "comment": "Malware payload", "value": "4ad0847fffe421bfb2a356855d208e6c27e42a4a70d603078675dcdbd1612c28", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644053708, "uuid": "0457bf0e-e629-447d-9c0a-f6b318c966f0", "comment": "Malware payload", "value": "45ab6c9807b15d3db368973771d83ff12120b44a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644053708, "uuid": "a4f11403-a3cf-4db4-a14f-55a79af2ed5a", "comment": "Malware payload", "value": "8a6b8aae2759fc3e8b20accdaa7449c73cf8bf341b58f277e0a9c08023ae7a3386614cefa2c2ffccc639412d6b09b99a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644053708, "uuid": "7b3a6d1c-05b2-4911-b2fb-d284c3a5d9e0", "value": "T173D51215CA63FCD0DD4A8071B8EF4FDD6A9104E28AF162374672712D7CA35385AEB70A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644053708, "uuid": "fa639675-fa3b-4b68-b68c-697a279a9c8a", "value": "49152:rPctdtUtD6wJjM2M7xZk1PctdtUtD61JjM2M7xZkWPctdtUtD6AJjM2M7xZk7Pc0:rP04D6+jkxYP04D63jkxDP04D6OjkxuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644053708, "uuid": "e4ead479-43f2-40a5-9e15-22a367e4d189", "value": 2831864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644053708, "uuid": "19af5ce5-491e-4107-b631-71407a771030", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644053708, "uuid": "1288d444-5c23-4864-8c8f-5fef70ae0c56", "value": "com.termuxhackers.id.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5bbd38-869b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644076099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076099, "uuid": "3baf9aa3-8ba4-455f-a98e-5c6219e017aa", "comment": "Malware payload", "value": "105a7f1e9f623633f1b1439cf15f58be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076099, "uuid": "138d06d7-f764-404d-adb7-304be802baf9", "comment": "Malware payload", "value": "4c20cb035c923c914c129daa6f7dd77c24d3d3ad58f09c89a12d8028405bb5d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076099, "uuid": "1452202b-204c-4260-a897-05159393500a", "comment": "Malware payload", "value": "0fba1e00864607102f82c7e2cdc14856851da104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076099, "uuid": "495eb6fa-fa3a-49a0-aeaf-0491a2b29cc0", "comment": "Malware payload", "value": "286852610e9b807c186208c99530fb90ee2e41639984561e1797fc62eb128a8d8d75fd01d51f15d351f6a08aa0674d4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076099, "uuid": "7ef7544a-f042-495a-84d8-d8a0205c85f8", "value": "T1C45633DB52676C8BE8D684733379481253ECAF997D2AC0DB1FCA3C5299376C46489BC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076099, "uuid": "6a152ef2-3438-41c8-8e0b-caac35d8868a", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076099, "uuid": "ab064387-fa5d-43cd-94f1-ad8e108c3da7", "value": "98304:xQs9Wbj+PYz0eAmQgr0+PiLKixqsCDnUpjDVRvrZUPtdfXZmCR6KrMkxAyETxEvg:vW+PYweAme+6LKix7CDnAjhRz6v9R6lF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076099, "uuid": "013d6801-9959-4196-9ed8-6e9ca6f9e20b", "value": 6003857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076099, "uuid": "17ece260-41dd-40ff-8a45-4d2193509076", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076099, "uuid": "3dd6a60b-07c8-4cfb-a0f7-fb7bc1051de2", "value": "105a7f1e9f623633f1b1439cf15f58be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe065d4-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088530, "uuid": "4f5effaf-8fdb-4a81-a1b5-5cf6698c9873", "comment": "Malware payload", "value": "c9103a19fecc9f28dda136a81899d2fe", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088530, "uuid": "56aef73d-3458-43cb-bfea-31c2ed1650fb", "comment": "Malware payload", "value": "4c7c2f2844974461532b32adea283728e737edd2c65dd7b6ac66f2325de78461", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088530, "uuid": "b4473122-26db-4bf1-898e-16f89c9f8517", "comment": "Malware payload", "value": "e06a3a4da1ce93f9005977877c85733a057da4e0", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088530, "uuid": "4714ed64-12d0-4b22-93fc-444a7763444d", "comment": "Malware payload", "value": "8dac55be6f026a0aafba18cc9fcd2510d50842d6c76092fb9fa913711440bb481c15cb4a35b63719ae7423b752db5887", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088530, "uuid": "76961996-be8f-45e8-b575-a79d56f1c672", "value": "T179128602BE65FA6F103331833982D44DEA24CBE7F8545ECC244CDDDA9615AAC6E749C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088530, "uuid": "a08c01c3-029b-4a52-96d5-e155c4960324", "value": "192:hUgVmvgmlxtG/Q+PojmF26Ut+LTXhwyPF8:hUgVmIDoQ0t+LTXhwyPF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088530, "uuid": "3221488d-a6a7-4202-ada4-59ab87bd628e", "value": 9766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088530, "uuid": "9c5f666a-90ad-4a9a-9da1-efcb732aabce", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088530, "uuid": "a54ae0b6-8028-49a2-b547-5de48448ae3a", "value": "PetiK.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fb6f76-86ac-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644083638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644083638, "uuid": "83d02020-fdb5-4730-a15f-a5128c7a091e", "comment": "Malware payload (RaccoonStealer)", "value": "c1f6adaef5a1ad06eccb097e0db2f4ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644083638, "uuid": "f99a51d5-b21c-4152-bacf-ac0f56d10cd9", "comment": "Malware payload (RaccoonStealer)", "value": "4e89904593d8709d655956623fedffb7137ece77ea70c4097e8f4390952c7f4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644083638, "uuid": "a10a82d5-bb83-4f26-9b09-7826a63793a7", "comment": "Malware payload (RaccoonStealer)", "value": "551e598a8ee715eb308e067ec6ffb0fd913661fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644083638, "uuid": "3abde8b1-3cad-4a7d-9e24-c8b65a393703", "comment": "Malware payload (RaccoonStealer)", "value": "7c25d311a91659539dae98b5f3db07f5ab05b29db03f1d05d40265caa32fa2aaacd2f392a8ddce9cf9b74960d0776798", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644083638, "uuid": "b2069fe6-4498-4eb7-8a68-8c4eb7ae555e", "value": "T134E4F110A7A0D039F2B712F4457A93A9B93E7EA25B3461CB53D52AEA57347E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644083638, "uuid": "a6f2520b-c371-4a20-9eb3-db6d1ab47a66", "value": "6ead9ab276ce8c02b6a68102af313c21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644083638, "uuid": "7956720a-44aa-427a-9bf0-58d67d1acc74", "value": "12288:fBCT7pKG9WfnzQSPxw3ePNasrjRz8rH3KmqClXZT0yXzPKao21NFPeL/9td1mrRW:iIlzQUw34zFIDKqX2yXzPKq1NleLt18W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644083638, "uuid": "f7019f2c-5200-4706-b8b1-b6e23335a0b5", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644083638, "uuid": "c1cc0e0e-bf61-4c05-be02-6f7d905ba162", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644083638, "uuid": "b2c7c045-bba3-475b-9b98-31b35183c0cb", "value": "c1f6adaef5a1ad06eccb097e0db2f4ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e43fa0-8689-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644068740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644068740, "uuid": "18cb15b2-ed84-4d72-bf9e-e7f5f3da4908", "comment": "Malware payload (RedLineStealer)", "value": "ee7d9e163ae56f174fc0f4069837f027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644068740, "uuid": "8d0cff7b-50f7-4346-91fe-88cc44d2133e", "comment": "Malware payload (RedLineStealer)", "value": "5379c83b35d84600a7786806f15c3d6ab30e7b8bbbd4fc37b2d31898dcd6fe87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644068740, "uuid": "374919b4-c4af-4e32-b0bb-470424ad613a", "comment": "Malware payload (RedLineStealer)", "value": "dedc681f66c2e971b6e606c6ffda0d026c1142ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644068740, "uuid": "e1f7f8aa-88df-4345-ab30-94eeefa9f348", "comment": "Malware payload (RedLineStealer)", "value": "bf3ba7cc5b176293c5377c3c28fe3d1c6e6176656c67bf627c3b1a0bdffee797d75d657d5e8de2f9b2269a5d15ef1e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644068740, "uuid": "7ebc33cb-c63c-4cc7-9df2-c9ea4e58057c", "value": "T1BF063353CA60A08BE685A3BCB17762D31550ED7D70EDA12E01FA494735ACCA0F9FC6C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644068740, "uuid": "edc0f7ba-4876-4a97-b004-aa759dbf685f", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644068740, "uuid": "04f25cb6-4fc4-4afa-9716-4622522e5261", "value": "98304:U3Cay3Xxpze5tko/BsTMvl0cZNP3lTe792ghVB28jY:l5xF2tF/9hxeZhh5jY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644068740, "uuid": "fa09a92b-4f31-4ad2-b2c4-0a05a7d65158", "value": 3724952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644068740, "uuid": "26578931-61fd-4588-bae6-05e457cf8b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644068740, "uuid": "4b90b073-d951-4384-93ba-8885da92a326", "value": "5379c83b35d84600a7786806f15c3d6ab30e7b8bbbd4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a526bc-868f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644071009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071009, "uuid": "e420e5d4-426c-4b1b-92a1-8edf90317311", "comment": "Malware payload (Formbook)", "value": "267b21b2d3bd00eca024ad3778eee8f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071009, "uuid": "4b693be1-3f99-4a22-90f8-602b87caf991", "comment": "Malware payload (Formbook)", "value": "53a883b8f26435986767ae5c21bca0bb7cdd1e121ca7ccf85ed31ae2157da1b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071009, "uuid": "20f2687b-ca95-4e31-b47b-02719cc33f0a", "comment": "Malware payload (Formbook)", "value": "e9ffbcd2ec3cd90d75134218545087170dd02b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071009, "uuid": "e7ac9e0b-96b0-474f-812f-324a92d34531", "comment": "Malware payload (Formbook)", "value": "ddcf7e08f23bc1c8c9e02a1567863b22187660515211a266a6570b0add09c15330c52a9fa491e45a9deb8677c2ee5a75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071009, "uuid": "3aa817cc-20cb-48af-bcf8-97eebc439846", "value": "T1925633C4479C517DE1EB25314C2B9A3E49F0A24E3944C7E35B40CAB91CA397268B7BBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071009, "uuid": "d05ef396-b014-443c-a98a-13154b745062", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071009, "uuid": "061b6e76-8994-4e70-a846-060f441c7210", "value": "98304:Y2+ewHsfI42QPLXJ+Qgxas3eIEgtX1U5qbBbaOjqoaou0mfqEZr2PLdzsF+noDGh:YBV2PdbJ+Qgxaqe1gtXqUhjqGm2zdze+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644071009, "uuid": "3840812b-7d1b-49b7-9501-49e9207e9f90", "value": 6139901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644071009, "uuid": "dea53c3f-312c-44ff-aef4-d065bee63313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071009, "uuid": "e3c134d8-a971-4fec-b68e-82fec9b878f0", "value": "FieroHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949f1386-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088357, "uuid": "01d9953b-5ca5-4ed6-9148-0a011e70ec36", "comment": "Malware payload", "value": "8865946e640bd48c30fbac059bacb8ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088357, "uuid": "8dfb99df-cfb8-4b9a-8545-301660e53877", "comment": "Malware payload", "value": "53c410dc3ae7b59a0116eb7e2611fe59426d6b1d616b1b56c24fbb12c588ba92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088357, "uuid": "a6c706ff-3758-4cb8-938b-c03992be8e14", "comment": "Malware payload", "value": "b0a9d56179b4883ef47f3636d0e98d1aa6ebec4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088357, "uuid": "0bfb7857-4042-402e-880e-1fb717098106", "comment": "Malware payload", "value": "1cb4763ed1224fbcbfea7634746953ea1faa7fcb56c2c584e48f7c0f8dbd4bfdce77f1768d2d8f5e419bde6d1f1f3ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088357, "uuid": "a32b0160-4785-4fff-a6da-1d9922c0b008", "value": "T128922E23BA5C9472F68D43B28E63CBED05167C300A418E1B7D8EBF6E1D3424299E175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088357, "uuid": "80c4c5d5-ff46-4701-8f4f-2c67872315be", "value": "ff3511f1b970b1e47d5b631e43f7f69e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088357, "uuid": "5d0496a7-087c-43c8-b144-1648871c7121", "value": "96:+gnEDRMBGBdxC5pq4TpS4El4uDG/fzgGBXByA7pzqD9yEWgKBEb2:PnEDRLBdxYHSKWVGVB9AD9yQzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088357, "uuid": "0c94d985-f1c5-41a2-af42-d02487c9ae76", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088357, "uuid": "0c05a13b-be33-40a7-9eac-d7cbd0362fe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088357, "uuid": "d4601425-7b2d-438f-bfbc-d0686a8a6bb4", "value": "EMM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448713a9-8639-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644034106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034106, "uuid": "74d56010-680d-46fc-8b3c-1fa2d937d687", "comment": "Malware payload (RedLineStealer)", "value": "6f58578e216f3d72de5be95b498cc8e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034106, "uuid": "4c7b398b-4181-41ee-9f47-791b01f19d97", "comment": "Malware payload (RedLineStealer)", "value": "53d1708d666d49dcdd2834d91de3f2bfb61f7263a5e3213635d6e893d28e5bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034106, "uuid": "84008426-95f6-48c9-920a-5ec123430606", "comment": "Malware payload (RedLineStealer)", "value": "942e9171183c5ea3ff435ac546fd14ae0dd65214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034106, "uuid": "427f2a6f-f5fe-44fa-a13c-8abdf6453da5", "comment": "Malware payload (RedLineStealer)", "value": "b7617abf8e5ac6acc10a8793c53f6475f682c224bfde44d6cc02a1b7144606f0c02e417736d0703b2c15808982f101b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034106, "uuid": "923e1e54-cdef-4766-827f-4c400ee40339", "value": "T1CE06339F82B0AF2ED483253C324E55429B9C4224B29155DEC2FAE3167748ED73977CE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034106, "uuid": "b9754606-ef40-4312-8935-a57434d83d82", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034106, "uuid": "5fe72c97-4a79-432f-8269-cbf4e4943935", "value": "98304:BVO18f5nYi7BgISAsk6HvoJMDYHnm0s3Wxq:fO1g9fY5PInmnGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644034106, "uuid": "34f42436-bf48-4abe-bb3f-36da81ed168f", "value": 3712152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644034106, "uuid": "fb70b3d1-3511-4058-9050-53e6ff6c0ea7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034106, "uuid": "93a26aec-b342-4cad-8e61-f040e4615c3a", "value": "AVG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc50034b-864d-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644042924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042924, "uuid": "ee390ec4-d668-4f77-908a-041d10fccff9", "comment": "Malware payload (SnakeKeylogger)", "value": "d4d81bba8bab18d15667a2a5d6ce919f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042924, "uuid": "8a82adb7-b045-48aa-b541-52424d0fe8e9", "comment": "Malware payload (SnakeKeylogger)", "value": "53e9973155c868272af8c6c551d4e8430339d8f71e4e06aa76852f98ac4ae6b1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042924, "uuid": "25906abf-fa9a-40e2-8016-77c9e6c094b8", "comment": "Malware payload (SnakeKeylogger)", "value": "7f09f2924d98843d5017661b520762cc5513c178", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042924, "uuid": "847db491-358b-4399-8d6d-00430e0719c1", "comment": "Malware payload (SnakeKeylogger)", "value": "b4fe230a76e267543a950e31dd966c6a488caa33c3d4d9fc7552328708daeb762f3a269cada8ee291f29a43c6a8a1656", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042924, "uuid": "13474498-c662-4247-9540-0c9ce047d672", "value": "T1186423DFB86D891CAC115225105E77DD17193ABEAD3D403F86468CACE10ABEC66E34C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042924, "uuid": "d8f443bb-bcf9-4b05-a49b-0cab7f4eedd2", "value": "6144:hgaxo8KgUk/gkZ+OpjtYwQqBKDMOzHGRcjCeZTx88HObpgkkzhhd+btjKxowJGVc:y8olgUkb+OXYwQqBC5eGTxmTkN3wfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644042924, "uuid": "bc4165b4-e383-4bef-84cc-33f9fb4bd0a9", "value": 329998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644042924, "uuid": "50b5f0b2-8437-4b6d-b3ec-2d974d6626b4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042924, "uuid": "8d91c516-f30a-4d99-aec0-c213adcfb257", "value": "BE415054 NEW ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097f6f4b-8669-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1644054623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054623, "uuid": "ce8ad59c-7f28-4e70-bc9f-ccc71ef306ad", "comment": "Malware payload (Tofsee)", "value": "3be36d70147939871dd072c1fe791168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054623, "uuid": "351614d4-94ae-4153-9fbc-770949850c6f", "comment": "Malware payload (Tofsee)", "value": "549953d5db2a4646740e721e24ec1b7fa57ef6c4d72ffa32752b17d4a65c36e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054623, "uuid": "72ba1622-41c1-4cc0-9115-733f4fd56388", "comment": "Malware payload (Tofsee)", "value": "43ce52a09ee2c0f3197273c0acf8afeaf0bf9b54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054623, "uuid": "0b10d791-0762-4153-bfdc-38319aa2b32b", "comment": "Malware payload (Tofsee)", "value": "77925f436dca0ef2f7ac66acbd0405f4b1733a95bf45741181a9544b77788338f3831a58a0ddf906e15ed5c9477b2caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054623, "uuid": "2629771e-8b13-4fe6-9591-56ca5273dbb1", "value": "T1871633A4DCF86147CEEE53791933EA5365CABA82F8097B3D7B0023E5EC744824B25587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054623, "uuid": "224d984f-17e0-4c7b-9f10-b48331c9a882", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054623, "uuid": "bbff4e7e-7ddf-400e-931e-076fbf713b29", "value": "98304:JSGOpo0uiwHVzzb6FsKu+dwpJQP3/iiEMN/a4NJTcXvceVEw:Jco0uNVnbKsKu9iiVo/bmvcQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644054623, "uuid": "8e377df4-f2dc-4b61-b321-6e73b2a4b785", "value": 4157276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644054623, "uuid": "8b9d794f-5207-4fe2-aaab-153d010ea18c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054623, "uuid": "10e22ff1-27b6-4205-8422-f9d988c27c86", "value": "549953D5DB2A4646740E721E24EC1B7FA57EF6C4D72FF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9c4b8e-8670-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644057960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057960, "uuid": "3c02e56a-9ea3-4325-b2af-c6e7e70ba2af", "comment": "Malware payload (RedLineStealer)", "value": "a500638434b5108c1b21426c8d726509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057960, "uuid": "15342ced-9e2d-4304-92f6-a204a2694415", "comment": "Malware payload (RedLineStealer)", "value": "54dc032c3503998eaa404dde9c677851856838e737edb3d198fb7c173562859e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057960, "uuid": "f8280ee2-f51d-4783-8915-7f50c8679b63", "comment": "Malware payload (RedLineStealer)", "value": "6847ba9b1cd63ac4ec14070b570753023efc2ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057960, "uuid": "d40776ae-675b-4b06-a328-db98ce9cfa52", "comment": "Malware payload (RedLineStealer)", "value": "ba75b1b08fffe89b215fd6b19b61e66a16306fd545579e171eb7ab390580082cc715cbbd9bf5b6b868f671e8a9eee0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057960, "uuid": "911a7c51-b143-45b4-b1ad-380df3ea3cd6", "value": "T16AB4A43439FB9019F173EF75DBD874969FAEF6632607E95D208003864A13B42DE8163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057960, "uuid": "7f3b19db-945d-45b0-afaf-fa35dbe80567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057960, "uuid": "60fcdbfd-b682-44b0-ab74-7bc55dd3b14b", "value": "6144:ncZ7g5r7KFTsPSBQsgU9og0Te2xglU7AzbG+GSjJXTMtx9BiVD:ncRsoS8og0Te2xglUVSjJXTOxDiVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644057960, "uuid": "687f957c-e350-4561-8173-af615938100c", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644057960, "uuid": "5505be77-75e3-4825-8571-5bf9bed5524d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057960, "uuid": "cf668654-0eac-462a-8784-afacaad8c373", "value": "54dc032c3503998eaa404dde9c677851856838e737edb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c260fb1f-86aa-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644082850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644082850, "uuid": "f65bc57f-5467-41fd-b92a-1b14dc340a84", "comment": "Malware payload (DCRat)", "value": "6b1a4a7b21440fa18ccfd4287178367d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644082850, "uuid": "c41dd749-9ce3-484f-8366-570470a64e38", "comment": "Malware payload (DCRat)", "value": "5574e0b5e404aa5bad86dd9aca033eb35421ec30dd91a9777bd6b053514010d7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644082850, "uuid": "ac07f676-0a7c-4467-b292-2af8e74219a6", "comment": "Malware payload (DCRat)", "value": "8173bc2b88b61be92ef8b641802c9629ba986cdf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644082850, "uuid": "8470fcd4-9333-4c7c-bb50-9b23695c38d8", "comment": "Malware payload (DCRat)", "value": "308726f94cc1361ea9b139a0465aa403d4038c82c526859aee60ecb40bef114043d3d7049a584606251aa7922416fd0e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644082850, "uuid": "32f93c5c-a2dd-40f0-8181-1a5893538588", "value": "T13455231658ED194BD04B2C3633F7726A9B071025A3766C0EECDA0D36D361868BCED74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644082850, "uuid": "b150121a-e01e-4d85-ac0a-b6ed409a5aaa", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644082850, "uuid": "226638f5-8d2d-4622-8c5a-913f422984f5", "value": "24576:lMKyQMZeeXBA0vDiw3ilBdymWNO6GAL9DbQ7Oqlg9338hfDrvLLlt9Vw:lUmWbiw3ilPyBO/AL9YlK3+fDrVtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644082850, "uuid": "db27f538-3b49-426a-82ea-1f1a6467c5c2", "value": 1323008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644082850, "uuid": "b45e8225-8ba0-4f54-9341-ac1684528eb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644082850, "uuid": "a0d3876a-60e7-4af8-a12d-17c59edec8a9", "value": "6b1a4a7b21440fa18ccfd4287178367d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4c8047-869d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644077126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077126, "uuid": "ab3babf2-a76c-485f-801b-6fcf051c7473", "comment": "Malware payload", "value": "eb83e59871c2a401085cca68106d582f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077126, "uuid": "725cd630-eeea-452d-9009-5b12bac06009", "comment": "Malware payload", "value": "56719990cf05483cd79512ca1d376baca27c1364fe110a6f9ea23cd53f8dcdeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077126, "uuid": "ea827a26-3fe0-4ba3-86a1-0ba8e1161eb1", "comment": "Malware payload", "value": "e18a82d4872fb21d7468a1bf637623400ffecc3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077126, "uuid": "f9fbc50f-d4f9-4d84-960b-35b8cb093abe", "comment": "Malware payload", "value": "c750ba052174ebd588f9464d2c07e8a894178527a1f580441415c262b174e5825606745c0fe7d60c5e46f1c1a43c716b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077126, "uuid": "c7cc2edf-234a-4aad-be36-ca0a24424e4e", "value": "T17E563337C70EB1FEDA3817B2A2E98F4AA7D5463D786C4DC8905D1AA7442D79803F424B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077126, "uuid": "95aed1a1-e53a-4a90-8de9-c65cf200f95b", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077126, "uuid": "7f164dbf-e469-46de-bf5b-4693c7841b94", "value": "98304:2cGAAVTgmYmQ039g9rdBVPdLcsXCWttpMqAwHUO/n5SNr65KrDySQOB6B2Q7eGi:2cGPt3QIEFPaKtbMgHUO/INr65IyB2Qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644077126, "uuid": "14594f0e-0dce-49a5-b198-a4bc3daeb974", "value": 5976673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644077126, "uuid": "ff835954-1821-445d-bae2-044fd78a9ceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077126, "uuid": "9dcb7158-d467-4c40-9ec0-8de3a0c66ae0", "value": "eb83e59871c2a401085cca68106d582f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4702d155-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075342, "uuid": "a477b2e0-455f-41b4-b988-b391590f7005", "comment": "Malware payload (Heodo)", "value": "2232092533e77f8f570e45d9a268c888", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075342, "uuid": "07e3878d-3459-4474-8bdf-40e13021a109", "comment": "Malware payload (Heodo)", "value": "56a44bf1337f6dafe133b2e142873784314ee311693c1466e5101400cabbe926", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075342, "uuid": "07effd07-6b5f-4dd8-837b-aa179c1c04c0", "comment": "Malware payload (Heodo)", "value": "855c515d7c60918380c03b57c71c1557e96e1635", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075342, "uuid": "85e3cec0-81a1-4ad6-9bda-894412b8a973", "comment": "Malware payload (Heodo)", "value": "ec6eee007cf8a622d1a15d2379a7cd046c407714230f9066ab0f4dd99c72c97d38b7b429951c9c1e5fdac2a20d36338a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075342, "uuid": "6ef88b04-0b1b-41ff-b937-06624f4a9e4c", "value": "T15A25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075342, "uuid": "d1cafb15-6af7-4be0-b95e-d9366d690fae", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075342, "uuid": "fa55223f-98dd-4ba5-81a0-56b6fe03b9ac", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxJfFIIm2m42:1ZsYB7vLsnZI1Hb9DcFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075342, "uuid": "8bd4e933-1c8e-4c4b-8dfb-3e62b6e7501f", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075342, "uuid": "8cb55c4b-8bf9-4e3e-beea-16b4e8ba36c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075342, "uuid": "62e44d37-a7f3-4134-9bc4-64353cf2b30c", "value": "56a44bf1337f6dafe133b2e142873784314ee311693c1466e5101400cabbe926.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c3ba9a-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075343, "uuid": "2ca96ada-10db-414c-8ac1-7c07cc82fd07", "comment": "Malware payload (Heodo)", "value": "a521ae213dd56fd1062e6802e96dac4f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075343, "uuid": "defd1fb4-ee14-48a6-ae12-add82ded026e", "comment": "Malware payload (Heodo)", "value": "58852b1ae77450300e5636ab9dc7558d2e4b00f97c12ab916823b76eb888276a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075343, "uuid": "bfc07ec0-0115-442e-ba19-c5f545513a50", "comment": "Malware payload (Heodo)", "value": "35349029b5d48be9a663218a3dc4b54f01767bd3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075343, "uuid": "8c64e079-3826-4432-8a83-98255601677d", "comment": "Malware payload (Heodo)", "value": "1e6688d648f13a4dc5840a95adad5b4850a726c17db725a0a6c30ed7ba563a951a3f62c7b3dc0fd7354fa1496d65cb46", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075343, "uuid": "b2999f28-8571-41a0-a442-3394cbb0ee75", "value": "T15225BE516E9A91A5FA0B247E00AA73470FDD791117E0E8CFEF44F5A71F21CC2963889B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075343, "uuid": "4b6b8a85-3ac2-4416-8b3c-320328b4ede2", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075343, "uuid": "7c4799e7-f3f1-4f44-9d54-c231e65e68de", "value": "24576:vGvafwy8HdhFsvdjNxcnsnPMf9yoro8ult+s9CdRP332L6SFIIm2mm:vBft89mjtMf9yok9lgdZCFIr2mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075343, "uuid": "1162bece-ab96-4190-8943-511e25060c70", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075343, "uuid": "68314cfc-9f44-4a76-9c32-0613d9e765ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075343, "uuid": "70aabfc6-527a-4ef6-8715-4e8f2b8ccce1", "value": "58852b1ae77450300e5636ab9dc7558d2e4b00f97c12ab916823b76eb888276a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34bb508-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087120, "uuid": "b8865ea2-93d4-4107-8f09-4a7bdb5dc328", "comment": "Malware payload", "value": "b358dde6d08d84cf4571df91509df185", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087120, "uuid": "3d0895a7-2c78-40c8-891c-b9d37c719924", "comment": "Malware payload", "value": "58aaf53d014f0e58e7cdc2b9585abc5250507fd985fb5c607b2e7a438f8f80f8", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087120, "uuid": "b20cf756-25b0-4391-a060-01e30997daa7", "comment": "Malware payload", "value": "bdec927521e2209aee0783b72b970b2211fb2d51", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087120, "uuid": "cafb880a-fe0d-448e-a545-35fcba81dd2d", "comment": "Malware payload", "value": "6089ead656e0230f40f3bfe826a82ff52e941ef35331943c36065b19069bbc95e49b674459bc77b7cb351b60586d7b78", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087120, "uuid": "6cee1527-7760-4164-afb4-3bc3ea511f9f", "value": "T1B531B0AA2A0384DB5832E4CA5493E608D54CB4E3787B48887CDC68956B39BDCAD31890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087120, "uuid": "42481daf-581e-4cdb-9e4e-768755cea170", "value": "24:69Ok41AsDGHZ2hV4NnR+svBwZA+XuuN2kHmBq/b5SJdI0cdO4:6Ik41Asr4NnsA4uuHHyq/bUdI0cdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087120, "uuid": "215db65f-48e1-476f-a649-7a042e2f912f", "value": 1571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087120, "uuid": "1624f21d-5858-4ac7-8428-3d0ab1303e82", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087120, "uuid": "c3b025d9-6ed5-419d-8f4d-ded8c43e15ff", "value": "haram.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48718d14-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075344, "uuid": "17750a3d-28c5-4bc3-9526-75c14ce2aff2", "comment": "Malware payload (Heodo)", "value": "826f0eccb191b27aee396b6c05fa8719", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075344, "uuid": "d9ed09e2-937b-4605-8286-af0c37d96e7e", "comment": "Malware payload (Heodo)", "value": "59e9cf469aa6649d15552acdd08aff1e74f1e91c2136b727357392d54b9c832b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075344, "uuid": "a77490db-a679-4075-9678-d5c26db4ffd6", "comment": "Malware payload (Heodo)", "value": "04018f2dce7c719eeeec61c4173619430f088c11", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075344, "uuid": "96ef6131-c7dd-4735-a8a9-62731be028ca", "comment": "Malware payload (Heodo)", "value": "5fe14d587035ae3faf138baca2e9ecc0d289ba7ce1426c80f38ce37cf5d130ce73e498a940a0bf7fc58332f3e0a480cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075344, "uuid": "c6d3e082-64fb-4e76-afa9-4544e9be9946", "value": "T13835AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075344, "uuid": "4861daf3-3070-4f38-bb47-e0dd364f0dec", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075344, "uuid": "f6407cc9-6f19-493a-8979-fdc3059daf98", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTkFIIm2m40:wfv1GVFF+765nFvFf6dlzzSQFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075344, "uuid": "4022ca3c-42f7-4880-8ed6-b11f2920756e", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075344, "uuid": "260c76c1-1e8f-46fc-89f9-d8744e2115a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075344, "uuid": "80f24891-7aef-478b-a129-bc9631392280", "value": "59e9cf469aa6649d15552acdd08aff1e74f1e91c2136b727357392d54b9c832b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b118a9-869b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644076088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076088, "uuid": "b7317f72-1da9-4b59-8f3c-87e41df8fac3", "comment": "Malware payload", "value": "a566a00278189d47ba8a8f61e2142672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076088, "uuid": "6cf06c09-d44f-44ec-b6a0-44cb24b77257", "comment": "Malware payload", "value": "5abd0dd9cfbf6f323c0737b139b0daea3f568da4f95fe862b66b74ba3fc04ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076088, "uuid": "ebbe50da-7383-4d38-8163-38ab27232d72", "comment": "Malware payload", "value": "1297b6a95d19e66ea9689b182213c757c3fe5d52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076088, "uuid": "c0e68a53-c228-4acd-a168-628408561736", "comment": "Malware payload", "value": "545d356fc851a3d20e97978873a0e67ca5de702d59e94db6042c86fbe871c7d34c8aa3ab709bc9eb08186a761d856179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076088, "uuid": "4d7c7d76-20e1-4fc2-a2bf-68cc82990c88", "value": "T16A46337D96ECC627FC27D2B664C8B44979BA0D24C3F087DF7BA58C00B946F11918E1A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076088, "uuid": "c5c14c14-47b2-464c-b163-0ad3b58a447f", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076088, "uuid": "384483db-b59b-4d25-bff2-f36b283bc7fe", "value": "98304:hFRTTRxn7Q9SL6rDijciSSSknh4yq3S4e58rENOlkkEWEpPLgFMZl94hciqvA1J:VXRx4SLSinScCyq3q8rECREJjsUL4IvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076088, "uuid": "81cb6f7b-fb63-4d6f-8a35-c81f8afbe37b", "value": 5875667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076088, "uuid": "1c309e4b-93d3-45e7-beec-b79281e45cca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076088, "uuid": "dc5f263c-6000-43ae-9694-950309b9e071", "value": "a566a00278189d47ba8a8f61e2142672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41652c0a-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644073614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073614, "uuid": "983df034-5065-4529-83d1-be73aace092a", "comment": "Malware payload (Heodo)", "value": "df7e32c71cc5fd8b9164a1b0f43e289c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073614, "uuid": "011f2958-3415-479f-80a8-ac9b0f9d0462", "comment": "Malware payload (Heodo)", "value": "5b9aaac4f0a508da9564b3232ab02ee44c8da6c9c0f2d7b14e57659ce93a9b6e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073614, "uuid": "a9e74c9f-fdf9-42c6-bab5-212cbfcc24b6", "comment": "Malware payload (Heodo)", "value": "43375466f342ab05849347eac1cb25c236c2b918", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073614, "uuid": "434162e3-0f7e-40bc-8e78-56f6f3c6975a", "comment": "Malware payload (Heodo)", "value": "042bebb66efc99f25a2ec7ce22d9c03e391ebe57b1147299874dad34927bff95feaa83e4690b1a677e8aab1a59408049", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073614, "uuid": "8886991b-ae8b-4996-966d-698a0d382f45", "value": "T11BE37C257255D9EADA04233109CB8BFA3627BC438E7183F37245F31E6F776509AD2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073614, "uuid": "8049698d-3f0a-491b-8d17-e9743dc4ed9c", "value": "3072:UcKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4Lct:UcKoSsxzNDZLDZjlbR868O8KlVH3yeh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073614, "uuid": "f0dbb8b2-4c05-4326-921e-fbcd25257c65", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073614, "uuid": "17965aa1-3cc1-4489-946b-b21990ff87ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073614, "uuid": "4641789c-2afb-44bf-ba44-fe312ddae9e1", "value": "Open Access eBooks.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208535c4-864a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644041347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644041347, "uuid": "2ffd88e0-3aa4-4685-bb9b-28a5fcfd0f5f", "comment": "Malware payload", "value": "e9d80e321527495a32e0e2b692840c0d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644041347, "uuid": "40f519bf-fa33-425c-9b54-f7b7d3cf6daa", "comment": "Malware payload", "value": "5eff59d9bc9e535e1be5aa150c9359958793e9b3ee7757422f9db7779596b24b", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644041347, "uuid": "fda5e1d3-9ab4-4ac8-a041-651dedd35e03", "comment": "Malware payload", "value": "0612afdaa211e9dd31565ba19dd49eb4283fc8fb", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644041347, "uuid": "e00a7433-34b2-4181-8726-7a02328f2c2d", "comment": "Malware payload", "value": "0bd41d8bb4aa6852a1bc43f31c3409005bca27ff1f097037e8ae8b85784105591bd9ff4174a383cd969fe11959eeac89", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644041347, "uuid": "a97de037-16eb-4a64-b72e-bf6188c06cc4", "value": "T1E5F16B28AF27B931E2078539F0098123F25EC60E576AD5974AC15DCBCEB2D94071ADCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644041347, "uuid": "cf05a56a-34aa-48c3-be23-af95130a51d7", "value": "192:53KmHP2fYolqwGW2zD6pdXNuwRlO/OosIVkdXy:53ZvAlqwzCs1K2osIidXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644041347, "uuid": "503b359d-5d57-43a6-ad43-87e6a5ba88eb", "value": 7550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644041347, "uuid": "4e9ef5fc-4109-48e4-81ae-fb67680d5d67", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644041347, "uuid": "7df9fd98-d252-4d70-99f3-b786894bb3ee", "value": "2022 01 25 St. L. Finance%0D%0A Committee Meeting Minutes DRAFT.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8dfe6b-8629-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644027225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644027225, "uuid": "df3ed547-1965-497c-9b4e-5ec24972e2b6", "comment": "Malware payload (Heodo)", "value": "492c0999e4a99f5d545459b548c6ee3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644027225, "uuid": "0cbb0c11-13d1-46f9-8fc1-7a9407686b77", "comment": "Malware payload (Heodo)", "value": "6015dc040564208c633e9c1af48e7c98f229ab7a004fd4fc840ded7d0e1c000a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644027225, "uuid": "dd51cad8-760b-4da8-a482-7f6f5c2ced1c", "comment": "Malware payload (Heodo)", "value": "f8d860de2a3ca5d92275f2f34fc07294707e4d8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644027225, "uuid": "3e263588-68bb-413c-89e0-20a58051d5d2", "comment": "Malware payload (Heodo)", "value": "9d43cae7cc9bbfaaf02e53be369e5bc14582bb43854e9dceace50ba9ab3b9ea2830412cfff25176208b773af5df27ae9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644027225, "uuid": "4d8bb2bc-521c-4ae8-b1bf-06d7241e2935", "value": "T157E4BF906D8644F1F683293600A7A2264FEDA61503E0DDDFCF88F9725F65CC2A77A09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644027225, "uuid": "79f565e6-303f-4c24-a516-39468d537a6c", "value": "12288:2D/Tukcyj1Giqjxq4s2IuJIMm0WKQTyPNwWe7c1QWImzvxmxsff7TFSuXAOFf6NG:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644027225, "uuid": "74952bf7-4600-4f67-9e50-b4866ef2ddc0", "value": 659758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644027225, "uuid": "a1e9da23-a3b5-4361-a0ea-ffc87b2778f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644027225, "uuid": "a2b6d10b-ecb3-4838-a7b6-5be45a9547b7", "value": "emotet_exe_e5_6015dc040564208c633e9c1af48e7c98f229ab7a004fd4fc840ded7d0e1c000a_2022-02-05__021341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a34aed3-86b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087266, "uuid": "fae905ca-b215-451a-b9e2-614c317234da", "comment": "Malware payload", "value": "15b037d0d23a915fb0a78961cdc7299a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087266, "uuid": "be871ee2-4eaf-43ee-8705-ece44715b1fb", "comment": "Malware payload", "value": "604a7ffe61e92d431eb70b433d05bc4d9c1ab1c41eaabf27fae1826d260e7894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087266, "uuid": "1b88487b-45b3-4314-a523-7bd7e188e5b9", "comment": "Malware payload", "value": "85864e397e3fee261bdcb62b477a71e936db39f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087266, "uuid": "dfd49447-04fb-45fd-bb78-4077d3eb8567", "comment": "Malware payload", "value": "61fe908089f9cd1d67fceca1b2e5d090fe6c62fe5cbf48b1638bdb40628ddae91021f47c8761d31edf556edbc437778c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087266, "uuid": "f1855e79-1401-45ea-b2b2-9849099528d9", "value": "T108F19447BE80DAD5C69119F440F18BD6EA168D30278A87490BBCF6AFEF391A4CD1C246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087266, "uuid": "d74dff4b-0b06-4a40-8b82-42e9d8b91f89", "value": "1bf91a980fd487cfc601b2aa615816f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087266, "uuid": "ce3bc782-0c33-4672-a9f6-537e9dad70b1", "value": "96:nPTjIUMEDgxd12kS6uBtufqUVWMVhhcK6t:n8EDgxd1DfMKhhcK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087266, "uuid": "0a0ea5a7-1a3d-4eca-bdd9-c322819a37c9", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087266, "uuid": "ac7b132b-0f8c-424d-adf4-8754742407a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087266, "uuid": "9a88b271-1ac5-42f5-af0f-f9eb57af31fa", "value": "MadCow.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492a465b-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075345, "uuid": "80696fd5-acd9-46a8-aafa-d58f5331a068", "comment": "Malware payload (Heodo)", "value": "2eec74a98a68fccc5c563fb921e99ae1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075345, "uuid": "f208dfd9-73c4-4d62-a13b-acdfa977ae54", "comment": "Malware payload (Heodo)", "value": "615ab862e6da6cf09ac0b6e63064b57f27323c3bc3ee7236f0e70185fa049c01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075345, "uuid": "5f6f0d37-cde4-46c4-a040-b7bc43065e67", "comment": "Malware payload (Heodo)", "value": "9cf37e1bab46ac69453029a60b59b597d02aaf2f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075345, "uuid": "8fb3333f-9813-4ef5-aa2e-27147ba9c17b", "comment": "Malware payload (Heodo)", "value": "3d0f70ce84202f3e02b961b2b3c6689c152cc9768e4c2996e25f7fb8614734c83812acf8d84071015f091edad95b53e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075345, "uuid": "e1316aaf-cbdf-4937-a11d-0021f067381b", "value": "T1DD25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075345, "uuid": "a7f57885-efeb-4e06-a716-08a22c0fc05e", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075345, "uuid": "8f357260-a29a-4f03-911c-97af126aea34", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYx5fFIIm2m42:1ZsYB7vLsnZI1Hb9DsFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075345, "uuid": "3c6b2cfa-0fc2-4bbb-9f56-8dfdd9e72f51", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075345, "uuid": "d5520bce-a325-439d-a860-c0c4262ed24b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075345, "uuid": "8da0cfa6-16a3-47c9-b0a9-3203078057e6", "value": "615ab862e6da6cf09ac0b6e63064b57f27323c3bc3ee7236f0e70185fa049c01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3c2a2a-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087133, "uuid": "6a46d7ac-ab25-4d5e-9505-581da35f9402", "comment": "Malware payload", "value": "95ec22b0b68815a9bf6def95e5c3b9b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087133, "uuid": "a14f6225-0f64-4fd1-a01b-3166ed4882c0", "comment": "Malware payload", "value": "6282b66c770ce9de83aa6ca4d042ca05515325f6ab480bc08c7f73fbeb06b011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087133, "uuid": "85056328-11d6-401d-b362-7f7002891450", "comment": "Malware payload", "value": "00dbadea4b400e6e0ae58951d063a4943fd1fc8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087133, "uuid": "30e64c7f-86b4-482e-86cf-d29ec0331543", "comment": "Malware payload", "value": "51aac976e93c1286642d56d210302b142f6c1f43519cc460eb2777df37e8988ace3aca0b4b6f223ad353564469c6e763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087133, "uuid": "3c370a95-fcda-47af-b048-0bb2fbe06b37", "value": "T15BB11AC2BABCF157C19A423B26B17562FC2CF4255789EA09FFC9905F50D62A0410CE6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087133, "uuid": "576834f6-56a7-4e73-ba09-a85bd72784bf", "value": "4b3fa465a7cd6e540350db5a529329a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087133, "uuid": "155da84a-1207-472f-8351-2fdcda677752", "value": "96:nPixhpx8ZlQj5MxyMryKMH91gL+pcQiZzEe:nghpx8Zg5MIKyN1gqpdY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087133, "uuid": "2057b2c1-ea3f-4d2e-af3b-1e989af5b8e7", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087133, "uuid": "7374be12-8b09-4267-bca1-20f03cb42539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087133, "uuid": "8be9cd17-d215-4c9d-9c82-9cfd484c8807", "value": "Kevlar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7defaac-866d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644056687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056687, "uuid": "e2edf78d-3ba4-4c68-a620-57046d273567", "comment": "Malware payload (Mirai)", "value": "b85ff07e05f7b5770ada36a5347fcedc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056687, "uuid": "51792029-e2b3-4255-b6bb-bdccda00bdc5", "comment": "Malware payload (Mirai)", "value": "63112fe5dda7d43bbc353fd1e1d8b4124d4008e4581e1da7fd4a683231d08891", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056687, "uuid": "481c77ca-258d-4d31-9c63-387f39c0f173", "comment": "Malware payload (Mirai)", "value": "838a70c1cfbe803aee31556b9ec1848174b91e76", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056687, "uuid": "2b4f24c0-6b54-4b59-b5c3-a1e0c30ea88d", "comment": "Malware payload (Mirai)", "value": "0cb20219d69b5472848a46fa0dd22f1e86a7eb7974d1699ef58efb7141e5da8c16f8f739234ce58967b87537b263df49", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056687, "uuid": "87cfe215-a0a6-4852-b7c3-2de32793524f", "value": "T12EB33B376251C97AC08356F426EBC5729D13BCBB0B32319A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056687, "uuid": "a080a2e0-41a9-407f-8fc7-efbd540065c5", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAl+TRCm7FnVqfJXFWbNb:T9a2aLqkrMIsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644056687, "uuid": "a7972e80-f51b-4ce4-9d24-7ac18cb8d18a", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644056687, "uuid": "37651787-4f76-40f8-8c65-5c45beccd852", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056687, "uuid": "80eefb6f-5ec2-42a0-a6a3-da96b23bbdf3", "value": "b85ff07e05f7b5770ada36a5347fcedc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84baa7d-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "a2cfa485-1d8f-4dba-bce0-4e69bd9ade11", "comment": "Malware payload (Heodo)", "value": "0e998419b15d2e374802f1061bd995ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "2de255ff-a3b8-4821-9edd-6f33dd527677", "comment": "Malware payload (Heodo)", "value": "64add31a3ef62f58829cf8c6ff7ef93ae21bee7d4fa355c854d794004de89517", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "f331da2a-eece-4037-bab5-5a4b3e03866d", "comment": "Malware payload (Heodo)", "value": "a191416d3605cedd68cd7c16a2559e3faaa9b2dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "aa50c496-a960-4912-a584-73c1a02f8e2f", "comment": "Malware payload (Heodo)", "value": "95ae7172845b9d2869a585dc4e5bef138daace7846d372df2542ecb63d8196b2c2d33de77414e94d2328ef7704299321", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "997a8d47-e48e-4bdf-8b27-91be76a085c5", "value": "T1B125AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "2392a614-70ea-4abb-8496-2beecf66975e", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "041cf75b-4c15-465f-85d6-893799fa4adf", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxLfFIIm2m42:1ZsYB7vLsnZI1Hb9DGFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019724, "uuid": "1080a065-2135-4669-8818-eecf11ce6379", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019724, "uuid": "a52b5a17-b421-499b-97c0-0595372b7c1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "8a83b764-ae0b-4fa0-9868-32f1b73403c6", "value": "emotet_exe_e4_64add31a3ef62f58829cf8c6ff7ef93ae21bee7d4fa355c854d794004de89517_2022-02-05__000837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bcec18-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "5665e46e-fbee-4871-bfbb-2f3c018ec42e", "comment": "Malware payload (Heodo)", "value": "ddabceecdee66f009b965eb43d4d5b72", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "06ec0fe9-2c7c-49cf-b650-d55bd74d2a84", "comment": "Malware payload (Heodo)", "value": "6529ef132048bca1892814ec615daf12259f58cff9a631b58d3045606d36f80d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "36615532-cbae-4cb3-9473-0efeca33009c", "comment": "Malware payload (Heodo)", "value": "99638f5c9995d72ad68a9f3a2af3898a509f1246", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "2e662552-9d72-48ad-931b-a864e4a53ed5", "comment": "Malware payload (Heodo)", "value": "dbba23d8b60f7f23436c12fd0c6ed6c0475c02c00d723d858b871e201175cc62f1abbff8a88bfbbb2369a1bf0938a9bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "d23747fa-5bc8-4fd2-9ff7-f0004c2d7d46", "value": "T1D025AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "5ad6c12a-610e-4b70-8d46-03b8ba0df7a7", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "9114544a-b75f-45d2-8713-99ffcd3b70cc", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxEfFIIm2m42:1ZsYB7vLsnZI1Hb9DvFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019720, "uuid": "557bcbe6-0c90-4776-a0c5-e34287a65db6", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019720, "uuid": "0e47b1d4-1634-4e07-a42e-51ba1b46444f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "3827b2c7-2309-426a-9c65-b526cdc9d4ab", "value": "emotet_exe_e4_6529ef132048bca1892814ec615daf12259f58cff9a631b58d3045606d36f80d_2022-02-05__000833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7d969b-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075347, "uuid": "6316619d-ea59-4691-b20c-609ff2f27904", "comment": "Malware payload (Heodo)", "value": "b91fd2adfd18ae3f81928d7171c04ddc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075347, "uuid": "1d96c0b0-1d25-49db-93af-4e7ee6033beb", "comment": "Malware payload (Heodo)", "value": "65722fd7987066a5f0bb6f6d02960075f744c49a3a4d828d732448c95f1a5dbe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075347, "uuid": "2b1fd0ac-d8dc-4522-8c97-37c4afe06b89", "comment": "Malware payload (Heodo)", "value": "7466d713959880723f14e2fb48c6ab69a7a4a488", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075347, "uuid": "6e2e7a0e-81d2-4142-8600-f817b1b6adae", "comment": "Malware payload (Heodo)", "value": "0a7c3ed5f7775d8f793adb7812397ec5fce8d9993d7ae9f1a69203f447f0fe2c4d3e2f150c9e802ccc0f305909ef9791", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075347, "uuid": "0d6c0b04-2b08-40cd-8c9a-be1d2606ff08", "value": "T1B325AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075347, "uuid": "c3947259-775f-4465-88fc-2d9468ba1155", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075347, "uuid": "1b541125-7e0e-47d1-bc4f-6ff269758ac8", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxBfFIIm2m42:1ZsYB7vLsnZI1Hb9D4FIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075347, "uuid": "df263aff-56c8-4f2c-8cf8-f0d39a6acf94", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075347, "uuid": "bcdf4736-4d72-4691-94df-a239d07cf35b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075347, "uuid": "e85bf45d-e1b1-4bca-8bf0-af5332713e97", "value": "65722fd7987066a5f0bb6f6d02960075f744c49a3a4d828d732448c95f1a5dbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6510601-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087152, "uuid": "26f2929d-9cf5-47b3-8c93-790f038a731e", "comment": "Malware payload", "value": "ee8e03e0a5251a340fe2c08fd7f9c2e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087152, "uuid": "80df47d5-4b86-4d25-ba60-f0ca7decb764", "comment": "Malware payload", "value": "65d541c76daef35f0036b37c1e8d993e1211a2ff4d74ae6ef0c8d6731c0cf866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087152, "uuid": "10544edc-2af3-497f-a89f-45e3b1dc2cee", "comment": "Malware payload", "value": "4144791ec8571744fe9905309bb6bf7199485a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087152, "uuid": "940a098a-0a64-4c78-8419-1a7119556951", "comment": "Malware payload", "value": "51f3af32c0bb6787daca1c182403b3f4e316ce06325f9bd0009c3a6bbac9f2da01c6f46c6fb287cb0fc914787be74e09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087152, "uuid": "bed4bc86-02f7-42c0-b249-53a6a930738b", "value": "T15202B78FB2449861D0C083701A1FAE38ED734EA1903596C7BB907FCFAC7B174D91929A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087152, "uuid": "6f38676f-0b04-492d-b93a-581b75000561", "value": "9d7f4b186bc961b7796856e8bfce868d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087152, "uuid": "9ece5c0e-93b0-4a0e-898b-47f1b591b642", "value": "96:nPGIYlf6708+IjgBIAoDP0ldhgAS+sqesCLoyHyz5LRX1xXaS28v+u+uV9:nOImfC5erwPoCqALNSRRX1Zah8v+u+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087152, "uuid": "d1bb1339-978a-4672-a069-1fac832a03b2", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087152, "uuid": "f141117a-ee72-4955-97a9-4a0adf296383", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087152, "uuid": "5a525b1e-a5cf-487c-a6ee-6b1213ff3777", "value": "Loft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74626e7-86bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091072, "uuid": "4a5e3aa1-7318-4f0c-9843-89a2231b2ec1", "comment": "Malware payload", "value": "f41a964a3cb2ad29bcee1ce95163c7a9", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091072, "uuid": "0ac638db-227f-4661-aa92-8f0d12dd197e", "comment": "Malware payload", "value": "666ec4fc1e42675b6d6bce8ae90e29fc1a0c6e5335fb74f2996cfca72ee9cedc", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091072, "uuid": "76f8e08c-40cb-4f71-b5cb-6b921925d5e2", "comment": "Malware payload", "value": "5b003c80a78b61e702f80e83bb77cffff4678d8b", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091072, "uuid": "5fa11434-02b9-407a-a580-f12ee1f4d881", "comment": "Malware payload", "value": "c5c09d6b870795b4e09878beab3304fadcb59f1b4ee1e3f7252dd2694eb1076efab51bcccc3ae22eccfad1aac746876a", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091072, "uuid": "0e599689-ea6a-4d98-813d-6fe1113aa4ba", "value": "T12E417635BE53FEE40D23A5413AE10C09DA01C471993097E899EDC649B7174B8DA9C3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091072, "uuid": "c2449342-4379-4931-b54c-2c91451959c8", "value": "48:5zwMRfSVaW0330oKjeHojz83qnZYhRo2g1y:ZAVj0330oKjeOziqnyh22uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091072, "uuid": "e3462a76-27fa-4c55-b0b0-abfc92102a94", "value": 2033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091072, "uuid": "0181a71a-50f2-42a7-8013-6b18bc1bbb1b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091072, "uuid": "1969eb79-ced9-44eb-9093-ad18637da7a5", "value": "Study.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a866f7-869b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644076121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076121, "uuid": "45633639-73ea-419a-8e98-455083a026e9", "comment": "Malware payload", "value": "979f89ce6f387df3ca9b11f84e522aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076121, "uuid": "3c7bb85a-a358-4345-9b92-172fe165ec94", "comment": "Malware payload", "value": "667886b0ff35cefcc45ccb1c78e6738fa1203d439d0ddadebd36c31d61dde885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076121, "uuid": "203b2ba5-2d19-4ff3-a891-f414df979aaf", "comment": "Malware payload", "value": "8aaafa11630b43bd7e3038844d0e4c91c58ff1f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076121, "uuid": "ca9fe08b-180a-4af4-b968-77f454bcd373", "comment": "Malware payload", "value": "87cc4ad590862b0a62a99db485d48ded084b0bdcf7e55b420e54f8f5b94a1652495bc596778335a66844c873f9fbcf4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076121, "uuid": "024ce6ba-f27b-4ad6-829a-865d1d38b261", "value": "T16956339E4BA64E96E6E0BBF178A373C91616E5725AFE70BC021CF59C139C30E576C420", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076121, "uuid": "8b3f7362-4e44-43c5-9cf2-cd348228720e", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076121, "uuid": "39e38c9b-996e-45b1-9d35-151da634dab4", "value": "98304:KsWPki/wMnbWCJRsRrMC65FTix3cF8blt1Ulq2F77ImUiquKFFsURt2ur2S0rsBD:gkpCArECZt1UlRl43VKloJzfcaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076121, "uuid": "e7f57b4f-f69a-40c5-a56c-bdd50410025d", "value": 5959285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076121, "uuid": "2bc6de14-8a8e-474f-bd16-cefe8c9d615d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076121, "uuid": "c2795605-895e-465f-9fad-32fc03ff905b", "value": "979f89ce6f387df3ca9b11f84e522aeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8ad64c-86b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087779, "uuid": "6d6f9254-04fe-4b14-884c-88b8f2a9b25b", "comment": "Malware payload", "value": "2fb45484acdd0ec3a4f7f199b13e2262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087779, "uuid": "99890441-7e44-4b6a-8a62-036848a29719", "comment": "Malware payload", "value": "66897c9ba674cbbb64cbec1690ad55a75c7606d127a40580d0508c5684434006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087779, "uuid": "38d42668-50f4-4b4a-a2b3-e7f7bc255e6c", "comment": "Malware payload", "value": "657559e72ba0fb47cbe296be5f8c8d01c1164636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087779, "uuid": "e3160f4b-dc55-48c9-ad43-a5ef845c1436", "comment": "Malware payload", "value": "5d62fd1421e830a66a694875adcfbcb38b8ac174da66acf39f86bd68bfd78cb166ac33739cd9087bdde7231b37581cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087779, "uuid": "fd26b730-c310-4802-bd9b-93e0fed04cb6", "value": "T1CC024BDFB95959A3E2824370C521346038BC70F003FF9BB1A685E123E5AE051693AFDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087779, "uuid": "ec00928f-8113-4315-9900-19fa732a6c23", "value": "3e7cece07ef3dad5e976374fea56617e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087779, "uuid": "6724cdca-5ae1-4982-8e3f-a36c2a81d60b", "value": "96:nPTylunMCB8Ox1y2wyH7ldkuUfnWQBiZ:ncCNmOx1NF7HJUPWXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087779, "uuid": "4ac6e67e-ed5e-44a7-b7e0-2862ff2b8e00", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087779, "uuid": "e55e5440-4bfe-4f5b-ad07-78af32b403b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087779, "uuid": "3c15c969-eae5-4487-9b6d-26ed4bc368ce", "value": "WTC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34c0b46-868e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644070826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644070826, "uuid": "a6dfc1be-f5dd-4af6-81c8-e249497d1b4c", "comment": "Malware payload", "value": "ac145b5d1710ddaa1541be127c4bc644", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644070826, "uuid": "d761b8b6-a812-432d-9e1a-24b491c0844d", "comment": "Malware payload", "value": "67c3f0e15b06add82f4b68e492b99d0a1e38ecdc6590bb2f772f51da2d64c7e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644070826, "uuid": "e7568677-ef14-4392-ac97-e2a325d80131", "comment": "Malware payload", "value": "2c208b236a6c21f358bd3c36a8c6d3eab65906ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644070826, "uuid": "05be01a8-4956-43eb-915a-c76b113af270", "comment": "Malware payload", "value": "c275e021459a2d140f560d962cbcb316baa918fefb82cb8722a2b4a4e6f86950d42e01da4a785577705aba8cbe36fdab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644070826, "uuid": "745061e8-a647-4844-889a-054822f2112d", "value": "T1C554E103E5C262B6CA172432116AA27F6E3C62119353DEDBCFA94CF25F367D1923435A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644070826, "uuid": "fb2dbdec-8fa3-4b71-958f-bfa2d50177c8", "value": "6144:83DvZRFTFbksYyljaMYDMfT7k+At+5fAzHKP5hET++oRFc:83BZbttaMYWLAtgpPo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644070826, "uuid": "9a51b652-c1dd-4b3b-a99c-e55f6f70996e", "value": 283238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644070826, "uuid": "1340277e-b537-4dc1-9da7-2a8000f2bc8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644070826, "uuid": "f6a5ebc7-d50b-4111-aec6-4d5f2c52180a", "value": "emotet_exe_e5_67c3f0e15b06add82f4b68e492b99d0a1e38ecdc6590bb2f772f51da2d64c7e1_2022-02-05__142020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32346949-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644076166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076166, "uuid": "9260f45b-4996-493e-8f9a-4f7ca30be677", "comment": "Malware payload (Heodo)", "value": "51daedbf82bb10c9d46b3f4557d43f1e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076166, "uuid": "651c0d09-5501-4e38-a42c-d643adb8e35a", "comment": "Malware payload (Heodo)", "value": "69506120935a49552d5cb748ffbf07862c2622d5a4cdec7df73c1373240ef295", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076166, "uuid": "d9a06975-076a-496c-87ec-0dd533cb26c4", "comment": "Malware payload (Heodo)", "value": "91ebc5e6ef8f96601e0ebd9799946e30c3fe3745", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076166, "uuid": "f6565567-1f09-4510-815d-54341be84c3f", "comment": "Malware payload (Heodo)", "value": "4ba8a8a41a009487dac427b05bb97f882cde16f49b51bd62e37b5b1c0aa61cdc2f8fd7c53938fcd1a1d871f648157ae1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076166, "uuid": "cfacc0ee-8a04-422e-98b2-bd23d4b328cd", "value": "T19D25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076166, "uuid": "201e103f-8ecd-4836-9330-7a44f673f98d", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076166, "uuid": "a072283c-d5a8-49de-9d55-8c58ed9a0e73", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxefFIIm2m42:1ZsYB7vLsnZI1Hb9DRFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076166, "uuid": "e1f61d5c-486a-47f8-9151-7674cb0bb10b", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076166, "uuid": "b54505c1-08a8-45fe-abf6-a0056d5e1899", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076166, "uuid": "f3dc3a8e-abed-4657-90f9-a5c78df471ac", "value": "69506120935a49552d5cb748ffbf07862c2622d5a4cdec7df73c1373240ef295.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e489a37e-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088491, "uuid": "3ca3259e-fb1a-461f-8769-adb2ff900abb", "comment": "Malware payload", "value": "0917a7ca2afb01dc26afc99f642c0b6f", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088491, "uuid": "f7b94e74-d643-455a-8a5b-d6475a2cba13", "comment": "Malware payload", "value": "69dcf61244261e99bf085a39b143fb4fa39ed99c248e2cbc25ef7e6b6f4dd5cc", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088491, "uuid": "0a2c8155-50e1-46b7-a06f-16ad20557d03", "comment": "Malware payload", "value": "aa809d611ba4ba26e9c4d65aeba3239888a0da79", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088491, "uuid": "fcc5b3a5-e135-489d-83d9-f9002a3acd50", "comment": "Malware payload", "value": "1bcc8d393f5120a0a5708833dc51757004f03fc828fff3f3f57fedbc9e715a2f2c2ea7c8792be04d1e3b6a1b603586a6", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088491, "uuid": "2d38e056-adff-4751-b498-8b2f351dd6c2", "value": "T17C819C9DA3F1DFC1DE05698F684C828A1A77239240DE1EA4AF2CED0405C4DBD769C59E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088491, "uuid": "43f3a7de-0dc8-4703-b261-37469fbdd088", "value": "96:ea6a6ov0v61ewhTTTQorLrvEUvXnbbbNYjP6uEEoDojU:iZoz1ewhvTQoDvNaGu3oDo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088491, "uuid": "9dae57ca-3476-4126-a895-d52ec91e14c4", "value": 4043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088491, "uuid": "5ad4d261-d8f3-42dd-8e3b-aecc4f443539", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088491, "uuid": "08aa7610-9f1a-402c-8eae-a55d9b87a505", "value": "hatred.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61044e2-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "1bea9a14-b6c8-4d9d-99ad-142d596f51cf", "comment": "Malware payload (Heodo)", "value": "2fd990201b13292d6dec9f727733da93", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "2141282a-3689-4e27-a8ed-87034d732255", "comment": "Malware payload (Heodo)", "value": "6b281edbc6363088bc0fd4cdd9817cdf292f605f0e59c78719e7d55281ee8c3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "271749ea-4cb0-4b14-bf0a-51e0ca19a26f", "comment": "Malware payload (Heodo)", "value": "4934af61b60d24d2794854c8a4495d25762d4b84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "21b0dc74-a04e-4663-a8e3-e7eb90903f0f", "comment": "Malware payload (Heodo)", "value": "7bb16354889a838468b396cf833daf4c3a54d50b01bc76b3b55cac3ab89e66ac170418efe33651654aa20ac7c63f2eed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "9a509445-5e76-4b16-9d1e-2d8b0dfc00cf", "value": "T13C25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "16b0bb8b-466c-4631-b1c1-ee8584cd94b7", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "b1d2d53c-9937-4644-bf46-f1cac3ab15f2", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxWfFIIm2m42:1ZsYB7vLsnZI1Hb9DpFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019720, "uuid": "a26489d6-e805-429d-964f-514f294d3f9c", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019720, "uuid": "8dd652a4-e3dc-4156-b7e9-4e63dcf79d84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "b3684889-5b97-4330-94d0-6cd691605db5", "value": "emotet_exe_e4_6b281edbc6363088bc0fd4cdd9817cdf292f605f0e59c78719e7d55281ee8c3c_2022-02-05__000833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d56cd8d-8678-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644061259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644061259, "uuid": "8b3bb32f-f1d8-4201-995c-6829b2e576ce", "comment": "Malware payload", "value": "70ef7bb9beed8cf844d4093e703a7ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644061259, "uuid": "dbffb682-0dea-4bdc-ac3c-3a790b377ba4", "comment": "Malware payload", "value": "6b402ef3b2f7d8d7f957c80246606572ea33fc40d851e3ad42866ad406589923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644061259, "uuid": "9c51e8d5-c1a6-4b73-a148-9f177d2358a3", "comment": "Malware payload", "value": "833e7b688f71c5b841a18bdf35e636980bc56150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644061259, "uuid": "9bc96df3-2c9b-4ece-b75f-e08ce57bbb93", "comment": "Malware payload", "value": "2d7b6430e8e2ed7f292f7da93948688db3396a578856cc1dc719e59a616d9b4ec6e7da0b6a166c243283c1a0dc2d551d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644061259, "uuid": "1cc767b2-cb3e-4a90-a158-7356715f7ced", "value": "T1B4F5BF02B3C252D2F9E7567147F5823A4C39BE25433889CBC2981D2F5EA55D36B38B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644061259, "uuid": "71925e1b-71c3-4394-ac9e-8a26aac34392", "value": "49152:rnj8uYbbZoFRqgBtlInnfXk95jN+LopIaPOUM06UtEs9yvL8euYe5L7E9Q:rnjVYnZo//tufw5jN+Lh8iwnW9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644061259, "uuid": "02c284d7-ede9-4f70-8a98-9a229c81bc4f", "value": 3624960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644061259, "uuid": "65dba1f2-9dfc-4c3b-829a-ad325b3b6dae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644061259, "uuid": "acec8926-9610-40e7-817c-9da1572750da", "value": "SecuriteInfo.com.Shade.11271.10622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d707a442-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087180, "uuid": "f2983568-d37f-4e13-aad8-42d1e8add906", "comment": "Malware payload", "value": "3338ff69f06129d725329143821e2fd4", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087180, "uuid": "d23ea0be-5c52-4bd7-b07e-5d2ff9d94ba5", "comment": "Malware payload", "value": "6c802ba8c30337a693836ea198f7bc6627aba75382797ad480ae892d62b5c44b", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087180, "uuid": "36dd0706-0834-4781-9f1f-34c7d507aff6", "comment": "Malware payload", "value": "8ca58154d669c6f66fc625601a6138300b3dc922", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087180, "uuid": "f736aa78-85b0-4f22-9426-4b281c31eae3", "comment": "Malware payload", "value": "fae2f6f01b86c2358b7c5f859f0bca918c0195e278587dc0364c00f38c610b724469e7d9814ca496a97dcc4332951624", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087180, "uuid": "84ca2cc8-5f93-4446-9511-a58922eb23fa", "value": "T16C414285B505CC2142F0339120596709AFD0FBD9FCA0F29E544EDA929163BACC6B93DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087180, "uuid": "875eec39-2c19-48c7-ba16-1cd6e9497989", "value": "48:egFAEgMRIDCqvqHheMmcRwKkERtUE9NVsH3NcL0iR:egF4MOCqvqHheRcRw99s0iR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087180, "uuid": "7a51280e-f530-402b-a3e0-221b9a91b258", "value": 1963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087180, "uuid": "31f638f6-34de-4554-b76c-d8f94ff590cb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087180, "uuid": "00abde80-3bc1-4635-a70f-e166d016099b", "value": "ActiveX.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076faafc-86b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087690, "uuid": "013cad24-b312-4077-8b53-98303b26335c", "comment": "Malware payload", "value": "91703278352e9e18d01d081c73330ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087690, "uuid": "d1ec8e5b-a399-45f0-8407-b5509a6be00e", "comment": "Malware payload", "value": "6eca9a834e9e68eaf3099eb3831d4f6215e36cdd3ef99265592c2e130e457727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087690, "uuid": "749891ff-0f29-4a84-8ebc-6eaee374e689", "comment": "Malware payload", "value": "81366149cda1578b5dc71b4c4860f9555467e1a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087690, "uuid": "f77ca42d-2c81-44ee-86b1-cf47bf402774", "comment": "Malware payload", "value": "6d138a61d6a2a04f0c92e31d15d00f8ee257d7b6500dbc1bb38985ba5965c56d7b4e17592912544a44716ac228f55a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087690, "uuid": "347ccf06-5fa5-4210-b489-3782df6668a1", "value": "T152B1FBE33419F3B3C2C33234536C351A1CAC75A40594AB596D489517B996357D538BA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087690, "uuid": "07a97f86-c034-405b-8eb4-3c261f6272e5", "value": "5d3f0170fb63cf087378e7339aff0513", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087690, "uuid": "7f91f505-ce36-49ba-9585-4895709c6bc3", "value": "48:OEP4lGdLLV9CgX07BiZt5r6TdPiqdPtH7FKVF+lqSeJY8JTaOq7tBrx:nP4gLVDXG4MfIVFriJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087690, "uuid": "96ffa20a-6dbb-4098-aaa1-deda8c12d665", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087690, "uuid": "8b998194-3d42-4303-9485-7f7b2f41a28c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087690, "uuid": "7ab79a69-aaab-4186-ab7d-8f8d23169dbf", "value": "together.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebbf00a-865d-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644049504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049504, "uuid": "49743ca8-f3c6-4312-a623-c3b65e0951b5", "comment": "Malware payload (Quakbot)", "value": "0131f3ba2a433680c693633012c3e5f1", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049504, "uuid": "7f0e93fe-78da-4ddf-97a2-82027f9debf6", "comment": "Malware payload (Quakbot)", "value": "71b5de4bc0e2acceece6d2f11a6c283aa483deff9858c73aabd5e844cea75c5d", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049504, "uuid": "c2fa9858-06e3-40f7-863c-a4734719da6f", "comment": "Malware payload (Quakbot)", "value": "7ecbbba7d47dc64e8bf4e69927cefbc7d525b678", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049504, "uuid": "9aab05d2-fef9-4671-b133-c3c79ba48af8", "comment": "Malware payload (Quakbot)", "value": "0cf62a8b97bdde50c627bfcdc5624ba7996ec0ed8a8aa0a4d209ac0ba1e9595fd6c983515296716357b376a6f393310f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049504, "uuid": "ee172b8e-da68-4112-94bb-06b30884fa69", "value": "T102C3029ED520E886C342183DCA5A4DFDD50D1257E873E01F25C47A4A3E926EB6F8E2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049504, "uuid": "7bb34b2d-3628-40b1-9278-1fdfc23b3921", "value": "3072:8fZQF483ux6KoT/jki1XCqRRAcQnEWzY24nX8yl:QdsrkmDRicQnE724X8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644049504, "uuid": "c66757b5-d9e9-4244-b3dd-fd89a88444b1", "value": 128292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644049504, "uuid": "c17b5507-444d-4cde-92c1-1d6b48d61900", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049504, "uuid": "3f0519f8-53b0-467e-8d90-38aff68b07fc", "value": "LM-586487083.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f99107-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644076167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076167, "uuid": "065b96db-bc7a-49dc-9bd1-b5048f804348", "comment": "Malware payload (Heodo)", "value": "e69a8e65a1fec84edf6b455041e318e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076167, "uuid": "0e88be3d-1131-482a-9c83-e40e9e0db49a", "comment": "Malware payload (Heodo)", "value": "72afacfaa300c8f8b8aa78e795cc7eb467974ec31be85d99a789727601c5491f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076167, "uuid": "db959adf-07e3-4488-a1ac-38aabf68e93c", "comment": "Malware payload (Heodo)", "value": "e4c19815aede7f1be50b983d7c6b04b7f51bb374", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076167, "uuid": "aeccdd73-c5ce-4d4d-bb97-706e3930692c", "comment": "Malware payload (Heodo)", "value": "831fd52e25ffbeedac7bbf1d3120aa5a7b4e5c8a860fb8c9d1791b2f2910699c263555f9dfa6877efe15536ec9eef5b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076167, "uuid": "acec0180-c2bc-4d27-a364-214b6b81476b", "value": "T13B25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076167, "uuid": "ceced830-940c-42a4-96b9-e6ca648dc9e8", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076167, "uuid": "98c00391-78ab-4fda-b1c5-df65984073c0", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxifFIIm2m42:1ZsYB7vLsnZI1Hb9DJFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076167, "uuid": "ed9161a5-129c-4090-b4c5-641f9a1f24ea", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076167, "uuid": "896409cb-c777-4729-a3d4-2f6f6c6567a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076167, "uuid": "fcebaafc-b286-4152-a3d2-cbb84b53e02a", "value": "72afacfaa300c8f8b8aa78e795cc7eb467974ec31be85d99a789727601c5491f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c035b83-86b2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644086168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086168, "uuid": "c8ac9138-ae3d-4f1c-a0bd-c031a23598b0", "comment": "Malware payload (RedLineStealer)", "value": "33f61d6099a6f15ecf5f569c34a939d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086168, "uuid": "d30f6e2f-7c42-46d1-b040-536a8aa28744", "comment": "Malware payload (RedLineStealer)", "value": "72b7f772e019def30abcf817ae7a3004a84215daef67588eaa1fde3839df2fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086168, "uuid": "fca844f7-84fb-47a6-af0e-bfb4f155e946", "comment": "Malware payload (RedLineStealer)", "value": "46725d959bf14ffac353f9a5b8330dc991536241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086168, "uuid": "1345b6d9-9f8f-4f83-81e2-fa583b8a6eb4", "comment": "Malware payload (RedLineStealer)", "value": "842b162c35e6d17bc71f411ddfa7a6fffbb7566781a8f54ccf8f0c638efc5b77b770abab66d6819a3e2cf77792668e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086168, "uuid": "2383d821-cde4-4dad-8b47-c02b340f8296", "value": "T153B42F5F29AA524DB251AD515FBCF176C15EF6F2283A5CB34DF30D0A1012AF0CB2DA26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086168, "uuid": "a7f4eb8f-94a9-462f-93f8-db64213285c6", "value": "3072:gqluFEtxpWqvzM6f8DYwKQu76OXAaLgpyk4V3E99o6+QCKJapVRiEL555lz5558s:gai999CKERiETZzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086168, "uuid": "b3986126-8833-40d1-9082-4cdcb6abcfce", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086168, "uuid": "dcd99859-56c5-431c-9e5d-a95a9f80730e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086168, "uuid": "ba30dceb-04eb-45a0-9657-616bbe305401", "value": "33f61d6099a6f15ecf5f569c34a939d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3fc6db-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075349, "uuid": "32e42685-5b6e-41d5-a28a-d590e29e187f", "comment": "Malware payload (Heodo)", "value": "8f82549452151ad4a0407229bb42376e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075349, "uuid": "a9fb37aa-1e56-4a59-a107-71e0bf784951", "comment": "Malware payload (Heodo)", "value": "73f385f2558a1ab1af7ba8802e9843e29c30d3e59e166c4b48cfe08c7e2ef7d4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075349, "uuid": "c39a1581-4049-4b13-9519-45b1db400c1d", "comment": "Malware payload (Heodo)", "value": "4e7cf3b813076a4654ab60e7c007f106d9deb085", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075349, "uuid": "f6728a84-5bc8-426f-828c-47a7b2fa20ca", "comment": "Malware payload (Heodo)", "value": "a50e79fe7d872f1c3b2c4c3bcabe4b57bf0e4ecf8ca783017161cc36a6ed675cd9de18941f3b8f446ff113a49e9d067a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075349, "uuid": "0d64bbaa-6a41-477c-804e-1234cb7d04c0", "value": "T1B635AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075349, "uuid": "be77b406-4fb3-458d-84ad-21e56410f903", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075349, "uuid": "170a78e0-d92a-4242-aeea-a057cdd87feb", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTtFIIm2m40:wfv1GVFF+765nFvFf6dlzzSpFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075349, "uuid": "3e9ac6b2-7e2f-456e-b104-8e9b7d4d441f", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075349, "uuid": "ccd83f37-8334-4ff2-91cf-869068bcb20e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075349, "uuid": "1329968d-b5e3-4438-bde7-92bb6ee4d923", "value": "73f385f2558a1ab1af7ba8802e9843e29c30d3e59e166c4b48cfe08c7e2ef7d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c65870c-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086974, "uuid": "c6be4348-ecba-4585-9f46-0e37d0d46064", "comment": "Malware payload", "value": "f6c5adc3869b24363a81d283908a9978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086974, "uuid": "08f1289e-dc19-496d-9b77-8ced4c46f385", "comment": "Malware payload", "value": "74ab4b499f6bd9bac2e3e2d206d12edd8b5b7fecf4390278f007729f78db3688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086974, "uuid": "869dbd7f-8787-4786-86a7-65e4c60e83f8", "comment": "Malware payload", "value": "8451ec7b8f6b487cd39d3d5ea9acdafc27116b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086974, "uuid": "0197ddd2-a638-4f92-b7f2-68ba7e9b1d3d", "comment": "Malware payload", "value": "d5d64b79a66b3641e6c140f79296ec0a8cdb526df6ad9c4989e4ef28245ca2027270137e0a387dd389811dac0fb74480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086974, "uuid": "1fcda70e-a918-456b-857c-8448bfe9b5ad", "value": "T14EC109DB96A97333C1960BB643A9F552648CB86007BAB7A63D28314B38CA050642CF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086974, "uuid": "fb2a1447-a0b5-4051-8a8f-eaa657f45a9c", "value": "0aa145f64456ab2d0bfad8949d6836e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086974, "uuid": "b733c4f1-f862-47a4-9045-36865904f021", "value": "48:OEPkwD3HLjNHac6P6N3U2+X4iYoN0ze+T9RgqqsBR1PV4AOqSeJY8JTaudaOaXnQ:nPkU3rVA6lUrXb2LTUqqiR1tV/on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086974, "uuid": "b391426a-2a5a-483f-bdb8-4fb18ebc30e6", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086974, "uuid": "1c71087d-514d-4667-8bb6-d5c18cb19e3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086974, "uuid": "daee1ba8-bb0f-4cfc-bdd2-b9805eeaf669", "value": "extract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb5c052-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "3f335c28-099c-410f-9865-2fafd35de4dd", "comment": "Malware payload (Heodo)", "value": "2a6c5ce5b1340f6b1286dae530151a83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "f09bf655-fedc-4e04-b6cf-2def05e9ff67", "comment": "Malware payload (Heodo)", "value": "74e9a111d40f420129bc02f81ba4bfc82e5fbe950516752f8c1fd6c04a31b5bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "fa94ab86-a0fb-4179-8ec8-71d708566d56", "comment": "Malware payload (Heodo)", "value": "2054b344d8a443a4d95f55b4cb0533ff5ff117f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "b8160601-13fc-4298-9e68-d66d3ba4dedf", "comment": "Malware payload (Heodo)", "value": "536cbf172bb0c64a1f768a5795af466c935e99328ffd4d70e8fd43e969c6b0ea1ed455999c96f913d514c9e9576c2e8b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "aa46665d-e2c6-4e30-b9c5-de2da95246ee", "value": "T1D035AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "31ed1b27-952c-4306-b2e4-9f0f764ada4c", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "74108f72-49bf-45c7-b205-33c1b50ceefa", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTWFIIm2m40:wfv1GVFF+765nFvFf6dlzzSSFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019869, "uuid": "7bee5f13-0415-4032-8bff-c8fe55831464", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019869, "uuid": "8a2c6d78-e0a2-4a67-b1cd-f990eaca3617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "290d3d58-fb46-409b-9486-13407682e774", "value": "emotet_exe_e5_74e9a111d40f420129bc02f81ba4bfc82e5fbe950516752f8c1fd6c04a31b5bb_2022-02-05__001102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fcc501-86ad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644084004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644084004, "uuid": "696eb8cf-3a9c-4fc7-ac66-cd06b3007038", "comment": "Malware payload", "value": "2addc324d5634f841e21decc85b8aa12", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644084004, "uuid": "48ef94ef-f895-4822-8cf4-cab802e6eef9", "comment": "Malware payload", "value": "776f60f8698a313aeb8d578379c3ed828a52a6847915cbb53d7f9d42c385cf80", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644084004, "uuid": "956fa919-0abc-43d5-a476-afe05bf6673f", "comment": "Malware payload", "value": "ea967a7009f923d0388989fd189f2107656be384", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644084004, "uuid": "ec6c8174-9fb9-491e-aa76-393691bbf83e", "comment": "Malware payload", "value": "098ba6b2de9e41e3d78f1764eddbe6ff854b2ab896ff6f8087f0ab008bc486a3a81ac59796f7685bd08a1b6eb4b47b11", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644084004, "uuid": "b62ea980-905e-4365-b3cc-9b8ed9f3db58", "value": "T14606330C23AEF8FDE49949283B6385B1C5E513F1D88225F2D67814580C3F67E5BDEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644084004, "uuid": "1a830c48-7f2e-44c3-999b-33e95533ad07", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qa:0XSxVJG2fLAqFOfT9sMYNM2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644084004, "uuid": "bd5f7258-e486-4e6d-a400-527b78e32978", "value": 3670016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644084004, "uuid": "cdcb22d6-7e96-409a-a6ca-838690458894", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644084004, "uuid": "5bbdd708-ffcb-4e6a-b586-0ab9bab076d4", "value": "776f60f8698a313aeb8d578379c3ed828a52a6847915cbb53d7f9d42c385cf80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e00d31b-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "f5cb28f8-5d8b-44fd-ba5c-2a3475fdf868", "comment": "Malware payload (Heodo)", "value": "428853d3586a22607d4443ecca12b664", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "8f3dd080-2a9f-4477-ae58-48d5fb884488", "comment": "Malware payload (Heodo)", "value": "7981f76d1ddbf799b0fd3625f51d3d4b3da274768213691c56ded2033b09b5fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "27c4cbf8-b912-4fb2-984f-2403b6f31ea9", "comment": "Malware payload (Heodo)", "value": "58c936b296b2a8dcc192156db1d090d7ae96a97c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "bbefce9a-ee84-486b-9580-0ddf6be69f28", "comment": "Malware payload (Heodo)", "value": "528e3706c3029ff983913c01bf73602020400722a08c8ae2f96c7ec5ef0d288db6ea9eb3c88d84ed68b082adc30fb14d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "56bf71a6-ca72-4c10-9590-d5da5d504a5f", "value": "T1DD35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "1912e2f3-c084-45e0-a8f8-22376f0d54ba", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "e078843d-9d8b-4638-a3d9-d4de89ba8488", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTsFIIm2m40:wfv1GVFF+765nFvFf6dlzzSoFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019868, "uuid": "73553725-f253-4875-93fd-579ddf136531", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019868, "uuid": "04bb22ef-0b14-4932-bab4-49f8626e55dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "88b27db4-c645-4fd1-a781-2af36943ac2f", "value": "emotet_exe_e5_7981f76d1ddbf799b0fd3625f51d3d4b3da274768213691c56ded2033b09b5fb_2022-02-05__001101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8c64e3-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075351, "uuid": "5239060b-3e15-4134-a967-c4fb185b1abb", "comment": "Malware payload (Heodo)", "value": "bbc3e54af4e728d7ea5d480b8ef80505", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075351, "uuid": "ca2f5786-bbca-4589-a957-2739d59fb82e", "comment": "Malware payload (Heodo)", "value": "799b3b33a140f39e63282e7a0b2c1eacb7c871f4412d1ec83369c4f2864e9aa7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075351, "uuid": "ab3983f4-9d48-427d-8672-e60a2609eac2", "comment": "Malware payload (Heodo)", "value": "e82027372157729fe2969627cc8c5b0f3bd68779", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075351, "uuid": "ff3818ec-7df5-40c0-a740-b93877917a03", "comment": "Malware payload (Heodo)", "value": "be92bdffee351ebd0a1dfd123124c67b7d88b0807a3b821fb49e428039082205a51f48c54a39ec08b431c9d599711d64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075351, "uuid": "fe89ace6-525a-4e3b-821c-9175e238b881", "value": "T10D25CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075351, "uuid": "c27ef9b4-3f14-49c6-9d9b-81af6bb15fb0", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075351, "uuid": "3b0773c2-8e2f-4307-857a-97264e560d80", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyP9FIIm2mHv:exyq2kpWGWRCLWeNWO1tyVFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075351, "uuid": "e73b295b-9d0f-4231-a16e-f21bd7c6c28c", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075351, "uuid": "aa575ebc-d366-4e8c-a79a-c33f572bceb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075351, "uuid": "f4925015-94fb-4ef0-8875-794793179e1a", "value": "799b3b33a140f39e63282e7a0b2c1eacb7c871f4412d1ec83369c4f2864e9aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfba55e-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088372, "uuid": "eab17146-ffce-497d-af82-31129859cba0", "comment": "Malware payload", "value": "fce1de67fd47f4b6b67ab7eba0bf4246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088372, "uuid": "839b4fff-18b8-4bdc-97d6-80742b49b7b5", "comment": "Malware payload", "value": "7b9a2c398634b3dc90ee82f4e7d25e1ffb3d8aa7abb7e076cab471eb7a9fcfba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088372, "uuid": "042d4581-d4d1-46a6-b81f-33234bf1c961", "comment": "Malware payload", "value": "bc50ef3b75ee04316ce9e24ba5707ba21ad308a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088372, "uuid": "6ddd7a59-e424-44c8-87e6-2b92622c773c", "comment": "Malware payload", "value": "ea852839fa472728fcee96a91131be3622de980425c9aa3ee3d8dca328974b4934bb74b079ef4254eb28af850de4ac1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088372, "uuid": "b025d9bb-c062-457e-84a7-eceb32c9a4ab", "value": "T106F2F146BB287579F2C701315F36DFF2E14AEC906534A623A9DCBB9FAC7618041851E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088372, "uuid": "5aca7957-4ef0-480e-808c-f22fe91fb75b", "value": "9deb90492f23085297cb01def5eb5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088372, "uuid": "509f3ddd-d65b-4b95-857c-bec6ecabc7fd", "value": "768:Mp++KRW4zwdASR82tceZ+TMqCv83g6M3/RKb9PpaTTc5UO:MphYDOAqtck+gBvUglPRKVKo5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088372, "uuid": "aa3641f1-cead-4f73-9fcf-1dd3ed6ca747", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088372, "uuid": "25f1f632-d6e4-4f32-8318-aad4f8a1e9a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088372, "uuid": "b2331a6b-8f78-40ab-a40e-31201bfc2b71", "value": "liliworm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4163e5-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075352, "uuid": "19e5424d-a701-4780-a30e-72fd1896459a", "comment": "Malware payload (Heodo)", "value": "23d74d0c645dd987f15907038a62272e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075352, "uuid": "318f619c-ce38-47fd-af7a-4809c206e0c8", "comment": "Malware payload (Heodo)", "value": "7bdb01814b471f11bd7ed2df3ef807bb91ce6b880983ed216d26f42959bc2a46", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075352, "uuid": "35d3f404-0f9e-4e01-bd26-6fdc40b8bc5e", "comment": "Malware payload (Heodo)", "value": "0ff3d7bedd658df573af5a6a5a36b197f671eec9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075352, "uuid": "dcac851f-e7f4-4025-b809-aa4664b2773c", "comment": "Malware payload (Heodo)", "value": "dd042e22106ec4ed1a22c702df299d889981f076a5784d94164ea94a8a63f69ee070066c5a5971b43420a57a4db742ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075352, "uuid": "0f7bf2d9-d797-482b-b994-cb02e54c415b", "value": "T1C525BE516E9A91A5FA0B247E00AA73470FDD791117E0E8CFEF44F5A71F21CC2963889B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075352, "uuid": "95ac2e2f-ea02-4917-9e44-33dac291649b", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075352, "uuid": "4940c2a6-4a2c-49ed-8a4f-feb125386c78", "value": "24576:vGvafwy8HdhFsvdjNxcnsnPMf9yoro8ult+s9CdRP332L6OFIIm2mm:vBft89mjtMf9yok9lgdZ+FIr2mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075352, "uuid": "d25860eb-f316-42ce-9bf1-d25abeeddc81", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075352, "uuid": "8b7b83e1-a508-4f2e-a717-7b794b19db45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075352, "uuid": "12c31854-cc37-4ee2-bad5-e583cf52fd18", "value": "7bdb01814b471f11bd7ed2df3ef807bb91ce6b880983ed216d26f42959bc2a46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e66ca56-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "4d92021f-80b3-4255-a901-70c70615e280", "comment": "Malware payload (Heodo)", "value": "a7e90f3295eb55f71570310d7235aca7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "4b99d222-f95c-4eb5-ad03-4c629934577e", "comment": "Malware payload (Heodo)", "value": "7c5f4c7a28a23cb0b457e85f6e59ed1dafc570cd21c07227746ecb5af1206ba4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "7fd6e10b-937a-45d2-8b6d-2a87c9918dd7", "comment": "Malware payload (Heodo)", "value": "1330659c028926038c156ffdb763ec8e9abc09fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "52a247b6-f247-44a7-a34b-353ab3a31ebf", "comment": "Malware payload (Heodo)", "value": "91eaaf353180c3d39a23117e30377945fb2c2584b5eefcbf3b3563fb6cdfbf6bc150e57ee52b0eb8254039c06df2826b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "ad2b7dba-4c55-4f7a-b80f-9ec8192b0641", "value": "T17935AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "42e076dc-a588-4a6d-b4b8-26da61932caf", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "38920509-5f6b-4340-b567-67f5ef275ab2", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTLFIIm2m40:wfv1GVFF+765nFvFf6dlzzSPFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019868, "uuid": "cccdfd8b-0172-42be-91a7-8cae265c812b", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019868, "uuid": "0890e291-b706-43b6-a711-0fdf27a47f68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "1216adaa-ef7d-4622-a8df-bdad18bddb19", "value": "emotet_exe_e5_7c5f4c7a28a23cb0b457e85f6e59ed1dafc570cd21c07227746ecb5af1206ba4_2022-02-05__001103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be390b0-861c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644021797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644021797, "uuid": "84f38c9d-bc9b-4d33-9425-5b92f28a041b", "comment": "Malware payload (Heodo)", "value": "0dd15a22afedea41bf7f65825cb793dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644021797, "uuid": "97859217-5f57-43dc-aff4-ce89ec39e351", "comment": "Malware payload (Heodo)", "value": "7c8d0268b86da18adcef2cdc44149a53d43c00ee7843c1a59960eccd495832a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644021797, "uuid": "a33a9343-0f8c-4b96-89ab-506d2436791b", "comment": "Malware payload (Heodo)", "value": "4a44685be448ac8affec85f627277b3fca9a177e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644021797, "uuid": "c8939571-87a1-493c-a2c0-5dccf7ce3f11", "comment": "Malware payload (Heodo)", "value": "d920f4f6d0a9e0b42af4972705ba96e97690b4b8f3cb887bff15b25e225a1acafad7343c390050665f29758478c74505", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644021797, "uuid": "fd974290-1bbf-4c74-9a97-d6064a5523b5", "value": "T1FC35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644021797, "uuid": "c2350192-898d-46b9-a709-3b89d49a109d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644021797, "uuid": "5e5b5dc6-a1ee-4e42-9376-86c6d0140a53", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTgFIIm2m40:wfv1GVFF+765nFvFf6dlzzSUFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644021797, "uuid": "fed405e4-c021-445e-a061-17473f5e8a33", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644021797, "uuid": "d862fd66-4915-43fb-a71b-d309fb918245", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644021797, "uuid": "2ce4d541-b3fc-488e-bbeb-76825dc30a4f", "value": "gPjKK41i2xB6s44x.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd567cb5-86bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091968, "uuid": "84cbfb6c-2f65-4e7f-a8ae-c0cc2b8bc815", "comment": "Malware payload", "value": "ebe499343061e49ea4f31639fc3a7e59", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091968, "uuid": "910d4f4d-064b-424c-8410-30834ca736c2", "comment": "Malware payload", "value": "7cf2db52892613d8bfff7fe6466419b0e29fac8ab77859ba097435c80e1311c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091968, "uuid": "55cb4205-c7ea-403b-bf77-15ae5cb71a5f", "comment": "Malware payload", "value": "89de7abdbdc3fc8764d481a49125b8a3cebf6f05", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091968, "uuid": "c5e9f414-7804-4778-b5a7-bf8a8025d6cb", "comment": "Malware payload", "value": "4ba5016923287e652391e13889a895e131ae113f70539905a46a4d2245e9385a14f0c1d7a06ceb38e65624dc3243a365", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091968, "uuid": "a9a7ff00-7db2-4575-b149-9794c87642c6", "value": "T1A8E2520172D1EE06DA961A310DFBCFFA5736BC51AD01C30B3194B35E2C39E608EA27A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091968, "uuid": "c5c0d1ea-f580-47ab-9545-e3f79cb71f5b", "value": "384:A4KKKKKKKKEptNdn4FXv/4enJO3jNeur:ANUvgeA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091968, "uuid": "6e3c8397-8c3e-4bb8-b972-8ab7ba4b217e", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091968, "uuid": "e4a98a60-e6fe-4038-948d-6d6d50336e3d", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091968, "uuid": "296ba9e4-f8a7-4279-b26d-947b74044481", "value": "Maya.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e934f64-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075354, "uuid": "d1246ea0-ac31-48c4-813f-8dad8f10512a", "comment": "Malware payload (Heodo)", "value": "4b0c9aea377195e5d03bbe03aaceda7f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075354, "uuid": "bac2dbdb-77cc-496f-bc12-d58d65118b07", "comment": "Malware payload (Heodo)", "value": "7e1c9c5e18e658c8ebb21217c12b21930e06766ab0c5176e5e773a734dce73bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075354, "uuid": "472c2b0e-4c31-4224-acb7-013c4f018d0b", "comment": "Malware payload (Heodo)", "value": "ee6b31d13353ac1fab6dd07ad3ec67c5807814d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075354, "uuid": "b9431ae4-fc84-4cb6-822f-bddbd30ec145", "comment": "Malware payload (Heodo)", "value": "123387c1716376cfaec1b5d694e2fdc8525030cae74a35a526e173400152173cebfb3e0a0b3932bc545d1c1d1b909f29", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075354, "uuid": "a526ba3b-bb46-4a52-83af-430a37a8ff80", "value": "T12835AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075354, "uuid": "e5b220d5-1f85-4873-8de1-4695f935fcb6", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075354, "uuid": "5bc84c23-16c9-4335-ac33-9a2a93740c3b", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvT1FIIm2m40:wfv1GVFF+765nFvFf6dlzzSpFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075354, "uuid": "35cb9de1-6220-400f-9bb2-78de521875e0", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075354, "uuid": "ccf25ca4-8038-4266-aac1-e2acb8f15a4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075354, "uuid": "e07f032d-0cbe-4ead-93fb-709f0499b5d9", "value": "7e1c9c5e18e658c8ebb21217c12b21930e06766ab0c5176e5e773a734dce73bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512c1204-8676-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1644060326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644060326, "uuid": "3e27ff3c-e1d2-4224-9f19-73ae3913ec3e", "comment": "Malware payload (CoinMiner)", "value": "3a7c2b0eb8ad94e61ea3c1ac3d6590e9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644060326, "uuid": "b93006c0-2195-4f5e-ad86-f22f1f53b28c", "comment": "Malware payload (CoinMiner)", "value": "7fa24025283e6b745f20c81e15a8cdb866905fb079579b71efd9e659398cb574", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644060326, "uuid": "9a1ab782-77c8-46d3-b929-d18bb9d441c3", "comment": "Malware payload (CoinMiner)", "value": "e5c8063186673888b173ff6bc4466dcd6e122e0d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644060326, "uuid": "63fe8311-b665-4f8f-b584-16ff52a100f4", "comment": "Malware payload (CoinMiner)", "value": "ec909c8bc3d9b2e2e855be3b95ac0af2217073f3c745df2d4130b3fc67a50167ef27d19dbcf3d836f53ffc1a6913f100", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644060326, "uuid": "37e2bf6c-9032-49dc-91a6-2fbb025f8201", "value": "T1A0F53350BA86A043C5A3C9F1AD2F2A170677EB5F15EE200B8B207FCE7E843858DD6755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644060326, "uuid": "2458777b-3475-4126-9953-fa2ef4e0fcc5", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644060326, "uuid": "fc874caf-9b45-4c13-b3df-2d7d784144f1", "value": "98304:Jroztd1Po4w0x3aYy0X6aKLjSQpZ3rWD1:J8R3aUZ6L1frWD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644060326, "uuid": "89a8756e-588e-4b83-b71f-58aa6f668d29", "value": 3472682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644060326, "uuid": "1252d7df-2633-4d5a-92c0-3bf188163f8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644060326, "uuid": "f7d96a2e-9ee6-4ac6-b98d-77d7ea0e8d3b", "value": "7FA24025283E6B745F20C81E15A8CDB866905FB079579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f897fb0-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075356, "uuid": "54c614b5-e09f-4234-93dd-da5deedc2ac9", "comment": "Malware payload (Heodo)", "value": "fa691f25b9207b6282b5dcd16e14d354", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075356, "uuid": "b14d242a-8304-4ce7-a4af-71d02e710f37", "comment": "Malware payload (Heodo)", "value": "7fb54eaaca7985a7c76569e5eb8f6fa56eef91b87d4a7299bb306f530dd379fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075356, "uuid": "8a505d76-afdf-4e94-9d34-1fc62e36c230", "comment": "Malware payload (Heodo)", "value": "f701201360a0ebc7e6d2596716390f08eecf1b46", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075356, "uuid": "70f0a1ec-7b0d-453c-b628-9b71c12527d5", "comment": "Malware payload (Heodo)", "value": "cab178ea1ab8fae045672a158966730dcf8209a4cd55a38bd511653b3fa1c536ca9b1c48a27e492dad636d03b18a919b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075356, "uuid": "796940e4-2567-435a-b74b-c42334a88ef1", "value": "T1C025AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075356, "uuid": "7e7dc588-1a9c-4a01-9af7-1a7a5a6ed378", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075356, "uuid": "6192a83d-34e9-4162-8e87-11a10bc69933", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxqfFIIm2m42:1ZsYB7vLsnZI1Hb9DdFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075356, "uuid": "32a9a5ff-6760-409c-8ed9-4117a0b4f185", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075356, "uuid": "6f1bf065-3197-4048-8de4-81779c8a0861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075356, "uuid": "04d10a1e-97cf-4502-96a9-4163189a0bd7", "value": "7fb54eaaca7985a7c76569e5eb8f6fa56eef91b87d4a7299bb306f530dd379fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c148c09c-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088432, "uuid": "4f98f413-c39d-4fb6-83b1-14f392862b20", "comment": "Malware payload", "value": "b2ff3ada6672ac9266a6fac5842ae706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088432, "uuid": "05cf8077-76af-4015-ac47-a941da1c5820", "comment": "Malware payload", "value": "7fcf945f5de37bffc3f06cca6144fbf829d9ccdfaf1b7ab73c6e2fa747a6bf3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088432, "uuid": "9962115e-9a87-4959-a5e1-322820308424", "comment": "Malware payload", "value": "93d70d8a36a4139f494fe82fb8d418104a72a899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088432, "uuid": "1718885a-7edf-4d2c-ac30-cf97df609563", "comment": "Malware payload", "value": "eaf9191be718813e9a90434174187f4404d15f45f848aebdf06ff71cb253e6f78f35f89a05c4bfe410193b4124346d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088432, "uuid": "1219a7c4-74be-4355-91ed-1c1146a54884", "value": "T10F12396AF3AEA023E12208359C77CF3628B67C51493C57577881B7AF3C719A06E14E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088432, "uuid": "a5df36f6-1da9-4800-ac4e-b4b2ffc162cc", "value": "9deb90492f23085297cb01def5eb5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088432, "uuid": "4bc92e52-a64a-42cd-b4cd-ee6a0b74ccc2", "value": "192:VpU1BbrAhrKuny9fHgV9b1fXqZPga3EaiB5uIZI:VeBArKeUPgV95s3EaiDDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088432, "uuid": "db4af679-ea4e-46a4-b2cf-b26750bd12f7", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088432, "uuid": "e2e7b850-446a-41cd-8b86-befe2df91cbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088432, "uuid": "8d0d7fd7-796f-41a4-b2c6-a2c022472c7a", "value": "visual.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50daea20-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075358, "uuid": "c87dfbe4-a6d2-42a0-8a1f-b9e0175d5aa4", "comment": "Malware payload (Heodo)", "value": "cbc3d090153ab12f5bd39fe196a1b37a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075358, "uuid": "ef0723fb-adf1-464e-994a-4fa879a9ce96", "comment": "Malware payload (Heodo)", "value": "808fcd742f28ecdbba27620e2e760c24dd52e079d0bdb69c32a19830374cb842", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075358, "uuid": "11f77543-e44d-40d2-abef-3de962016bd2", "comment": "Malware payload (Heodo)", "value": "e3d51f89690e24aaf9ae0f048aaf393f82a94e49", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075358, "uuid": "2809bb38-096c-4569-a532-ccb61d566133", "comment": "Malware payload (Heodo)", "value": "26ba7aa2acf80659e1c669ae3d4208f5a2ca84daa7528116c3429f7383a1ee4b13d1267bdaafc9ffee51a6473b01157a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075358, "uuid": "be403b85-9549-492e-830f-d1247828629c", "value": "T1B435AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075358, "uuid": "cfa99fd8-64d3-43bf-a428-ad870699c501", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075358, "uuid": "8a7627d8-0c7d-414c-8451-c260ccf579ea", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTFFIIm2m40:wfv1GVFF+765nFvFf6dlzzS5FIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075358, "uuid": "238bef2e-e98c-4056-b0d8-cfde36ff4ee8", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075358, "uuid": "39802b96-edd0-4ea6-b989-519ca8c60fb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075358, "uuid": "48e43dd0-82cb-4d29-9215-f14d6732f51b", "value": "808fcd742f28ecdbba27620e2e760c24dd52e079d0bdb69c32a19830374cb842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1397c4c3-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086852, "uuid": "5f1cd66e-97a8-4ca0-adc6-3548488bfbf9", "comment": "Malware payload", "value": "8b66aadcff8510521ba7f0bacb6fc54a", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086852, "uuid": "689c2c68-e5f6-4fa9-98c6-a87ab9f2f2da", "comment": "Malware payload", "value": "80e9eb2c465cffd469241ec681a55b897418f98dfa1be31bd0c4f86466d308ec", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086852, "uuid": "d5131c3c-aee3-4bec-b714-cf67b4525b1e", "comment": "Malware payload", "value": "e1022a03f29f2ffd74764d6e4547b691c16991bc", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086852, "uuid": "9f434841-5fb7-4888-be1e-1e8b7586904d", "comment": "Malware payload", "value": "0dc004d679b859c80685a402384ccf478a0c0e3e5e630775324ee637176fc2eec9c5a09d6a3905bd3c7f60a6aa10ca9e", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086852, "uuid": "b616329e-8f84-490a-b8e3-251aacca2fa1", "value": "T161614321B409E4CCB93657E325E0944DBC7085F2DA391EA83C04C877E275BAD15A66FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086852, "uuid": "e2d1815f-03c9-47e5-85a2-bccf02b1dd69", "value": "96:WAsSCF7gRgjgpgDJgHgMcI26FINP0TGMtl:ooeuOJcPyy1tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086852, "uuid": "732bd673-bccc-4c60-b35d-eb005ff3ecb7", "value": 3349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086852, "uuid": "cdf812f4-edc4-4c49-a4bb-d30333eafd9d", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086852, "uuid": "61b6fde3-c873-4cac-ab40-a29cef1bc8ed", "value": "Welcome.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c728351-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "182f0c34-7ed4-4ec2-93c0-f0c8b10b66f9", "comment": "Malware payload (Heodo)", "value": "0ed63bf46c6ef0f28cfca0c1495f44a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "0d32d8ff-b130-4f96-9a89-55f67ad4a2c9", "comment": "Malware payload (Heodo)", "value": "817ac9efeccd560a56cbd74afe205f5fb6fe5f9c0abdedb86c12d3619637d0b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "22690fd3-f0bb-42d3-9f87-fccd7e4c711c", "comment": "Malware payload (Heodo)", "value": "93c40fcb3600c2addcdd666b170f913b555836e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "62cc078d-bf01-4fb0-b750-f3bdb00290ce", "comment": "Malware payload (Heodo)", "value": "05432d61ebe0e73a1237f5b3a11e643ce9570df79b5157b47cdaf2cde09d0f45a59225d2be58b941d632b59dcf8c5045", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "e80add2f-c869-4f1f-96a4-4ccde0ae900c", "value": "T13B35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "375c6d25-86e6-4129-a25c-3bc5c6be4020", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "2ddeafb6-c11e-4408-acdc-e5c009132ffe", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvT9FIIm2m40:wfv1GVFF+765nFvFf6dlzzSJFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019865, "uuid": "46b9aa75-9b29-4823-a387-f02c400d3b06", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019865, "uuid": "5eec9fc9-db78-4056-9637-921ff90819be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "7a870cc6-2098-4a10-a243-c2be00992a26", "value": "emotet_exe_e5_817ac9efeccd560a56cbd74afe205f5fb6fe5f9c0abdedb86c12d3619637d0b4_2022-02-05__001057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf5f695-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088503, "uuid": "f3b48667-d4c8-4bc7-898b-f21d1b7ccf76", "comment": "Malware payload", "value": "763d1411edc603a60b7fdd2f63d77579", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088503, "uuid": "f1bee9fb-fb08-4749-8e07-7bd659539e9e", "comment": "Malware payload", "value": "81cc7d413b725e992ea347f493f2284b0943ca8c1333932e5b4142d532825cec", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088503, "uuid": "ec9c3195-7a6c-4d80-90c9-952994b5a891", "comment": "Malware payload", "value": "98fede0c3a54c7c3fd8261b44b27107f91f4fc49", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088503, "uuid": "005c403d-a181-4b92-9fbb-cf5a39b7414f", "comment": "Malware payload", "value": "5f4d18ea5e54e4caa0c24178b7bfd97acedd1ef7b21c097fdadcb02fa112331997416f3e29444be72512501df84377eb", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088503, "uuid": "68789f0e-e540-49b6-96f2-caced4cc6e27", "value": "T15A3186227793D9D59C92580338F1C549DA99D8903A34EBADEDAEC1D663340BC9D3E1C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088503, "uuid": "de4b6351-b138-462c-8d8c-a1102cf75c50", "value": "48:8WUU4aY1ZEK4jG91fTlXkzrlkS6uBtb6AshcKF:8W+aYvEK4ExTlXkdkS6uBtuAshc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088503, "uuid": "0925f89d-3c55-4f2c-b657-e39a0deebbab", "value": 1683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088503, "uuid": "a344cbce-109c-4a16-9666-ae87e80163e1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088503, "uuid": "169777e7-e58e-41bc-b7aa-01e7e936e09c", "value": "Kadosh.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accf0fd7-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087109, "uuid": "bc797e1d-8f95-4c7e-ac36-2e21142da32f", "comment": "Malware payload", "value": "0316dbe5df244e6a4fc18ce96e7b3907", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087109, "uuid": "96d0d352-80b3-4f66-bf3f-0b6b0915fdba", "comment": "Malware payload", "value": "82967d2019802cc1e4c8380c3afa6b23851a529f5e0fe94dab0ee1832bffa5ba", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087109, "uuid": "eef7e11b-7dbd-4461-8cb3-0b3021f8a261", "comment": "Malware payload", "value": "1fea896705358384a6889d1a223f1416b2880902", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087109, "uuid": "61ee7e4f-5160-47af-bf9b-60bb061a0dc3", "comment": "Malware payload", "value": "8fa8276b6efcdb2cf51a4390b255e1e595bebaeaf679f193129c8334d18a50b25909d4fc1ce9ac120bc877d713e668d1", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087109, "uuid": "a58dfae4-fd92-4eab-8ff0-3b85c5393200", "value": "T19501F415F332F2D2092A0D63D6E0654AFF08C0D02F2469AC459DCDC75BB1A3D4E4C853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087109, "uuid": "c4bfd96f-0656-456b-a55c-03428280d085", "value": "12:9vWdokAAxPhZXdQXlopcbUSLv/ypiJaYNB9N28qrAUcZXd0wYRDXVWjWAJa0dD2a:9AoqxPdQXl4cbxj6pigYjgAUcRtYRXAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087109, "uuid": "d6e4ddae-e2e1-425e-9237-7b5b75215e3d", "value": 721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087109, "uuid": "5988081e-6873-4336-bae9-ae7905106dd4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087109, "uuid": "311f60ea-c136-4bd5-acf0-1292c7462649", "value": "haram.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8e9071-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644075109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075109, "uuid": "86b6b752-938d-4e17-b4cf-808c7972b58c", "comment": "Malware payload (RedLineStealer)", "value": "e1f92ce262396b5030c2f9a0d448d162", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075109, "uuid": "e4b3424c-b64c-45ef-a0fd-ee8c9aad1a09", "comment": "Malware payload (RedLineStealer)", "value": "83192912fec0c2f7c3e4e350f8722aea77fb085e78e577016675a1f0ee6a4efa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075109, "uuid": "cf253270-0cdb-4676-9709-33d4ea1a5fd5", "comment": "Malware payload (RedLineStealer)", "value": "c8c5aa8f31e50f37ed1aeee57606a1001bc8dad3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075109, "uuid": "e3b55042-572b-4ce9-b25a-0307bb4aa10b", "comment": "Malware payload (RedLineStealer)", "value": "be5809c6a7a13dded5750d2082c22815be6196b33e70adcd2494b2b88f5f68d5ec68ab7ec4f1362c4b3368777d24940f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075109, "uuid": "d75a39ea-85ea-44ef-ab02-a0ac61c847a0", "value": "T101652343E24575E8C1463FF8DF836587CAA6E810F52C4279B7A91F337459E920B2B0B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075109, "uuid": "8d4125e4-ea8d-4ad5-8c5a-fe2c511c7c66", "value": "f6af73011d9ad7cbccf66eb190442910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075109, "uuid": "e65082ce-8bea-4766-b5d3-b93e2013ff89", "value": "24576:gwQdFXTmGzIhhfQwJ7lZin1lusZw80vv5xi2tcjpiN+ow8kEaHNYK3sfNW9W9:UjXTmGM/J73in7V2fX50qcAN1NaKfNWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075109, "uuid": "711763e7-23ff-48c7-a643-87e43401d52a", "value": 1416192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075109, "uuid": "9b2990cc-7ae8-4d26-adf1-130bf3e2b73a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075109, "uuid": "ca68ab75-c692-4213-8ee6-68fe4db6bef7", "value": "e1f92ce262396b5030c2f9a0d448d162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfa39d4-86bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091057, "uuid": "7a48db74-8f9d-434e-af37-d36ece3adf17", "comment": "Malware payload", "value": "db45536af4e9a1debccb73111fce3f3f", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091057, "uuid": "9a4756e6-b045-41bb-9fcd-65c3c2ec9737", "comment": "Malware payload", "value": "8395975c4bb035252749c75cbcc49180046c474fe4fd3616af27e8c893f28d6f", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091057, "uuid": "85274f28-4de5-48a0-a3e2-e22b3c969b4f", "comment": "Malware payload", "value": "d8dfd047f7ccfba137bd3932c6495d7c0fc88d2e", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091057, "uuid": "778dad82-d909-4e38-87c6-7c3dc34b6d63", "comment": "Malware payload", "value": "5bccdf202f0620e50d817051415f738a624adc8f186c385eec261b16d36c13c4533a7bbb28426273cd730876f1a21a5f", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091057, "uuid": "6e2092c6-a2cb-41ff-a4a2-796272790e38", "value": "T16A919455B701D923E162FB4338EF590877418BF7A8B045ED9E29C2D336125BED4B01DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091057, "uuid": "3e8ef82f-eab4-4f57-a37b-a2b4e9f4286b", "value": "96:WA5jsBRae2E6r3Q4gIMLNMbbZ48q/qBFLDQap2EJL33ZouoOxYGJh/4JYZLM+L:9jsOe8dgIMLKSiHLDQ8YGJhUYZxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091057, "uuid": "3ee73f62-23be-45e5-aa6e-e93e0bfc08b7", "value": 4566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091057, "uuid": "02f7c7a7-dca4-4477-bfa2-96d6e5230628", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091057, "uuid": "33500a3b-fe19-44e0-86d3-1b45b915b717", "value": "Starmania.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e4d241-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "fb5bc78e-d9ad-4a2d-9c86-1b32353ce9ca", "comment": "Malware payload (Heodo)", "value": "9f53e67b338b967c28bb5ebe46eced15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "ba66b0b7-a9b6-4c59-9ff6-8a0fe3d5e8f1", "comment": "Malware payload (Heodo)", "value": "86a57f269cbc753632845beb959eb437bd0bf6c054e12bd457ac6e7d8fb15680", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "951a6bfb-cf50-49b8-9deb-56c6cc947d25", "comment": "Malware payload (Heodo)", "value": "39baaec7706cca55fde28fadd9b5c7d6bcba59f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "d268cd0f-2a4f-4151-9293-25bbd4546b48", "comment": "Malware payload (Heodo)", "value": "22b30fbf03631e0a6b1e59ca018badbbfdea0cb992a322272c727726675fc1eef8779c18284c6b5caefefea3522b817e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "d3aa3bf3-5587-4d28-a314-084c85ef3727", "value": "T15825AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "8b5ee7cd-a8c2-42b4-90d8-6305542ce69e", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "eed00cc1-a616-4e65-9690-422a95b91bee", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxtfFIIm2m42:1ZsYB7vLsnZI1Hb9DYFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019720, "uuid": "6de7c0ba-2c96-4e42-9655-6968dd793724", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019720, "uuid": "4075877d-848b-4311-86e0-341d0cc18752", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "5bd1029e-103f-44b6-baa1-f7fba5be12f7", "value": "emotet_exe_e4_86a57f269cbc753632845beb959eb437bd0bf6c054e12bd457ac6e7d8fb15680_2022-02-05__000832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51969ac2-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075359, "uuid": "6370a60b-6f49-4cba-a9f5-c19ddb7a446e", "comment": "Malware payload (Heodo)", "value": "64219be029b7ba6a5426cf4e4e2d7a79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075359, "uuid": "96837dd5-5df1-4c3c-8187-537e1af1ecaa", "comment": "Malware payload (Heodo)", "value": "86c2314c7b8178d528de8502946021ba4f84cb7800d394ad31560f0bc0533550", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075359, "uuid": "2a692ff1-f736-4383-a075-d3594951cb9c", "comment": "Malware payload (Heodo)", "value": "6005924522ded806b23849dad02ec445f021af39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075359, "uuid": "0e9afa2c-69a0-46e7-9ce1-b7a8525758aa", "comment": "Malware payload (Heodo)", "value": "2d8721a3830c6c0a3019f7dc55bb5e54376ab71c1d6dd19c176f7d1938b00f57cf48828096bbd59d483babeedbaf6749", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075359, "uuid": "42cbe537-8be1-48f8-a8f4-015dd75aac8d", "value": "T1CB35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075359, "uuid": "bf41ff94-5d1c-4723-aaab-a52f192456d2", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075359, "uuid": "32592ba1-f4d8-4d9e-9585-b9b60740c0a4", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTfFIIm2m40:wfv1GVFF+765nFvFf6dlzzSTFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075359, "uuid": "590370a6-f0d7-4c23-b709-13b134424f81", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075359, "uuid": "96df6b38-59e7-4951-857b-6f471374464d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075359, "uuid": "f0b22420-92f7-4ee1-b125-c0e9f342be28", "value": "86c2314c7b8178d528de8502946021ba4f84cb7800d394ad31560f0bc0533550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53144ce1-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075362, "uuid": "2e9a9749-e7ae-425d-b4b1-78107775956e", "comment": "Malware payload (Heodo)", "value": "2edbfbf2b97258bf072fa76eba11b9d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075362, "uuid": "a68118f4-d10c-462a-9662-7af9920437ea", "comment": "Malware payload (Heodo)", "value": "87966ed7e17a6daaa9732d9adceb8df75118812da0d40e695b08223d071c27b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075362, "uuid": "72da4d33-b82d-4b26-9001-c0c76d5b3607", "comment": "Malware payload (Heodo)", "value": "0749b0a2bf1c80737b597cd5594ed01140ac6a8c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075362, "uuid": "04474111-ce8d-4fa0-aece-1e1a61ef166d", "comment": "Malware payload (Heodo)", "value": "7c1d1aaf9754233a9912245a54c0c3472c513c6ea6525a8b5ee553ea4fce4c8d64830f9797d2703e7e68dad40bcebb43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075362, "uuid": "df707149-3691-4b50-adbd-9e0a64a3528e", "value": "T12025BE516E9A91A5FA0B247E00AA73470FDD791117E0E8CFEF44F5A71F21CC2963889B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075362, "uuid": "c531a33d-fab2-4271-8829-2fefecaa1dd7", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075362, "uuid": "f5477f94-20b2-4a09-a9b5-e0bfdcdcd3c2", "value": "24576:vGvafwy8HdhFsvdjNxcnsnPMf9yoro8ult+s9CdRP332L6iFIIm2mm:vBft89mjtMf9yok9lgdZyFIr2mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075362, "uuid": "b6d070d3-4881-4097-a781-81a9ba95e05a", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075362, "uuid": "8be09e79-f14c-411a-bb9d-e99790f5b1f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075362, "uuid": "e1e522f2-00a7-4465-aa3a-760b47264267", "value": "87966ed7e17a6daaa9732d9adceb8df75118812da0d40e695b08223d071c27b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ceb2ce-8626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644025838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025838, "uuid": "764e7317-be06-4b32-8e4f-d988fa17d6fd", "comment": "Malware payload", "value": "e66b033492c8f1083ed1717157320844", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025838, "uuid": "711d7320-18a2-4f24-bed9-ae282cb2b5d5", "comment": "Malware payload", "value": "87995d4feeeb461c1c888678f43bc64101155353114baaec6e9aed3affbcc940", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025838, "uuid": "a213f3f0-61b4-435f-b066-a60e38a80dc0", "comment": "Malware payload", "value": "1f3265de14f3560d760935dd3d8b23e9df7254d0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644025838, "uuid": "c976a8a3-9a55-4dca-9c1d-02c206e71942", "comment": "Malware payload", "value": "89d5d6748a81f130f8ec7238031290451bf76405ad0f66273ce4b45b7c2e9bd6e712dfcd39e5386a16fc141df95e7583", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025838, "uuid": "33f542cb-bf93-40a8-a87a-91e7156f40ef", "value": "T1B0B42378B3C349A9E9698FF1BAABA9391140DE739B078B1704EE1B37480D5D7940F15C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025838, "uuid": "fcb33aa0-e074-4553-9e4c-3e12ca407fbf", "value": "12288:0UNxyjXYq5egIKC6r0EwwLLN6zjCrHXJNubESTV+A:0Z/egI4r0uLNMjCL7GtV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644025838, "uuid": "4e1b5948-f695-427a-963f-084f58b6961e", "value": 517418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644025838, "uuid": "6a7fc0f8-9a56-456f-bed2-c7da5965bedd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644025838, "uuid": "fb24bf6f-c4eb-443c-977a-ae37fd345d27", "value": "e66b033492c8f1083ed1717157320844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5462639c-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075364, "uuid": "6523a1c9-5bbc-494b-99d5-a67945b4c3e6", "comment": "Malware payload (Heodo)", "value": "9b7fead0259617567ea9073e21dce001", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075364, "uuid": "fe77d86c-13b4-455e-b45e-473fae6be57f", "comment": "Malware payload (Heodo)", "value": "87b43eb7a7a3c0a4f507f0462327210a9a8c700c9e8df805d7b4522b0fddc995", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075364, "uuid": "92d81dba-589d-4742-ba87-a44fe41efb8c", "comment": "Malware payload (Heodo)", "value": "412b06d901c0c512be1769cca921d4738c92f02b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075364, "uuid": "ba9c5f17-1e8e-4883-8379-c58d67fbe1ee", "comment": "Malware payload (Heodo)", "value": "338b4aeccfa7416dd92812ab10835c597ed980d20721f076add6ed08b0c83822644ff7a8752efa87ef97a466cd5b536f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075364, "uuid": "0ed791d1-b300-46ff-8c17-d05e14a71dec", "value": "T19C35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075364, "uuid": "c7f7f0ec-b1e2-451c-946c-5d263e3c56db", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075364, "uuid": "4c0fdcb4-3b33-4787-a493-9726b1db5737", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTQFIIm2m40:wfv1GVFF+765nFvFf6dlzzSMFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075364, "uuid": "18796688-8325-420e-ad31-c8efa578dcf9", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075364, "uuid": "18a3f9d9-fc93-44fa-a233-f6f442c0a0e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075364, "uuid": "fd6eccd3-df28-49c8-8665-a4cbd7d40fee", "value": "87b43eb7a7a3c0a4f507f0462327210a9a8c700c9e8df805d7b4522b0fddc995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55277d0c-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075365, "uuid": "5cc93df8-5abc-4734-a977-27b144f37001", "comment": "Malware payload (Heodo)", "value": "688e18b1c290e0bb3b2334fda57e677b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075365, "uuid": "44595563-b1c5-4775-aef9-7b42a2775953", "comment": "Malware payload (Heodo)", "value": "88f009c6d7f2ca18feb7310848fcc8efe37e61d14a4f1f494ed7da29cf876049", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075365, "uuid": "829f9316-c069-4734-8d65-27bbd1ffbe83", "comment": "Malware payload (Heodo)", "value": "a290a3ad8b1e5acb4d3522eaa3ff2f1d8971f67a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075365, "uuid": "1dd06ead-f576-47e1-a7d3-8ad82a9d1af3", "comment": "Malware payload (Heodo)", "value": "903ed5187f3e9444e516c24876289d4df8c579119d184e390beee4e1e12ca5783639fbfe7b07d0dc388102a43857f737", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075365, "uuid": "3e4bd28e-aa4a-4b6e-b22b-e360880a06aa", "value": "T12625AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075365, "uuid": "72662aa6-ef5b-4a6a-8f11-2bb06e760305", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075365, "uuid": "15772fe0-63b9-4c67-a6b8-de8cfea0a46b", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxIfFIIm2m42:1ZsYB7vLsnZI1Hb9D3FIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075365, "uuid": "5c2a29de-621b-4b47-9489-69506e1e80b1", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075365, "uuid": "235be2db-02f3-41a7-9da6-82bafddcdcec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075365, "uuid": "dea5cf60-e913-4b86-adb5-f1add8d5f8a1", "value": "88f009c6d7f2ca18feb7310848fcc8efe37e61d14a4f1f494ed7da29cf876049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b51882-8659-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644047773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644047773, "uuid": "de0debc4-8087-4521-87f6-087fbcbe5c90", "comment": "Malware payload (RedLineStealer)", "value": "a2cf8b69509c6daf5bbe6956182a9dee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644047773, "uuid": "40a0793a-aa90-4e69-88c3-93abdb0593ce", "comment": "Malware payload (RedLineStealer)", "value": "8c3ef73edfa0ae05e257b02ade9d540c736426d9fa20eb8a923a1acb0d4cb72c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644047773, "uuid": "2806008f-6096-4ccc-8c84-b2a3c9242475", "comment": "Malware payload (RedLineStealer)", "value": "6b0259ce1fcdddbfa676c2ac04712efb8fd670c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644047773, "uuid": "a09ab0ed-87bd-4ae9-a79a-4ed770eebb7e", "comment": "Malware payload (RedLineStealer)", "value": "afd329e0de4f5e6a20b037ddaf990ce2c306f5067112b406865fda273d4b9b085787eef9a44ce5926077dbcade1fc040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644047773, "uuid": "109badf9-7d66-456d-8ae7-788a098f0ae5", "value": "T1B79579A0848D7CEEC36647E02B1F3D6D746D7672F2C95A490328EB4212B9A3F660754F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644047773, "uuid": "dbd6079a-f3d1-43cd-a789-d991016c2b0c", "value": "a83a1c67f35ef540380bd259b4fb0b80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644047773, "uuid": "b3e42d04-09fe-42a1-97b2-40be12939bde", "value": "49152:NumejRidrjx93n0dEqLevLZzruI9TSIgJ:EmejRi3SDkRLSIgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644047773, "uuid": "386c527e-6010-497e-a9c9-d92c6ed77de5", "value": 1917632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644047773, "uuid": "ac2ded07-cd14-4bd1-9d9c-22218cbd7ba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644047773, "uuid": "efa462be-8b5c-4311-9a03-70d9b7c87764", "value": "a2cf8b69509c6daf5bbe6956182a9dee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34488adf-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644076169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076169, "uuid": "121a8058-efeb-4a70-ac20-d9d619c37437", "comment": "Malware payload (Heodo)", "value": "e4c0f137cc72d31333d5e64c915b7af2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076169, "uuid": "b24a2407-c0d8-44be-b19f-0aa77ef9fcef", "comment": "Malware payload (Heodo)", "value": "8cccaf130619212617cde264e28c68d36d0a93dd4f9eb358f7ed5e93772ac256", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076169, "uuid": "b3280ec4-922d-4bfe-bf84-bd8c410f5afb", "comment": "Malware payload (Heodo)", "value": "add26d6b66f5ba4989c8556af0aa14e769c6d98e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076169, "uuid": "3067d2b2-d9cb-4a8b-bcdb-46bf07e79d5e", "comment": "Malware payload (Heodo)", "value": "d7c7c54ad44f6335a6d9771cbac9769ed4f4bda2101c07071b36e2f0b7ec2303347f7a42553742990bf39a0d01e026b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076169, "uuid": "eb7f447f-b573-47e8-b5c4-ab7d37e17d7e", "value": "T1A825AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076169, "uuid": "81ce0f72-0d92-408e-b3f0-3cf38d3358a2", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076169, "uuid": "fcf17d09-b4c9-44b4-9664-8d5e11010492", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxlfFIIm2m42:1ZsYB7vLsnZI1Hb9DMFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076169, "uuid": "04458cc9-1513-488b-b9d1-5ab0318b561c", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076169, "uuid": "8e4cda61-0976-4979-928b-0e728ad27c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076169, "uuid": "af4bb714-2bbe-4fe6-a53a-7259e06f32d7", "value": "8cccaf130619212617cde264e28c68d36d0a93dd4f9eb358f7ed5e93772ac256.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3507786a-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644076170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076170, "uuid": "7b6a86ab-9b9a-4044-b8a9-5e28e48fde12", "comment": "Malware payload (Heodo)", "value": "d4b80abc2c52307b91de637c3acab1c7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076170, "uuid": "ce194034-aea9-41e2-8264-52683d23cce9", "comment": "Malware payload (Heodo)", "value": "8d63228bab6765b3ae9003376d1cc7e2095d326d2ddc726a82d705c9fb3c594c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076170, "uuid": "7a059639-5a82-4782-a118-b493e7e0edbd", "comment": "Malware payload (Heodo)", "value": "984b3ffa3620426eb4cabc77045cbf5dc271be65", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076170, "uuid": "2ec3d5dc-5305-42b4-91db-b688878e2996", "comment": "Malware payload (Heodo)", "value": "af719a84b33ddbe621c1a980f4ea72139ff7a633b7322a88b1b3db191575aff2c8e5e72bf7a751115901fe1758dfbb6a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076170, "uuid": "31fe7ed2-0318-460d-bd03-3c851f8d94a6", "value": "T12D25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076170, "uuid": "65f3efcd-69ad-4a60-89f5-7471f8b6b28c", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076170, "uuid": "ca66b6f9-4db3-417a-aef1-dcc716089437", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxdfFIIm2m42:1ZsYB7vLsnZI1Hb9DAFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076170, "uuid": "194fbfb9-d2e9-4988-9c0e-3034a4288ac9", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076170, "uuid": "f04a162e-eb64-46f3-a841-8fc07f96aa6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076170, "uuid": "a2740e36-1bc9-4994-96df-71fd46be438b", "value": "8d63228bab6765b3ae9003376d1cc7e2095d326d2ddc726a82d705c9fb3c594c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74759b37-868f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644071123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071123, "uuid": "5470034d-e8f1-463f-b00f-a7b6ad01117b", "comment": "Malware payload (SnakeKeylogger)", "value": "2dda4e40d7a205ea5e87ef6275565ec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071123, "uuid": "b06d7613-afd1-4368-957f-4d9756e3e25e", "comment": "Malware payload (SnakeKeylogger)", "value": "8d6920c5387f81c49b2c4bd72aa811e699beb98718b0c176949797a0fc12ff08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071123, "uuid": "58e28f32-79f6-4ebc-8652-577d30c331e1", "comment": "Malware payload (SnakeKeylogger)", "value": "472bc745e744882356376020268d07d55b432843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071123, "uuid": "a20e4049-02a2-4ac0-9081-586ee6350701", "comment": "Malware payload (SnakeKeylogger)", "value": "6a8956def7f6c309ff83f985045a1b28f9daa8d5aafcd8ed90182200eb66bf03155fc4bc728452a41487988471bf681f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071123, "uuid": "50b47b04-e0ee-41f7-9746-e9c113ca7bca", "value": "T19DA49DB4A1E78591F10BC974257CF96501B231E3E9C50D3927397641CFAEFA93E84A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071123, "uuid": "d647537b-3dcb-4015-b88f-b80760c9d715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071123, "uuid": "ea621968-eeff-4ed2-8df1-5aa8c1f1180a", "value": "6144:gd79NVO7JpyTaI3pvXX5WnFMbXJldRYiLO3tIHFPCM+H6jc9G3nEJ7zeaCN6U3pv:gdPVO7JO3pBSziLI+B4ie7iPP3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644071123, "uuid": "10fcad16-c1ad-4015-8360-c7ee30bb1033", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644071123, "uuid": "2d6d50ee-27a9-45d3-be2d-7ea3fdd684d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071123, "uuid": "0579a00f-c7db-47f3-a281-a070de217df3", "value": "2dda4e40d7a205ea5e87ef6275565ec4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f68e2b-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019722, "uuid": "35f760e8-ecd6-49d1-9610-e5eb95b1d319", "comment": "Malware payload (Heodo)", "value": "270eb3dcca1182665773503bee3c9dee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019722, "uuid": "584a4426-9176-4f11-84e9-88d59d902c26", "comment": "Malware payload (Heodo)", "value": "8d7efadd92a1fd2cba160d065b26e8004bab60e5e169d72b8deeb4376169e230", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019722, "uuid": "1381c76f-07c4-4238-becd-cd25bb9c812a", "comment": "Malware payload (Heodo)", "value": "0581a1f5ec196cea0ec8b39fabe39d47f465182e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019722, "uuid": "83386098-cf49-4741-87b9-c368fa95bcec", "comment": "Malware payload (Heodo)", "value": "7729d83e2c314d15d6ad9335f2e170fdd032fea9a4e43692b13e1d1f152f900ec96f6f4f1d9e05a85efa3cd8d6bacacc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019722, "uuid": "cb85232a-c343-4966-ba75-4de3c48deb52", "value": "T19125AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019722, "uuid": "41d41a71-a4cc-418c-9e02-25c8aa573d4f", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019722, "uuid": "e5268234-4636-4b2d-82b9-a7cdaa190101", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxAfFIIm2m42:1ZsYB7vLsnZI1Hb9DrFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019722, "uuid": "13341c5a-d4d9-499f-8d22-6055781b1a57", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019722, "uuid": "4eb3a478-ff8f-47d9-9d5b-0602e045e829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019722, "uuid": "1b9d92a5-de8e-4f5f-9702-5be33ec71ed0", "value": "emotet_exe_e4_8d7efadd92a1fd2cba160d065b26e8004bab60e5e169d72b8deeb4376169e230_2022-02-05__000836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197d5479-863b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644034893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034893, "uuid": "e8d3765c-1dba-4fbf-a843-25f6874aacbd", "comment": "Malware payload", "value": "103511dae55300a335da0d8cc3771e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034893, "uuid": "7331e4ee-13b0-48a8-9d35-6332201663e4", "comment": "Malware payload", "value": "8db7d9ad3159cdff19eb0929c2186104546713dcf68235ce9d37b86cdbc257e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034893, "uuid": "4c47a55b-44d8-4316-a5e3-a764638a2705", "comment": "Malware payload", "value": "bb15acfeee568ebbdc67bf8c000e6adf6d4e3642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644034893, "uuid": "d365d1bb-366d-4249-8a69-b53a5d548df7", "comment": "Malware payload", "value": "9b714ed8202756a61fb25fac1806399489c7e4c1b60eb413bf96485f86b386840fb2a0617a7bbd06d0a8b9908e2c053c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034893, "uuid": "cf617476-dc3d-420f-b3c8-4970f775b260", "value": "T195A3BF32164A61B0F2BBBAF01250E1ED2B7E2AD35A971F1D7D953B4106E7CC82F31462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034893, "uuid": "ce969a65-5e34-4fae-a8ad-b0c122b01b28", "value": "1536:+Xzpa+4h+MXeUfqEskQ837ho05fphcohmrCBwCqHbh4Rf0MAVjCJDfvM:6zMA0fq2Q8La2hhhbZksfx0jSnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644034893, "uuid": "9776b7a3-3041-41b0-b70a-4bbb5536242a", "value": 98305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644034893, "uuid": "24e43d75-cf2a-4768-8590-a372456f40a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644034893, "uuid": "79f7cc49-ce63-437a-9f4f-c3fbf390ee9f", "value": "ass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927025d6-869d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644077186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077186, "uuid": "54bd8331-3122-4cae-a2f0-5d3f5e9e3f59", "comment": "Malware payload", "value": "dfac41a1767882f1bec3664a5bd29f2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077186, "uuid": "f7b84b58-e858-459a-bfe5-cf75d7c14a78", "comment": "Malware payload", "value": "8dd0db265da1807eb1564337219862278e347d5aac40ac2d9bc1e6c22241f713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077186, "uuid": "dba328cf-4f14-4ff3-b29b-0256cbc04de1", "comment": "Malware payload", "value": "7416c679e32369a57737e811961387c64bc9e8e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077186, "uuid": "000ee8ca-0743-4ed7-8e5e-e76bcbd8022a", "comment": "Malware payload", "value": "08d5f8804c7c8f84f0038adae852a33da3f13c37d521100ab22a226a9aeae83fa424a12bb2ca9a2a61dc9d135ce8a9f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077186, "uuid": "fd069d30-37bc-4b38-9e6a-7537bf45c681", "value": "T127463387085CB7F3C16D0A74E6B71F11C1ED18026339AAD83A9C645B9CC85AF57D4A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077186, "uuid": "c578b8cb-94ec-4de2-8eff-9fe8909ae88e", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077186, "uuid": "1ba3e873-053e-4bb9-addb-bf033006f95e", "value": "98304:Z3cR+IVYt7INr+NM0VlDaP7BWKoGp2F4pd69FMSqE+6QxNOProGOUZdgiAc4U:sXmt7I5+Nhl2ToKjEmd6zMSc6WOcmZ+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644077186, "uuid": "04cc9e22-7ed8-43ef-b153-d25471ace393", "value": 5863363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644077186, "uuid": "d3f63353-2b95-4b3c-bab3-67c9e99ad322", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077186, "uuid": "226a665b-0427-4c80-aa55-9eca06bb870f", "value": "dfac41a1767882f1bec3664a5bd29f2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32eb7773-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644076167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076167, "uuid": "cfaa0098-2783-4e95-8f66-5ade5473ff11", "comment": "Malware payload (RedLineStealer)", "value": "2b6f6b38ea91c530c9cc18e4fcdc8356", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076167, "uuid": "0c5f593f-c961-4444-91b1-00f5c2b2e990", "comment": "Malware payload (RedLineStealer)", "value": "8f24ab6099e8b87822d26c4fab9e6d6f308dcaf2d486e6e51cad747a2fbd75c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076167, "uuid": "3794b2ec-4789-4441-ab33-36be2f7c3246", "comment": "Malware payload (RedLineStealer)", "value": "23f3da23bcbec0ba7e206e89b2fa00bd6fbc1359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076167, "uuid": "966232aa-cbc4-4a34-9a6c-25ba8a7046cb", "comment": "Malware payload (RedLineStealer)", "value": "f400287c6f20dfb32e8af9d4e2d4dbf0385d4cc00954aeeeb169249c2868f6982ea7f784368cc715eadbdbafc5372b7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076167, "uuid": "ed2e98e0-4a37-481a-820d-3f7653aa4ca0", "value": "T13435E8DD51C59849CDEE27F01DFBA88CAD7094DA938773EAA32C95F0AB423C2654D4E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076167, "uuid": "e211ca31-4a16-4c69-8847-98105e30e7bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076167, "uuid": "7eb2a14b-fb27-40fc-bc2f-395222496f5b", "value": "12288:ceu/oxV0MVPC52fjFiFnzQfiRTXXYRXnjByushCxZ9jgp4zz:c/gY2fsnzKRqM5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076167, "uuid": "fa529b86-d06a-4432-99b8-90d0d3a2674d", "value": 1060104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076167, "uuid": "984c1a70-dd01-4de9-beb6-a269e25bf60e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076167, "uuid": "7b51fb0e-a6db-4ea8-93ad-219c467a9c9d", "value": "2b6f6b38ea91c530c9cc18e4fcdc8356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5653f25a-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075367, "uuid": "95266724-1e6b-49f5-a7b8-4129aba37038", "comment": "Malware payload (Heodo)", "value": "ca61a01cbcf5642bf6f5a34be867c4cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075367, "uuid": "4bd63498-a8ab-407f-aff6-6c0787d57136", "comment": "Malware payload (Heodo)", "value": "8fd689b94b8e134052be1b2fa5222c40c72bba3295cffbe6bb1d2f4cc6cc662e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075367, "uuid": "6c41caa2-a799-4be0-95c0-ed897406137d", "comment": "Malware payload (Heodo)", "value": "14fb70792ff73a0c8c749beb4b52820c600d9ef7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075367, "uuid": "3c267134-6c6b-4650-a5e8-180730da047a", "comment": "Malware payload (Heodo)", "value": "8d9cfb43711658362c3c0cb93af04baea3f81a86cc31511ad82d5a96cad53740138c81bd2e77600bd399392580ff06e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075367, "uuid": "62fb05d4-7c4a-4d4e-b036-8b31ca1de2cb", "value": "T1D964E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075367, "uuid": "f7327400-4a5d-46b0-9b73-6be1b69ca726", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075367, "uuid": "dcc82628-f177-44ff-8348-9e85a208135f", "value": "6144:83DvZRFTFbksYyljaMYDMfT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYWLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075367, "uuid": "3760c6d4-447e-47dd-b376-3f75ee722329", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075367, "uuid": "8c3c11da-90cf-4f06-a761-5c228d884b3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075367, "uuid": "aaeba54d-f0fd-43bb-9d61-1b5f5e1cc043", "value": "8fd689b94b8e134052be1b2fa5222c40c72bba3295cffbe6bb1d2f4cc6cc662e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6995f0-869d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644077151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077151, "uuid": "87fe7b24-1e0a-47a1-9a89-ef3bad626ecf", "comment": "Malware payload", "value": "c860f669e98fe7c4a9d8a459225dfb91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077151, "uuid": "6562d854-e1f0-40b8-b02f-4605226dc43a", "comment": "Malware payload", "value": "911860ba2f0c1d6b668bc865e77cdd09ef29682fa0ea39846b0affef39fa9e61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077151, "uuid": "9399fcfe-9a80-4dc2-b266-02c5626721f3", "comment": "Malware payload", "value": "f107198d493a52ccd57c1c1f8d5d8cd399460934", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077151, "uuid": "32758958-ba58-47a6-81e7-eacec9115081", "comment": "Malware payload", "value": "a5781cd7224b591cac7fa3000a1dd5bf64a80b7b2a908ccd3625833843114df40567f40c89814eccd21900dc49d08a75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077151, "uuid": "fbe194c7-de92-4e4a-bd9e-6f34c7e69341", "value": "T158F53379CFC6CCE7DB9D8D71B696208366A257CC22BE0A777A85BEC4760B4100D409DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077151, "uuid": "70553335-7844-4ac8-acb1-d73470d28740", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077151, "uuid": "f576b4ac-e78f-4088-b35a-b2a009bcf40a", "value": "98304:u8IidfJ7Gzi3WzUmUBaAYuHhUqiadOR5fyW1R:u7i95GzDUMAFHhViH1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644077151, "uuid": "b0499fc2-0961-4144-a819-119a56ae15ff", "value": 3346529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644077151, "uuid": "59a0458e-5d0e-4473-adc2-164586c9a3f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077151, "uuid": "5b936341-0b44-4e8d-9e5b-167a04c20d40", "value": "c860f669e98fe7c4a9d8a459225dfb91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdc8450-86d2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644100126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644100126, "uuid": "b2a71825-015e-4a23-8e5d-aca279735ec8", "comment": "Malware payload", "value": "bf586b1543e5f8131217069d520a1381", "object_relation": "md5", "Tag": [ { "name": "DOS", "colour": "#9D21AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644100126, "uuid": "37f7eba6-16ad-4c6c-9532-6f22ba349d9e", "comment": "Malware payload", "value": "91fa185f353b790b4dfb3b468503244e4c84be8c43959b32d6821d764d5d0c41", "object_relation": "sha256", "Tag": [ { "name": "DOS", "colour": "#9D21AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644100126, "uuid": "4a3a0cc3-e5db-47ef-b1d3-31a27c6984b6", "comment": "Malware payload", "value": "694ee33166437a664ceb1e442b382fdc24d91392", "object_relation": "sha1", "Tag": [ { "name": "DOS", "colour": "#9D21AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644100126, "uuid": "16ec2e07-1422-4a8e-8685-f65a43db2b09", "comment": "Malware payload", "value": "edb322574de98a90b82e0278c27ae0a842b43463b8d0183bb7d3872d4fda0af0c8812fe2fa1727252b909ace96126955", "object_relation": "sha3-384", "Tag": [ { "name": "DOS", "colour": "#9D21AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644100126, "uuid": "5d9658dd-c520-41ea-bf6e-a021b66914f4", "value": "T125A14A503FBDC75CE42FC931B13A3584A89EDCF06A16422B652E3E740E70759C653B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644100126, "uuid": "54ab4c42-7305-4911-abfe-1cf78f59971e", "value": "96:3OR0/WwLwKKy8HXNRRATDB6zhDKW5H+GbYauD:w033m9Oaz5HjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644100126, "uuid": "313822e6-fa93-491b-a88d-f53a7a614087", "value": 4946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644100126, "uuid": "f0884871-7e13-4b18-aadb-b78563ca6bc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644100126, "uuid": "92eeb3c1-39dc-46bb-a260-55ff085013df", "value": "YESMILE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761ecfee-868f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644071126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071126, "uuid": "be8add91-7421-425c-99dc-9433a6ac65bf", "comment": "Malware payload (SnakeKeylogger)", "value": "f1f17a2f3c90e1ec6af1cf8b51d229a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071126, "uuid": "f1b560e0-e9a2-43fd-bfff-a2d75fd302db", "comment": "Malware payload (SnakeKeylogger)", "value": "929a436f251f5a7942ab526194be24fe00433c8548b345933af643aadeed42d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071126, "uuid": "0367ce53-fbb4-4542-ba6d-4d1801a46edc", "comment": "Malware payload (SnakeKeylogger)", "value": "a09b68ff7a3e701cd9d36f7b94c4771c3d46196b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071126, "uuid": "5737487f-1590-4ccc-ba0f-6e3f5fef7174", "comment": "Malware payload (SnakeKeylogger)", "value": "a2c2a1ee252189b051a1fab8c2fe3fbf7e24ea861126f8a1f834da5cf112e71fd6574e8a7e9cd7dc64d806f27d85d39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071126, "uuid": "3ad095f9-5725-44f3-b136-eb8aabadf4c1", "value": "T1AFE46BBD726072EFC86BC4728B681E68AF5075BB930B9217A01725AD994C9D7CF110F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071126, "uuid": "1548f36e-c9a3-46ac-8ca9-3af4fdef28d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071126, "uuid": "8622e1f9-c122-4f4a-9cb4-20bfc4304998", "value": "12288:xuUmOCxYP9wmdCEwYOpedLo1mGc3aw5vdnf1tJX1Gd5MLwH9RbWK6RdzRs5HKuja:QiCmPHwYkeFOcN3ejAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644071126, "uuid": "a21a1a0f-5fcc-43ee-8d4c-8c56e6b8b194", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644071126, "uuid": "aab0be85-e55e-4c93-b9a7-d4b85cd5a9c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071126, "uuid": "9901848e-b8a3-4420-b06d-5b1dd39db2a1", "value": "f1f17a2f3c90e1ec6af1cf8b51d229a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6622866-8654-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644045866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644045866, "uuid": "84232e4e-5a56-4ab8-a74d-41baca825fb5", "comment": "Malware payload (Heodo)", "value": "6f9221ad20cdfd5464c47ad8b919bca7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644045866, "uuid": "4b109520-900e-4f25-98da-ebd95a310575", "comment": "Malware payload (Heodo)", "value": "945dd612912a66da5dc96ebe5ceeb6bfc3782522271c83bd0307d2495d2da3a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644045866, "uuid": "fd766261-38ed-4d03-b847-77252380fd5c", "comment": "Malware payload (Heodo)", "value": "b3136bba26494e591a00341d8c191e31a02fcfe6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644045866, "uuid": "74767513-f02d-46c0-8954-758797883733", "comment": "Malware payload (Heodo)", "value": "f9c5ca5caa64312fe86ca5f278adf270cab0e3ccf6d3cdba8a286c0c97faaf9566e7260b14cb8048c44a02835a3e4772", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644045866, "uuid": "693a1550-cfc0-4728-96aa-f1beca64bc64", "value": "T14A745C3CB2A0A835C37A34F175F9D2B7859FA9520B29469BE7FC412B1E3D5814E3850B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644045866, "uuid": "98974398-d7ba-4a7b-9074-c586d1241ed7", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644045866, "uuid": "37ff54be-d0b6-40e1-8e64-27332de6d7bf", "value": "6144:iM0iqqqq2ICu/71T3lfb3/XeGpUxmdFwkFIPbKq1r23qJkMQql/F:G5Yfb6SGkFIPbKq1r26JQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644045866, "uuid": "222c2878-aa37-49fc-90ea-2b8f8857e329", "value": 362913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644045866, "uuid": "3f1315ed-4d72-41b2-b943-41a2aada74c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644045866, "uuid": "5a3822f6-b518-4ee8-b259-2edb35385b3d", "value": "emotet_exe_e5_945dd612912a66da5dc96ebe5ceeb6bfc3782522271c83bd0307d2495d2da3a9_2022-02-05__072420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26241c3a-86d2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644099768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644099768, "uuid": "5b7e370f-0d0f-405b-8d34-7a1b39087680", "comment": "Malware payload", "value": "c9f43a11f078ccef960a5334cf26d7f6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644099768, "uuid": "d6d2cd5c-3bb8-44cd-9ca1-d38a6378d851", "comment": "Malware payload", "value": "94c9fbe9638e12443804a5a93db7bb60f7d7f25bafb17a55f313bae063e5236a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644099768, "uuid": "30101e68-8288-486e-b628-58322e728d0c", "comment": "Malware payload", "value": "5d90df6d3c9a321d74be613563d2719d49cbfecd", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644099768, "uuid": "b84b04ae-ddb2-4136-b095-55f51f15f5cb", "comment": "Malware payload", "value": "f72ec1a97163773bbf08c8306c7fb4c0ba41cbfa2acb5110b4bad79ae4a157e2dd9a7660dd8411b4aead78e992d5deee", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644099768, "uuid": "182df98a-6a96-4d8a-97fa-adca2e9d3ddd", "value": "T18C51568CFD27D64125C3268214A6D05CDFF76BD70C028F6CBB6CDA092B75D2C9A864D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644099768, "uuid": "e96d9373-0908-484a-832a-923f1eebce12", "value": "48:eKNM8vQh+faRkpOk+oxsNJGI4cFeDbVOwIGGBl2dB4X1Kr4eXBMXBKXB2vMVCR:ehUQoZHxs3GI9FeDbGhBqBcKrnBKBkBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644099768, "uuid": "e33d5346-1724-4aac-b8a5-fb71438abf6a", "value": 2892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644099768, "uuid": "2cb88d1a-32df-4a7a-8d97-5eb5d7c80c20", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644099768, "uuid": "7f8b851c-7342-4657-8622-3040f2ddbbb8", "value": "carnival.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0980fac9-86b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088553, "uuid": "e8be77ad-c995-4f02-94f2-51ae080ebd16", "comment": "Malware payload", "value": "b4a5df075e6d5278036e07be004b3e09", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088553, "uuid": "a52f6c1b-30a0-4cc5-aa3d-3421dba569d0", "comment": "Malware payload", "value": "94e087e8c174bb8cdcf850fa44703fd219485d4c2b879e86fbac0fcf358fa7d9", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088553, "uuid": "dabafe1c-76f1-4d52-af03-e34e59dce010", "comment": "Malware payload", "value": "e757ae3f2a165cdb1861c8c8743bd0f76c28d606", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088553, "uuid": "711104bf-6367-4076-8ac5-8cd9fb330ef6", "comment": "Malware payload", "value": "dbf1374a754f6eeb19eca0010e85f6a1b49f59a945e502932f14ed92f951af06d476f6ee64670e84609074452125d586", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088553, "uuid": "315d26e6-8134-4aef-8b76-a73a92ae99ad", "value": "T1CDD10F167E55F6AF102330933AD2E81DDB3486E7F8549EDC205CCCE64B612EC9EA0D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088553, "uuid": "0fda5b4a-d2c1-4c0f-b2d5-45481c4e3946", "value": "96:KjApnCTjT0ESSvzhuA5vh2Z8y09jP969l9N959hKAA+CQgULeDPvFcJQZ0dJlflQ:KxTjThDllcUJ+LTXhX7LmPh4tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088553, "uuid": "8a97556e-2d2e-4a5a-8112-3ca2eca71b04", "value": 6557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088553, "uuid": "6d381d8d-5662-4744-9a93-bd0836da399a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088553, "uuid": "6f321d00-0d58-492d-bc0f-8fc447c90029", "value": "ShowVar.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5717b653-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075369, "uuid": "a2aedd31-52e9-4dba-93ad-ebcc34269568", "comment": "Malware payload (Heodo)", "value": "9a9c03301cea4849ec386e0032ef1c9a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075369, "uuid": "575ca350-862e-409e-80c3-f373154cdf33", "comment": "Malware payload (Heodo)", "value": "9689e80d0c1d706f44816ddbfa3931651c14fce3ae3bfc3afd9739570aa5fd6c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075369, "uuid": "b2e3d1ff-2cc4-45a2-ab56-413df015b479", "comment": "Malware payload (Heodo)", "value": "a1c1d3c52b52d6b7ab6aabe923b0045c837e3c2f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075369, "uuid": "79b0f1bf-f233-4f4b-8cf6-264b45717e2e", "comment": "Malware payload (Heodo)", "value": "97211f8f7198839b9e43ac4682e13d42a622e0799ca8d678884caa9ccdd44a0d420de5ce818ad5dc41cd21cde5e1beab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075369, "uuid": "80f25610-6587-4778-9549-bc1dd3006834", "value": "T1F335AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075369, "uuid": "7dfa49fa-0b2e-43cc-bbd3-16eb68a2f3ac", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075369, "uuid": "4b053c7c-3089-4148-9571-e956d6ad4e49", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTvFIIm2m40:wfv1GVFF+765nFvFf6dlzzSbFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075369, "uuid": "10fa35bd-1940-4466-910f-4f8489c9aef5", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075369, "uuid": "f2868f88-d12d-4ac5-8ba0-7ce5492f13da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075369, "uuid": "5581b820-4dbc-4da7-b712-33fc777fbbb1", "value": "9689e80d0c1d706f44816ddbfa3931651c14fce3ae3bfc3afd9739570aa5fd6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ee66fb-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086960, "uuid": "e5efc775-c70d-4c4f-b41f-513fa21b9614", "comment": "Malware payload", "value": "87e2b361908ac17e03ae947c75a140a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086960, "uuid": "f9a3055e-27e4-4e82-9eec-ef0ecc41a490", "comment": "Malware payload", "value": "97bbc5d487334b3ea4598455f1621ec23b32fd71684e70977b689d5a8009aafe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086960, "uuid": "910fbaad-8f3b-43f8-bc41-a8ba8f81a089", "comment": "Malware payload", "value": "f038e389ea778594125222e97d82a0a2c1404986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086960, "uuid": "1f16a51d-649a-4bfe-9590-0923fb512c46", "comment": "Malware payload", "value": "e6ab4ddfcfa521c40449a5dfcfdae2e372008754a9e7bb39936868ac4eb5cced882ac92e6dd1786f17147740de8f9014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086960, "uuid": "03bd8d7a-23c1-4ca0-95b2-f7c1f8e0ee41", "value": "T1D0C13CDBB6586BC3D38B61FB4182A13A357D323005A743882E66361FB9A6189153CF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086960, "uuid": "a4b39e84-53ca-46b1-91bc-c03f97e37709", "value": "4150e80bcbc60b44330e2ef8b89b153d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086960, "uuid": "f494bcd9-3997-4c98-87d2-796480fa7431", "value": "48:OEPeDqDTOPgq373zmkAa2YaRZlkqxIq2Hk0sdofzfEceqSeJY8JTaBUBm:nP0qDTMHzcPhqk0sdoSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086960, "uuid": "83fdf3ee-bebd-4e34-b92a-d05ac7001e66", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086960, "uuid": "84eb3446-a1a0-46b3-8167-94e85c2d33c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086960, "uuid": "76b75510-f6fe-4e96-b074-78d513eb2509", "value": "Casper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b268894-86b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087294, "uuid": "3ca5a086-6a5b-4477-98a9-8a120e41f0aa", "comment": "Malware payload", "value": "2aae09e21d35fd56f7aa0f603dcb6151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087294, "uuid": "f7b02483-1a7e-465e-a6c0-24d583ff3eab", "comment": "Malware payload", "value": "98597febbe021822edce7b34303cd6ebf890e70e45cd85cffdbc36478facc932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087294, "uuid": "9f2c7a2e-6905-4d8f-bae8-f48bf6e5f4b1", "comment": "Malware payload", "value": "4fbe3b2758bdb50ea45bb4593f074239c30bdd5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087294, "uuid": "e7473565-9ab5-466a-a0ac-c201dc371190", "comment": "Malware payload", "value": "b1010d668b758cb828f7d790afe11f775581a112a33dbcaeaf04754e08bee1d6d67d084b0e98782ed3d53ed4702ea8f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087294, "uuid": "64a3c800-af34-4935-a220-bf9ff7d1f386", "value": "T10DE1D98B7B14D8A1E65083B054964B21FF326C602A618B045FADB007AC723E5FE2C75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087294, "uuid": "0af2b56a-8af2-41c2-913f-8b1a68abb0ad", "value": "43159a695ba6463209809a4951ca7464", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087294, "uuid": "73fc6974-7a9f-47cb-8777-aeea533bf76d", "value": "96:nP/DHIxgjNFFlkSbuBtuElE5PphcnB0SSU:nHDHIuElWphcFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087294, "uuid": "77e57d47-15cd-4b7d-92bd-4f0900006cef", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087294, "uuid": "a45df7e7-80af-4503-9ea1-4d9ef57f8b0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087294, "uuid": "d447ad3d-bff5-4fed-98ae-40ccbbc13b54", "value": "Mustard.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610c181b-861a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644020839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020839, "uuid": "1a0ebf8f-8590-4693-a81c-8528ac763da4", "comment": "Malware payload (Heodo)", "value": "476bf2bf9c357c742961f5b472c0c944", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020839, "uuid": "2eea9134-e6f3-4f15-b5b7-be101d077279", "comment": "Malware payload (Heodo)", "value": "987062340259dca99faf87c71e57811feba861cb071f0ad5bcedfb6be982832d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020839, "uuid": "562fc8d4-6ed6-444b-8b90-8a73e99dd4b9", "comment": "Malware payload (Heodo)", "value": "19d5addb1a15563b8bfdbcd3d1b49df0b26c838f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020839, "uuid": "f6acc87d-b3ad-426e-ae46-6e880068a1bd", "comment": "Malware payload (Heodo)", "value": "0f6c3da441c917dfd80a3c7fee0294c266ec53f07511ad1fa0b9e832513b72001c4c20f30ee851f94e87f11af1f6d136", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020839, "uuid": "4338c3da-b43e-416c-adb6-9b74c72d3eda", "value": "T194B3022527282DA2E130673DAC8DD5B3342C1671D1849472B647ABDED270E670CFA6EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020839, "uuid": "3b428b09-1121-4d7b-929b-f250cc1b29c9", "value": "3072:FMamihghD0t/4LcRtaXR3KUtE4sYzOXPWa:FManghoyL8e3KU5skOXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644020839, "uuid": "d0654a73-ce23-48c0-8610-696dcd303f76", "value": 117867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644020839, "uuid": "d39a4bf9-012f-44d5-aace-eafe5f21d9b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020839, "uuid": "90fb6c0c-a0f9-40d9-9c51-4b61b2306179", "value": "7759 05022022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69a3b59-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "d5383726-c117-403c-ace9-d4e1e7e7e608", "comment": "Malware payload (Heodo)", "value": "b7efccf0018db62c7951b42195fd7308", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "c1a060eb-2334-425e-8aa1-3342c51d8f7b", "comment": "Malware payload (Heodo)", "value": "9901196b6053a86ce3615b8853ad14e7dd168ac549e0b50f7d259dd34cc0d421", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "dc871830-601c-4056-831d-87fbb89c6eef", "comment": "Malware payload (Heodo)", "value": "7e1837daad34512ee6bf89c1c5c37bcb1b77f572", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "bc4f4ac7-3d94-48f9-88be-a4db2f05f21d", "comment": "Malware payload (Heodo)", "value": "e536197b534e75d4775991b810b16c675ea47ae0e9da4dc5d4f82c94fbd8b6abf36c16f02aea49be2990bed54058d86c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "cba05912-8556-4082-bf64-8d61163c3119", "value": "T19325AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "f3a573aa-9dd3-4d11-8693-aa7b987335a3", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "a60ae88f-c984-463a-b930-44b5b5a8a502", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxZfFIIm2m42:1ZsYB7vLsnZI1Hb9DUFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019721, "uuid": "739d0ef2-9d6d-4d7f-97ce-f8720fac5770", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019721, "uuid": "0e574f4e-77b3-4480-a974-f6b5fe292b3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "0a98361d-0184-409f-83ef-050595cfe46a", "value": "emotet_exe_e4_9901196b6053a86ce3615b8853ad14e7dd168ac549e0b50f7d259dd34cc0d421_2022-02-05__000834.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4bde6a-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "c2d1eea6-4036-459e-a0d8-4b52f47a9f06", "comment": "Malware payload (Heodo)", "value": "59b2a04a884fda201e6448e9b3510efb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "253d1a26-7d85-468a-aeac-a3628769e25d", "comment": "Malware payload (Heodo)", "value": "9910519903b1a16def1c063df71d3302ffef4cd42970c8e51d4f1923457d9204", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "e798e4d1-9c82-459d-9357-87eaa81172f1", "comment": "Malware payload (Heodo)", "value": "ad413a82ed20cba42d60a33d31d200a15c94706f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "163904cd-932d-4ab4-82fb-5510f1e7b4f7", "comment": "Malware payload (Heodo)", "value": "f68d5c81f052178068609b7ef17c09bcacc2d6429a3b96f7175e40f381fb77a396f888f1d58ee60bb03922ba7919b58d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "4e042709-12da-4955-a199-2615e52c1f6e", "value": "T14535AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "44862002-0ec2-4044-9f44-010b3c5769fa", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "5974946f-0825-4f6b-af44-fc14a1f7c28c", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTJFIIm2m40:wfv1GVFF+765nFvFf6dlzzSNFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019867, "uuid": "46eea3fa-e50f-4cd1-8b86-6f6c52d645b8", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019867, "uuid": "8eea0170-e957-4a31-b7b1-1e965cf89f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "0dd57624-664c-43c3-8cfd-fecb50d816c8", "value": "emotet_exe_e5_9910519903b1a16def1c063df71d3302ffef4cd42970c8e51d4f1923457d9204_2022-02-05__001058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3494a3-8687-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644067866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644067866, "uuid": "73d86f03-43cd-4c54-bf9f-3cc83c5aa235", "comment": "Malware payload (RedLineStealer)", "value": "0ddd9b8a40f2cffbbdaffd79cf964e20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644067866, "uuid": "1091b234-f1da-491b-9012-13ed59334be9", "comment": "Malware payload (RedLineStealer)", "value": "99306ce091ffc74939ea41621dd8e947086f6728083a2ff24aa02e3ae91905bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644067866, "uuid": "602e6b69-51b2-4da4-8264-03eb581ff5a2", "comment": "Malware payload (RedLineStealer)", "value": "5bbcbc09cf0a108f85a89d67381d01e752471870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644067866, "uuid": "b66128f7-e39f-4a5d-9f90-84915ec40198", "comment": "Malware payload (RedLineStealer)", "value": "243aedc332e0265a23900400feeb9ff7764f153f1e178685fd41a1067b7b2a0e80d150707767ce23e526abe092f5917c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644067866, "uuid": "05ebbc48-0ead-42f8-9fd6-d961575ef7fb", "value": "T174B4943839FB5029F1B3EF75DAD475979BAEB6633707E84D209003864A03B42DD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644067866, "uuid": "b7425213-396b-478c-997c-1d54e7c6d3f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644067866, "uuid": "e94b1a83-8a44-46f6-9e4d-069e36129a73", "value": "12288:2Vr5yAGUWPc+MD5mLi7WRTxMhZe4dNy9Oh:2VXGZpEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644067866, "uuid": "f6376157-d574-4be9-a773-35db0c17ed6d", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644067866, "uuid": "c417c89e-21a5-4d1e-9e60-f90f4df7ec1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644067866, "uuid": "d82ac485-8fae-443c-9910-1242d942bc8b", "value": "99306ce091ffc74939ea41621dd8e947086f6728083a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58463c68-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075371, "uuid": "67a29d37-bf01-41c2-a017-c2db14e23915", "comment": "Malware payload (Heodo)", "value": "e6dfd637910d4c5a24f94ff561562089", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075371, "uuid": "c791fb12-1547-4a15-a4a3-08d0cb4c84f7", "comment": "Malware payload (Heodo)", "value": "9a02a9eb4b6dc42e0c16dbbd517d3e6920089e2893bb4ca9eee42065f4d58ecb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075371, "uuid": "0a7e82bc-2a4a-4fdf-b6f2-f477ad7ef621", "comment": "Malware payload (Heodo)", "value": "a61a6c9392f76d63c33f7ffee6c16fd53383278e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075371, "uuid": "b3b11263-0284-43fd-bed8-1748cc986c27", "comment": "Malware payload (Heodo)", "value": "a137e182f5d6dd39ae376534fa2bff11c1d1b3f6f49cf2997c5763fde59d641bcdb01c4755321fd74e53ae341cbe572d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075371, "uuid": "4096c0e4-34f0-4bb1-89a0-2fb40b1e819a", "value": "T16025CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075371, "uuid": "4294751b-1178-49e4-9138-12ccdfd098c9", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075371, "uuid": "8581050d-995b-4470-8757-e194150f1f90", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPgFIIm2mHv:exyq2kpWGWRCLWeNWO1tyYFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075371, "uuid": "3ab73fa4-2aec-49e9-959a-320b9467e941", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075371, "uuid": "65bf5e8f-cc7f-4546-b1fa-3fd9b3483c14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075371, "uuid": "4efb6e5e-a7f9-49e9-999d-2b6cf60789c5", "value": "9a02a9eb4b6dc42e0c16dbbd517d3e6920089e2893bb4ca9eee42065f4d58ecb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95f0125-8655-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644046301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644046301, "uuid": "828d64da-a02b-4c37-ac6d-3150b48c5d31", "comment": "Malware payload (Heodo)", "value": "88fb4345a0b8de757b2ea353b2093f03", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644046301, "uuid": "8f806562-cc29-4af3-bdca-955b19983525", "comment": "Malware payload (Heodo)", "value": "9a0d58f95989b9970858e7bde1438bfbf1334292081e2a05db1721b7d37432e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644046301, "uuid": "3a7f6e99-b593-40de-a4ae-abc9384d5829", "comment": "Malware payload (Heodo)", "value": "17cc0d9b0aade0de0d0e67854e0c5188397e0307", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644046301, "uuid": "d295ad39-a003-4a08-8452-cfe0b8c06510", "comment": "Malware payload (Heodo)", "value": "617929cc12b9d9c44825ae371bebce2811343b323e1312912c1b553c4d63c402e73d5e18af7512e811faf27ee320332f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644046301, "uuid": "99d5a9f2-1efd-45af-9221-4ec580c7f4b2", "value": "T1ABB49E3D72A0A435C27A34F535F9A2B785AFBC524B29429BE7FC212B1E3D5414E3460B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644046301, "uuid": "28cdd360-353b-406a-99fd-e80032a22d60", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644046301, "uuid": "b8e3e3b6-e5ff-4683-a253-823aa03c74d5", "value": "12288:G5Yfb6SGkFIPbKq1r26JQ6DraMA0ZaC87X:GK21kFIPT26ZD2MDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644046301, "uuid": "3209b321-1219-4d7d-b292-36d46c134466", "value": 539569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644046301, "uuid": "77f38f30-23a0-40f2-a87c-ed8ec35eb4e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644046301, "uuid": "aa5000ac-6bbb-4186-962a-8b761f0399bf", "value": "emotet_exe_e5_9a0d58f95989b9970858e7bde1438bfbf1334292081e2a05db1721b7d37432e8_2022-02-05__073137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78ae688-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019723, "uuid": "219fdb29-0e8e-4188-b156-f596e629d47b", "comment": "Malware payload (Heodo)", "value": "ebc833bd4409e104ca730c484220f05e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019723, "uuid": "0f85ddf7-4f74-4555-b58e-3a5aac92b035", "comment": "Malware payload (Heodo)", "value": "9a50958cbe63530b7804a98d4cfb421c1387b21e49d503dbe840dd6631d04c95", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019723, "uuid": "4ce20f00-72f0-4bf1-bfcb-64d092187686", "comment": "Malware payload (Heodo)", "value": "8f2eb705b863eaebccf8c0a6478ffed004260153", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019723, "uuid": "d89ac778-b19a-4732-8746-c418ba9c36c2", "comment": "Malware payload (Heodo)", "value": "3b1fd55ac0432e65c691334d0787276d2599b719bc6d5ba462e3318000a65ba02b3b0f651bbb61fbeae9d5aaffac2000", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019723, "uuid": "a88f9a17-61fb-4fd8-be34-a117ade332e1", "value": "T13325AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019723, "uuid": "2d2e1cb0-d0a4-43b8-8b67-a249dbb8bc97", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019723, "uuid": "6dcec9c9-75c0-4b66-ad1a-7efad218b86c", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxtfFIIm2m42:1ZsYB7vLsnZI1Hb9D0FIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019723, "uuid": "536994e9-059b-44d9-86a0-8f7c6a102599", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019723, "uuid": "bc793661-3c6c-4bdf-8e4c-3530a02d5a82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019723, "uuid": "9577ac91-82b1-44ba-9c33-db863eb070da", "value": "emotet_exe_e4_9a50958cbe63530b7804a98d4cfb421c1387b21e49d503dbe840dd6631d04c95_2022-02-05__000836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4a985b-861a-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644020801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020801, "uuid": "b04a62f6-a6ca-4483-a1ad-b7ed7df49cf4", "comment": "Malware payload (DCRat)", "value": "fabb5ff35f5b6823abf1363b94b24f8d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020801, "uuid": "a7d2bf2c-aac1-492e-893b-d3fd92e73f31", "comment": "Malware payload (DCRat)", "value": "9a7ddb432bfba4b1cbb9ce0db2df530e34f54e772aab90003e65eeb55de65108", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020801, "uuid": "60bf8ff6-c8ba-4ebd-adad-564c607338a6", "comment": "Malware payload (DCRat)", "value": "0f7a989f517bf022cc1959d9682da7386d45f159", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644020801, "uuid": "6a092b85-fd0f-49e4-be4f-200a6975d068", "comment": "Malware payload (DCRat)", "value": "b7a1b5a51fdb3a239b70d44f0a6aa6a527a1c0f4133807d847263821904462406204d74a01c509ce4d976b550310874f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020801, "uuid": "bd23be6b-44f0-4e3c-908d-2de46987b33c", "value": "T1091517067A44DE02D46E1737C5EF841543BCAD427A62DB1A7E9F339D26213A70E0E1EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020801, "uuid": "e45d5bd4-a0ac-42eb-9e86-cb7037051225", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020801, "uuid": "7e43ce8d-c5d6-4ba0-aedf-b825c7250a5c", "value": "12288:a9rTtAIASKt+bLbdJpztEpIrtfrdwTEoy9bhY2B:ahq8Kt+bL3pztEpUwTXyxnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644020801, "uuid": "4459400f-7a5a-4ded-b38d-92b8f53b505c", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644020801, "uuid": "98a4666a-a8f3-4d5c-85e3-ac2cc31c519d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644020801, "uuid": "eb5ce49f-3770-41d3-b343-84d8bd3e6bf3", "value": "fabb5ff35f5b6823abf1363b94b24f8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3661854e-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644076173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076173, "uuid": "0b174e2a-a060-46d3-903b-7c2133ab5cad", "comment": "Malware payload (Heodo)", "value": "b96f97dbff3648c01c5c09d7d4d3a326", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076173, "uuid": "c116d9ff-5256-442a-82fe-b633d0ccbbc9", "comment": "Malware payload (Heodo)", "value": "9c3fcbdea727dc1bdae5be6e1ca66d254eeb77092d5674819216587d8983651c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076173, "uuid": "93464316-bbb1-4b73-891a-7f8aba2bd818", "comment": "Malware payload (Heodo)", "value": "a4a3f8a26d12b3b61966219eecdf1a25d2f7bb60", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076173, "uuid": "185abe86-a559-4ace-b183-fa9525dde5fc", "comment": "Malware payload (Heodo)", "value": "306092920034aa11e6b82607a0bf06eea064faf01edcc1d59c7db0e1e5d57123e1c50ec8547133b981466c8e76fd6956", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076173, "uuid": "e7d030bb-2831-4b7e-a151-dca3771cd626", "value": "T1E125AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076173, "uuid": "5b8afa17-5f50-4c18-aa07-ab26fa1e7f73", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076173, "uuid": "28487b83-5004-4701-9e2a-23fddf7cff97", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxifFIIm2m42:1ZsYB7vLsnZI1Hb9DBFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076173, "uuid": "633d85c3-7413-40c1-8562-faceee527d26", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076173, "uuid": "a277a4e4-4e92-4a45-866d-5abf52bdeb6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076173, "uuid": "651581bb-fc2f-4952-a9d4-c7c9a071c0c3", "value": "9c3fcbdea727dc1bdae5be6e1ca66d254eeb77092d5674819216587d8983651c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad1b977-864d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644042921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042921, "uuid": "3fcaecf4-e537-40dc-bcc9-c310f573c818", "comment": "Malware payload", "value": "f447557a49f3335f92e4d8d88b1bc3e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042921, "uuid": "a21a2145-558f-43de-a1e1-d7ee2fbe3b51", "comment": "Malware payload", "value": "9d48a1d3ff1c1a0c5cd05d1cc0f5a3e04e9ae7ae6b2a6ee12a9608b6c7d83d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042921, "uuid": "f7084bfc-a84b-4e7a-aae7-7c2d4e46124d", "comment": "Malware payload", "value": "30863cadae939b7059854217d989d14d57d10cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042921, "uuid": "dff656f7-26fb-440a-a4ff-559de06eb93c", "comment": "Malware payload", "value": "dd4c83614adc9a536363459f0ccf647a54ef6950337ca36bfb41709387c346ae9ec4759e05a1938043831946325ced91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042921, "uuid": "3e043241-6d36-40a8-ac02-5cf9bf256946", "value": "T1F1073346F35104CED476633760B3C1369521A8EA0325519F1AB8F7E75EEB1E2BE39B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042921, "uuid": "4df800d6-fcf8-4743-8a76-1866e560135b", "value": "d170e2e5adcfc4c271f2eb78a565305e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042921, "uuid": "b9219271-4117-4239-8d69-535475517004", "value": "393216:zPJscAqd7mUL3GH6YkkvaCnc9nKhsCq3+d9t7Ab6W8DJpUd6sAXk:NtAqdqOGHfBiCnlhsdOd9t7Ab6W8tGHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644042921, "uuid": "e4cab17e-5a9b-4c29-a3ec-0b300103079c", "value": 17371529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644042921, "uuid": "12914242-9439-4f66-96c7-dbc3920d449b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042921, "uuid": "c222f525-aa62-4d4d-8855-b75a29a33457", "value": "godsdienst_opdracht.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590125be-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075372, "uuid": "e9ed5ded-9d04-4359-853f-57b3e14e65a2", "comment": "Malware payload (Heodo)", "value": "27294624320c2aafab94f3d29764b28a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075372, "uuid": "a8a6b9df-d4a8-40fe-8b69-faf0a7e031b0", "comment": "Malware payload (Heodo)", "value": "9df96f432cbf06b20c3f8ea221db539479dfc1fde7da62bcd5cf0e6686f9ec15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075372, "uuid": "961be2e2-66d9-4db4-953d-79ba9952869e", "comment": "Malware payload (Heodo)", "value": "af4ef0743f6c5282ede2c3854e17f52948494426", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075372, "uuid": "fdb34a5a-0d4d-4c79-814b-ae201c398bd8", "comment": "Malware payload (Heodo)", "value": "f7a8bbe0d5c463130fb79d65dcb0a7a3cb0ac9f876abad44e16c647fef725cc4271b7082b1701641aa676980abc23d4c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075372, "uuid": "56de2ab8-bfe3-4252-ba9e-3a1abc9a7263", "value": "T12335AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075372, "uuid": "11efe2dd-8588-4f57-9f43-827bc7bc0ed5", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075372, "uuid": "8218ac91-a81b-4459-b39e-c0837ede4729", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTCFIIm2m40:wfv1GVFF+765nFvFf6dlzzSGFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075372, "uuid": "527bc3c0-ecec-4add-883e-c616fd05d801", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075372, "uuid": "e2b7cd37-91fa-43b0-8549-bd9cd8539257", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075372, "uuid": "c7e63c49-3cf4-4121-81f4-cbfec2d9951f", "value": "9df96f432cbf06b20c3f8ea221db539479dfc1fde7da62bcd5cf0e6686f9ec15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37483206-86b2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086053, "uuid": "f7b553eb-cd92-4c6a-bbf7-ee724429dab4", "comment": "Malware payload", "value": "9bc141f0b7550df94f713e0962b736d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086053, "uuid": "0f01f443-d72b-4764-bc1e-86ac0a59897f", "comment": "Malware payload", "value": "9f157ceaee5858d2f77f1f828d9dc8417c7c99a65b4412896ac0231416336393", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086053, "uuid": "1c62f562-d0fc-4d96-a671-4e5f090c96f9", "comment": "Malware payload", "value": "fb54be90b52c3ae67fa36c4b42058c4a96bd0d34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086053, "uuid": "98752e46-119b-400d-80a5-148d2520b93e", "comment": "Malware payload", "value": "e49c1e0deee9e1579fe830abbbd67545d8150e368b1e2432b28a21d3d026dc390a805f8ae4903d810893c2a727517940", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086053, "uuid": "8aed36b3-4bfe-4e63-ab98-cb6cb13dd44a", "value": "T14584CF10BB90C035F1B752F449B693ADB63E7AA25B3451CB63D167EA1A346E4EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086053, "uuid": "9eb02815-d800-465f-a8db-e99446a2d133", "value": "1a3cf179d845c62d49a765b8e54e41fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086053, "uuid": "0825d4d0-31db-47ed-896e-27a006daf389", "value": "6144:pGJItNqakccUCseBAKH3GH1QYvVDnFqvU66tfdyHNdlxpOLKBFss/KsmO1wfze97:pdNqKRCsepH3GHOK4cdtMlwsWs/3oLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086053, "uuid": "c489afe8-0d2e-4543-811d-171f21e4bf5f", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086053, "uuid": "162efc40-e82a-40e1-a257-edef3fae7de1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086053, "uuid": "90860c04-7c2a-4eb1-b261-07ec19af915c", "value": "9bc141f0b7550df94f713e0962b736d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a505b8c-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075374, "uuid": "fef88d42-9799-4767-904b-dd294cd0910f", "comment": "Malware payload (Heodo)", "value": "0ea6ef50cf475006599cc8d06643eada", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075374, "uuid": "fea14b4e-e19d-4543-91d2-52f5f1128a3d", "comment": "Malware payload (Heodo)", "value": "9f6c4f604ad6a94018b63d532f44397070a153e4844ef4f66b3906f063d745b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075374, "uuid": "0983ce30-a423-45f9-bd91-fafb2d082d87", "comment": "Malware payload (Heodo)", "value": "01ecef80b9a6b6de1f1516951ca05886c1c7e94a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075374, "uuid": "491b3acd-793e-4751-bfef-854c8adce5b8", "comment": "Malware payload (Heodo)", "value": "e5badcbc96aeed5aa67c844ea5ea9b3acb497ae3d84f73d44c1864dda2eba760f43c4e086882db965e55bc9c3e92c578", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075374, "uuid": "614976e8-228d-4820-930e-8399c882942c", "value": "T10225AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075374, "uuid": "fa6520f2-2ba9-4b06-8a2a-4dad066726dd", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075374, "uuid": "897050c1-0ab3-4cf3-8de6-70431150db55", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxrfFIIm2m42:1ZsYB7vLsnZI1Hb9D6FIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075374, "uuid": "482aa25a-d92f-4c9f-8620-1c9015bb59c3", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075374, "uuid": "c02cdfff-0aa8-4c21-87fd-93542a33c319", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075374, "uuid": "253f7d9e-66c9-4a2d-ac29-72cdfb93590e", "value": "9f6c4f604ad6a94018b63d532f44397070a153e4844ef4f66b3906f063d745b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76c6435-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019722, "uuid": "b27c5cb5-20cc-403a-9722-5e3a51220717", "comment": "Malware payload (Heodo)", "value": "0be5c2dfe9f72be1f77b71911edbfa92", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019722, "uuid": "258c0f41-71bd-4c3d-ab27-f3b7bbfdcd46", "comment": "Malware payload (Heodo)", "value": "a0e7144868e941a6a053c70c44b9b065114418c15270dde3f3ac04e7def26cbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019722, "uuid": "6969c0d0-cae1-403b-99c0-e2f456b8f527", "comment": "Malware payload (Heodo)", "value": "b0340dfdaa4dc6db6f67f3a12ae55b900f9dfe96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019722, "uuid": "283c44ce-23a5-48fb-afdf-4f309c9dca8e", "comment": "Malware payload (Heodo)", "value": "70cb0ef4caad79f438c6043e06fc042df7da206d3ad0588ae9012d5e8f532b0785470ba03911cbd9bfa3eac365079892", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019722, "uuid": "9e4885d1-46b9-4a42-948c-247496666153", "value": "T10D25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019722, "uuid": "0357fb19-e9b9-46f1-918a-64f2a88ef668", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019722, "uuid": "0b82c0ce-dd55-4579-9c2d-a959f01eaba1", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxofFIIm2m42:1ZsYB7vLsnZI1Hb9DTFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019722, "uuid": "d4c46f4e-06ed-44a0-93ec-8c2c26df2f40", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019722, "uuid": "f5b718f8-8fbf-41cc-849f-9203f0d664a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019722, "uuid": "f5ecac0e-e5aa-46e9-aea0-625920a14c5b", "value": "emotet_exe_e4_a0e7144868e941a6a053c70c44b9b065114418c15270dde3f3ac04e7def26cbf_2022-02-05__000835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6445138-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "7b9c2150-c80b-4970-868a-ddfaa3ebf504", "comment": "Malware payload (Heodo)", "value": "079160b30e8076da75fb51b768c4e130", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "32a9f58c-af66-4ba2-ac98-e25b2ee3de33", "comment": "Malware payload (Heodo)", "value": "a3455ea909e2a4402c3194d8e2025da1bb61bb7d0ab21810103f318acaafb19b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "f83feeff-d0fe-4cab-8c78-ca2b6bab38fc", "comment": "Malware payload (Heodo)", "value": "2920f59d672531bc9a94adaa6f4c362937e09666", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019721, "uuid": "fa3d3ea9-098e-4761-808e-f86b67e2fdbf", "comment": "Malware payload (Heodo)", "value": "4533ce48fd7fa24a3c1d1a4c2f255c754da9b206dff8c9a839d18edb99397b2595e9da8bc4006ddece515cc183abb1eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "370d9f48-38c7-4f83-8939-73081829cffb", "value": "T10625AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "07c37b7c-2d06-42dc-a215-bf35a882c483", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "8e9a94fa-49a1-42fd-b0cf-206f0552bcd7", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxHfFIIm2m42:1ZsYB7vLsnZI1Hb9DGFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019721, "uuid": "67312857-1efb-4d96-ad3f-68fb77a35907", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019721, "uuid": "6ca4dc60-b27d-4a76-8696-fc801c7c3a89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019721, "uuid": "b8fc1717-128b-4569-9aa6-6d329bd4f208", "value": "emotet_exe_e4_a3455ea909e2a4402c3194d8e2025da1bb61bb7d0ab21810103f318acaafb19b_2022-02-05__000835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dd46c7-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "9188c162-53e8-4eb0-af8a-6445e2a7a032", "comment": "Malware payload (Heodo)", "value": "2e0494d9406580f98bf3ffa0f496fd51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "85b02c5f-36cc-4d87-bfd0-47f14195b25f", "comment": "Malware payload (Heodo)", "value": "a3819fb37c3c6ce4548f5e6fe0980c24eb782b05936cb0b703fe10ab881e3092", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "d1adaf49-f32c-42ec-8e52-33d7fbc82089", "comment": "Malware payload (Heodo)", "value": "3c0de7317e0dabd8dd359a84abc9d07ff7c0c143", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "5fc5a1ea-3d79-43d3-ac0b-8accda4ca5b6", "comment": "Malware payload (Heodo)", "value": "4e6c3e52d5a8b1c6f161da0573b1181973035c61d7cb7ec685457f150a7d48033baac7bdaf8cf3717b9ff5207880ba10", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "c3b8a154-1e78-48ad-a3e7-891dd6b4c9f0", "value": "T1CD25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "16117ca0-9739-4f54-9c4a-8edcac99a189", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "abdcd345-bd06-408e-8e7e-ba94db7962eb", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxOfFIIm2m42:1ZsYB7vLsnZI1Hb9DJFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019720, "uuid": "fea1f3b5-9c11-41f5-aa5d-5decf5c54c3a", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019720, "uuid": "e59524c6-8189-4e9d-911d-bf82a4c288c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "85ceb436-eeed-42ba-b0b2-fb9812ebf845", "value": "emotet_exe_e4_a3819fb37c3c6ce4548f5e6fe0980c24eb782b05936cb0b703fe10ab881e3092_2022-02-05__000833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a87175a-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075267, "uuid": "6a1d0a9d-3038-493f-91d5-b369d496a7e7", "comment": "Malware payload (Mirai)", "value": "e3f2249b2619a47b04e2580f41799ade", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075267, "uuid": "00e9421f-01c7-48f4-8f65-d2286da80b1e", "comment": "Malware payload (Mirai)", "value": "a3a4f784a91fc62ea03be5f72ec20f35f3b4a1a0f0f401e699ec7710df48ff32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075267, "uuid": "bc81aa29-c4d1-45b8-86a4-f4e4c1cc1ea3", "comment": "Malware payload (Mirai)", "value": "d1c2cfcd9bccf071e5d3e54da77157523d28998b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075267, "uuid": "7d223ee1-dd69-4cfd-9f00-50fcdd0e8f06", "comment": "Malware payload (Mirai)", "value": "b90e999eceb13d4b2709cacf1903aeaf11207a9d63001e8fc108b1d1d77960d03fcdcbdf7860b870a3d559b9e29830e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075267, "uuid": "98e65ab0-72d3-4cdb-9614-5e2a0c1bb72b", "value": "T101E3756E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075267, "uuid": "18d3062d-8b0c-4f27-b684-c66b8880e831", "value": "3072:07JmtxvGvlfDfj5hKmEzG2URxuZq+1uPNd5R:EmOBj5hKmMURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075267, "uuid": "487ff244-9e50-4aaa-9249-65d24cc1655a", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075267, "uuid": "4a228bc7-e923-4f51-9639-4ce7fef54e6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075267, "uuid": "e4d6be73-c0e7-40fb-b59d-a58ebdd50720", "value": "e3f2249b2619a47b04e2580f41799ade", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e180c3b-869b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644076132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076132, "uuid": "61af28a8-ccff-40b9-a2ee-f2ee3e09980f", "comment": "Malware payload", "value": "23db2a242a0e69070906b4d53687387d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076132, "uuid": "89dd6c98-ae1e-4906-9053-f4757abc665c", "comment": "Malware payload", "value": "a4c7cb6d7212aac61a61a4f7c7c218684a8ea7727ebf26c4bf9b4f98c39a86c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076132, "uuid": "f007cd87-0b9b-49e3-be98-76b1b4176043", "comment": "Malware payload", "value": "62a5de498e7dd6271b64b4d2a97ff45771e61ae4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076132, "uuid": "b8eb674a-98f6-460a-a9a9-e50ba85c3543", "comment": "Malware payload", "value": "1a6a4637721c8af75b531fd6e8ae5a04a0a3fc582f34f17ef93e1dcc80ae489580bb3465b6ab47334e93fe5129fb0ead", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076132, "uuid": "1c8b5528-2b75-4c29-9622-4eacbe0b0e13", "value": "T192853328D2EAD686C10955BF904A6F69ED56826D2FCAD31CC03FD60A3E125C0F5CD3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076132, "uuid": "b15b9477-2e3c-46ad-926f-124f4ac6eebc", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076132, "uuid": "71057ae9-f05b-49e2-99b4-ead410da333e", "value": "49152:CE5K0otTu2XsSRxUAlntfV0B8FQ8xLvtYTq19zo7yb:CE40KXs5E9V0B8F3LlQq1C70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076132, "uuid": "e37633aa-b4de-46e5-93a5-a59b40921ba8", "value": 1725440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076132, "uuid": "e00e40f0-01e1-429e-8b3b-e75fe40a5bfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076132, "uuid": "f6e60abb-bada-45d8-ae7a-7628230f0d4a", "value": "23db2a242a0e69070906b4d53687387d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4763ce9b-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091234, "uuid": "632ab1aa-5fe0-4403-9b73-4b414862c01e", "comment": "Malware payload", "value": "2bdfd3609d98f54cc1c8fc7e3f5e925c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091234, "uuid": "d5ac2b34-8706-41d8-9634-47cbb11d51d7", "comment": "Malware payload", "value": "a5ff805e8d80ff06fb6a387306bba0eb670147b58bb69bc37b399a549f6372ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091234, "uuid": "43e7e969-2dad-4925-90ed-7161ea6cc927", "comment": "Malware payload", "value": "1e1c42c4d1cefd930ca37e60ba8689f3d0da174c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091234, "uuid": "71bb9923-ed47-4b6d-8386-221ff1ed9b30", "comment": "Malware payload", "value": "42ef64845821fe1f72c3b2d1f186eb577290a7136e4b43a2b2598b87dbb095424cd866e2767018a276a46e151e2a84a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091234, "uuid": "60fcaedc-9ef9-4f8d-9c01-67d4170eca81", "value": "T199F13A76DF48C9F7D0CB2A7351DA7913D97ACCB281328163A3F5486D785A428DC2CA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091234, "uuid": "a59ec317-8f8c-4ab6-83a0-8b238619fd80", "value": "d5e0355f8764c235b38759b860077ceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091234, "uuid": "fb42e191-f71a-40da-9b93-241f7083aa4c", "value": "192:nQoOhPuTAxCwCMrpY7e8LqPZo5LdCfq1Rn6O3:Q5qAxCr6+e9Pfqbn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091234, "uuid": "bb8b1c78-a2b4-4ce7-97e4-e68f6221e92f", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091234, "uuid": "f58dca53-f561-412c-92b4-ce00d650c914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091234, "uuid": "46b394e0-a739-4c72-b73f-cd54b8fb03ee", "value": "w32linda32.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c1e3f2-866f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644057603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057603, "uuid": "cbe63c07-f25b-4170-aeaf-efd2eb4bdb58", "comment": "Malware payload (Formbook)", "value": "138cf25577b2da2574b5b19913fd3b01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057603, "uuid": "541fddf0-7289-47a2-b73c-2586b071d261", "comment": "Malware payload (Formbook)", "value": "a64be57f36f2cdb1052aee4e4babf66a70f68c22c2efb393d8f2423cea62f1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057603, "uuid": "7cac6c53-b1ac-4db1-9cae-84a8ca430d2a", "comment": "Malware payload (Formbook)", "value": "e2b1ea816193e2bd3869a90eb594c09cae1d154e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644057603, "uuid": "63f99846-524c-4bd4-8927-9feaa9008aab", "comment": "Malware payload (Formbook)", "value": "ddea83939924818bafa0a89141e235ba1f1fb7addf925a21965272752e500c2078803f22642871c06bd9f47667f31c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057603, "uuid": "2115136b-b4a7-4ad2-a55d-2f4288ff4305", "value": "T17C4401201AD3812BF09E3FB11860E974F269FF2DED45094BFBA47A75173939E21E4291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057603, "uuid": "4f530488-c7c4-4865-aeac-d6f5cb5df149", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057603, "uuid": "6c1787e4-847b-449d-9187-12aabccb21af", "value": "6144:/wIMLSiMm2Y5bu+UMj3VtT/l14KzUd6pkAbpBYXTpc/:yh56+UMLVtTN1vbpSXl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644057603, "uuid": "bc6836d8-2f81-4c62-80b9-7fea817ba92b", "value": 268884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644057603, "uuid": "a18fd7c4-2b09-48d6-8293-c146ec188582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644057603, "uuid": "fda66f56-0f13-40ab-86f8-bef9e6e09b25", "value": "edun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3baa8d9-86bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091093, "uuid": "b21c6c5d-2ef7-4487-96f0-779bcd4b71a1", "comment": "Malware payload", "value": "36ff406c0c1ef9bc931499d6f2638b4d", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091093, "uuid": "f255d515-f160-4794-8463-fe481b3bd886", "comment": "Malware payload", "value": "a65908d3d53e2526b212d08831cab7569f48e269a25abceb9ac30974f0cd72fa", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091093, "uuid": "5cfa03f9-fb98-4291-9e56-334f668a3694", "comment": "Malware payload", "value": "52ee58c7a1fb96a324326cadcbdd11538ce928c8", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091093, "uuid": "d6e0e1ae-19ac-482b-9bd4-14188c4ece58", "comment": "Malware payload", "value": "ff93a5a7d0eb0eaaae6b25d97f51f8fe35c5c26f0e9a9e50815570ab6873f448426d98885a9ee95ab23a569b4a9227f2", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091093, "uuid": "081a2f1a-d7be-448a-a318-897c4c85fc94", "value": "T1965188C16E0595BCC1F281C36111DC46A2B113F2CF2D8D4628B0CCB7ABBE1DDDDA4166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091093, "uuid": "c5b94cf4-af10-40cc-84da-52f7ec5731e1", "value": "48:AA4DTzlkxfdzCi9v0ieOHd/6SiN5sG5WqGTx+TATF:AA4D3ledd9v0ieOHd/6SiN5sG5WqGt+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091093, "uuid": "3e96f52b-6100-44aa-8e37-47b5f6f8ff4c", "value": 2481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091093, "uuid": "03a2050e-b46f-427b-990a-61636c00636e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091093, "uuid": "d58dbb6a-c628-4841-947f-bfb717365142", "value": "xchange_b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc60ebf-8669-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644054814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054814, "uuid": "da2b32d2-0b64-4aab-b113-7fc384f90dcf", "comment": "Malware payload (SnakeKeylogger)", "value": "57f51548768945790665a0291b399c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054814, "uuid": "0dd84149-1b72-4937-bb06-321d79eb7c67", "comment": "Malware payload (SnakeKeylogger)", "value": "a77515a138479d5c99ea79802d15c3f38d53879b9f5f0fc67ce2825d08605a14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054814, "uuid": "566dbef6-ecf0-41e9-b7c6-e5fd7d8101e8", "comment": "Malware payload (SnakeKeylogger)", "value": "ce9dbfef2f2e8e95c88b6a82c79f96d65df92b2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054814, "uuid": "e2948734-fbdb-4c8a-94fe-b0291b932e8d", "comment": "Malware payload (SnakeKeylogger)", "value": "a14dc456c83ad81841b35b97a6179310d3063ad642edf5c0ec8088c4aecc0718812201dd246bad9ff99e155959b8ab3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054814, "uuid": "e6b9de61-3167-4c9e-806f-c77405bbb586", "value": "T186A4AE4172751282F17E8FF064AE89904BB87F7A6404D6DF2DC871DA09F5324826FA9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054814, "uuid": "2f01214c-1ced-4263-b3ba-95080f7e5278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054814, "uuid": "da7f82bc-41a1-4d8e-8489-ead34ed328e6", "value": "6144:8HbOXXN+2tvJ/xa6xxMrHbW9i+SNK/liYrfFFMOwXUSVH3WfmDuoiT:87EhFxXPMW92NK/wYrfbMOwrVHpDuoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644054814, "uuid": "ab8049b1-bc46-4b11-92e1-6dbfe43b504c", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644054814, "uuid": "5e209991-90b5-46f7-b279-918b021773e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054814, "uuid": "bfbfb789-faf3-4677-8e31-36ca1c64df9e", "value": "DRAFTCOPY-39398373-BILL-LADING-INVOICE-EPORTDETAILS09E874947.PDF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780ca08c-86b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086591, "uuid": "12b34f66-a47a-4eee-ac77-0289d406457b", "comment": "Malware payload", "value": "d35715e97081f71ca4df20ad03bc0341", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086591, "uuid": "b2cfdb60-a203-42c0-83a6-2dc1e642f059", "comment": "Malware payload", "value": "a7f8cc34f7fcffb6f29fb6b0fe7b1bf1484ebb2163091138d7b4e3975a44d052", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086591, "uuid": "3f1fad80-75a9-4d54-bc85-63422837fb40", "comment": "Malware payload", "value": "2c3b51c4a6e0fb54c3ab66446dcce7d5ed61b5de", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086591, "uuid": "bc57b10e-d640-485c-b2f9-9346b4e64b00", "comment": "Malware payload", "value": "5018afd760017502aba50cc92ea50eb6632c1e52b77fe3b078e271d6d822bbf0d54c3970c88abb8330d9fd4b3b800c61", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086591, "uuid": "f18a4066-ba01-4c38-8cc8-911cd8d32826", "value": "T147112F576ED8304D991B1BE32178C0BC4F879D88E3D0FB5A0AA29092D8B4BC03787E1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086591, "uuid": "ecb665ac-3438-46d7-9e96-9ef9e20d8e87", "value": "12:p5Wc6GHD0+RNdHm/WymvPMzDPjxSYbql5bzJ9yR/29ZEjuYLqB9n/iY/2n/VvIm1:GcvH4AxsJGTtZEL7GB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086591, "uuid": "bebba5a8-c006-46ec-9222-f5a24ec247d5", "value": 858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086591, "uuid": "0419ff47-6f06-41b7-b5ac-bcab3f65e098", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086591, "uuid": "15353807-459c-411e-acd0-6cbb26c74323", "value": "BASTILLE.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e8912c-868f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644071129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071129, "uuid": "8c3cc77c-dd61-42ff-8358-17f328cb50fd", "comment": "Malware payload (SnakeKeylogger)", "value": "ef36021e8dd588f8153048c4e02c9d6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071129, "uuid": "7f7523e2-977d-4e20-b896-6126c687c041", "comment": "Malware payload (SnakeKeylogger)", "value": "a93dde650adedc95caddd2ccd08fea3f53b1d58ce58d44854353b5a5f43126df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071129, "uuid": "e861dfc8-4db4-4fe5-84c4-46a7076343bd", "comment": "Malware payload (SnakeKeylogger)", "value": "f80db6988c1c32255f03fa619c4197c80008ba84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644071129, "uuid": "51304e24-4de9-4291-9b8a-641233974b9c", "comment": "Malware payload (SnakeKeylogger)", "value": "e02f9e3ba33aa36d800e551ca6d774c22fe7cf9970d5f1386567b46ae2ce38dbe74fb5b9ae02b754d5d17e650da838ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071129, "uuid": "068ad514-009e-4546-b71b-722246fc4f99", "value": "T11C14BE576796FE91CB212A3028090760DF72C81DAD95D3435C7E4DB92946BB2B2FCCE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071129, "uuid": "3e1081b0-31e4-483e-8544-50b1702a77d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071129, "uuid": "43be0e8d-3898-474d-9ef3-c6e6fe07c326", "value": "3072:hbWrJrqITay+jI1e27AN8FmI94cKgl6sp9jNbAxFnW+JHi/yQmd+spVuSr+p4ugg:v8FmIjKgl57jNbATWKhzpV3rHugsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644071129, "uuid": "2ec67ecb-aac4-4323-b809-d1838d2234a0", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644071129, "uuid": "9d695b30-59bd-44c5-91df-4084a4d31e28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644071129, "uuid": "ccf00f60-17b7-4689-a57d-bc3b02991368", "value": "ef36021e8dd588f8153048c4e02c9d6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b10001f-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075375, "uuid": "187f3c1e-2040-49ad-b300-ac5f4a4780c8", "comment": "Malware payload (Heodo)", "value": "4358d328d4fe76121ab52dd5a736f006", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075375, "uuid": "e4b82b44-b75d-44a7-9494-c2a92271cbf0", "comment": "Malware payload (Heodo)", "value": "a979da96b82008a4f1ab0675c43b6d03cba0c20085b458f11d3224f3c7df0433", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075375, "uuid": "bb59e7cb-f0c3-4bee-bfa1-39e816ead3f4", "comment": "Malware payload (Heodo)", "value": "b64e58d3b5faae3ede8583467e15f03d9aee0e87", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075375, "uuid": "a04da9a1-7e7a-43b4-909f-2a6adccda5f8", "comment": "Malware payload (Heodo)", "value": "3ec5081b94771039361cc332d9addc73ee61c0eb3d4a7b21e87289a3994ac568647c2eab4f95de032cfddfd35c37c9b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075375, "uuid": "def18f61-d5a5-4599-9db4-301e856a3d73", "value": "T12A35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075375, "uuid": "a84c0c83-c9a5-4ea5-b6ab-4a5da00a9b67", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075375, "uuid": "f8781f1c-acdf-4803-82bf-946fbcd612be", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTTFIIm2m40:wfv1GVFF+765nFvFf6dlzzSPFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075375, "uuid": "ef68d289-f45d-4fe0-a3b4-17a2e9dbb7df", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075375, "uuid": "23d9cc09-2137-4930-9a04-43c644cd9ec1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075375, "uuid": "bbadeba2-a569-4b1b-9538-964ee8c5528e", "value": "a979da96b82008a4f1ab0675c43b6d03cba0c20085b458f11d3224f3c7df0433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3725c2fb-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644076174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076174, "uuid": "5b50fdde-46a0-4317-83e2-e5c4607dfbc8", "comment": "Malware payload (Heodo)", "value": "6a1c491fcc740b95b1ae160695558039", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076174, "uuid": "5cd98b9e-1556-42f0-9945-d25f244bb038", "comment": "Malware payload (Heodo)", "value": "a9a0e3f0aaea62b285c52e575d03ca4a4b0ee0cb4f4fd677ffdf52863fab02e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076174, "uuid": "aba8493d-fd25-4d35-aa28-482eec5644df", "comment": "Malware payload (Heodo)", "value": "1e7118c311dd07f335272896f13f6f4e8f1cb28a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076174, "uuid": "e601ba8f-0edb-469b-b19e-54b588bcd91c", "comment": "Malware payload (Heodo)", "value": "7f380d9e65e808bebffd5abeea40c0bc4356bf57bb7587e8716f371d44ee5c6ea501e45c5a504e61895655d15d8894b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076174, "uuid": "1df6a20b-581d-4ce5-90c7-917f6304e65f", "value": "T10125AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076174, "uuid": "c49b6339-f0eb-4ba4-9ce3-8a42a75deedf", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076174, "uuid": "1a825b06-8e52-43ee-8c19-979b6cce9cb1", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxyfFIIm2m42:1ZsYB7vLsnZI1Hb9D9FIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076174, "uuid": "f875c6ea-5b2c-484a-b69f-fad38aeb5a5e", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076174, "uuid": "3df8335e-ef73-4610-9db6-65023dc7c0e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076174, "uuid": "5612de6c-5d62-481d-97a7-27c5b7b8383b", "value": "a9a0e3f0aaea62b285c52e575d03ca4a4b0ee0cb4f4fd677ffdf52863fab02e2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bfc25c-86b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086807, "uuid": "89a0b545-d30c-4585-8e72-2a19c856c388", "comment": "Malware payload", "value": "43ac95142a5c7281246b68ef0584e079", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086807, "uuid": "4e6e2db9-9476-4288-8739-7f64b4a9c38f", "comment": "Malware payload", "value": "aa61471cda3bc98ca21854f59871d4979de942293891c3d9861a6c0e4474516e", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086807, "uuid": "b92f74b3-889b-4b2c-948a-8fb2ee882a44", "comment": "Malware payload", "value": "66758177710fcdd652c37671efe593f7651248e2", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086807, "uuid": "12765ce1-f2c0-4f0a-99af-ece15924f762", "comment": "Malware payload", "value": "1a20aa36232ff181970b4454b3d8fb5ce6a929b9d772344d5ea9cc198eacce7607e1be48550d45a595b93f98a47097af", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086807, "uuid": "bd3f0c31-bade-4421-931e-344236d7f8cb", "value": "T181510C45794008DD897230D338E1D68158B091F28C313E89A784DEBF9BB1DFDE9642E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086807, "uuid": "414283c4-f640-4610-8066-7b21b63f1609", "value": "48:OHj1As3CYNAHH8zdB0H6RTFaN+Jk1wgnNX88aVE43d+6O:QJAs3CFnOB0HyTFaN+Wv88aVLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086807, "uuid": "ed38e2b4-fbce-402f-8e8f-f99f3b794205", "value": 2755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086807, "uuid": "ef22ed54-8a83-4150-87a8-3260bbcca2eb", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086807, "uuid": "453753f1-0b58-4c41-a8a3-1b2e46f7cc3e", "value": "LoveLinda.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96df529-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075211, "uuid": "0abd6af8-9e09-4ab5-aa87-6e3015c096e4", "comment": "Malware payload (Mirai)", "value": "5d7649c3f37af235f274808dd67c42fb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075211, "uuid": "e376d067-95fb-4923-a4e8-42ab926a81c2", "comment": "Malware payload (Mirai)", "value": "ab0d136bbf27a7b2a1ee262e11c50f7752dfc512a974a8245de9b705bac0a462", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075211, "uuid": "1a6b05b8-3c70-4e48-8609-eefd591f9dfb", "comment": "Malware payload (Mirai)", "value": "6b8907402ee2d804401669cf124cbb1311b24e3a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075211, "uuid": "fbf77c7c-72f1-40a0-9325-2d941a752c49", "comment": "Malware payload (Mirai)", "value": "52566b07a6e9cac4b5ad51ac237e97fde204e143566d7773be01da2f2a378411475e0c18e407498aec3ed21c97506fb5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075211, "uuid": "d5e111fd-441c-437e-872b-acb7dd32e699", "value": "T189B35B176692C5FAC08342B92BDFA1618823F67D0B36721773D4BDA43F158CA6E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075211, "uuid": "ccc7ca1f-6b9b-423a-b75c-cd8e846ac43b", "value": "3072:/d2niCa9qRBFZm4z1EYfcbJbphapf4Jvs3CKPCNVOXinYuM8R:FMVm4z6Ygpphad8kFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075211, "uuid": "e329f9f1-d9e9-48df-a698-b110ca992012", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075211, "uuid": "62eb4dcf-65b9-4f69-8a22-a519de88274c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075211, "uuid": "a63f1b0c-7196-4392-abb8-e206fb00b0b2", "value": "5d7649c3f37af235f274808dd67c42fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033d9ade-86c0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091978, "uuid": "fb5dde39-eac7-437b-8e03-5aa1dedca49a", "comment": "Malware payload", "value": "456d71a02c519c6a1f13fa9ffc899f2e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091978, "uuid": "917a0b69-2c8e-483a-b99e-3f67bb36f04a", "comment": "Malware payload", "value": "ac9feaf6626f186bd557eb90c494a7b596420954d9d41c61219310ef6e109f62", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091978, "uuid": "aaaa73d9-b59d-4861-a205-b952e9ea6d2d", "comment": "Malware payload", "value": "534f5ae68f8634c6c69a5b40ad131a4bf674d000", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091978, "uuid": "a9516020-4ffc-49a5-a7bd-f60476d89167", "comment": "Malware payload", "value": "57a2c1b558573bacfa23ba56e3b873cec8bb42ee9579bf6501d9eaf1826cff8c6832cfc89bc6ac834fef448f9a5ef23b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091978, "uuid": "2a71e260-50e0-42f3-9c01-6c731f19bf09", "value": "T1DE035304B3EADE16D6A566321DEBCFE66732BC41AE12C31B3140373F2D79A508E51752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091978, "uuid": "b0a8f1e7-28e6-4906-863d-e520d68ec059", "value": "384:5EP2L0MVf6ax3G1rNcTPOV5z/dwKMNLsTBUdt13Cs0cO00j+hHCc:5E2Lnx3eNtgLh0CBhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091978, "uuid": "4c1ab369-cd1d-4ce8-a23f-8d590e9b56f7", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091978, "uuid": "19661f41-dd45-4e07-a349-a36391a2d226", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091978, "uuid": "5ba99500-ad64-408b-a280-4bef40497371", "value": "Wolf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6b0cd9-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075378, "uuid": "6c69c020-d630-40f9-8546-7fb4b238a85c", "comment": "Malware payload (Heodo)", "value": "af9b3ed02282cb8f3c429a6652930a84", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075378, "uuid": "c8be9a74-e2e3-4e6a-83a0-b84add56e2f2", "comment": "Malware payload (Heodo)", "value": "ad15fb4db8da225c506f66898a866524a4dfa7cb84525686b375c1149d309536", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075378, "uuid": "82ab3136-29a6-4c48-9201-1d9decce2c4c", "comment": "Malware payload (Heodo)", "value": "c4ffdaf77c1a074e6bb221a87a943ebb9cf088db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075378, "uuid": "156318ce-e856-415a-881e-453f4f413073", "comment": "Malware payload (Heodo)", "value": "387a4327257738d1889c3d037b08e4cb7f5a4f483f2e1aea729bf133013b5a81f40f7b81ac315a8011d1d55098c6a028", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075378, "uuid": "99cd72d5-1373-40ce-aa1d-f1a3bf75976b", "value": "T12C35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075378, "uuid": "2f876cd4-f80d-4e03-b37c-89e507096ebe", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075378, "uuid": "88290f8f-b483-4f6a-b297-e2a8d2cd713a", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTyFIIm2m40:wfv1GVFF+765nFvFf6dlzzSeFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075378, "uuid": "a41fe31a-61f8-47b9-8f59-6b8fde69e498", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075378, "uuid": "1e111b67-ada4-4160-a17f-df5104e31bac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075378, "uuid": "ccd337e4-afdf-4a8e-9415-1c372e58cd64", "value": "ad15fb4db8da225c506f66898a866524a4dfa7cb84525686b375c1149d309536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9280a6-869b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644076158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076158, "uuid": "c4076b56-3154-4a98-b38a-0c7710f9dd9c", "comment": "Malware payload", "value": "cae815efaa1525b49c738affcffb8021", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076158, "uuid": "17261669-4305-4ff0-b554-de0ff6b3e3e8", "comment": "Malware payload", "value": "ad4c13e847384a5ed8640ea6bd4c42c97f55eef4ce21d11224b89d818e0cf74f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076158, "uuid": "280537b8-0bf0-4acf-8fa1-ca2aca05345d", "comment": "Malware payload", "value": "eea1626e143b034411ba699b142d621067f742fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076158, "uuid": "f89dd642-ed3d-4bba-a593-85e5a2a30fc1", "comment": "Malware payload", "value": "1ee51e2810b2ae6c6ec3ea3f8d9c4218f2bdc037b0d0056b7a1aba04353084238c23bd19b73402257283a1b9f3b35180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076158, "uuid": "0c5a741a-765e-4f85-8713-43572b0bdafd", "value": "T1B8E533B943A3928CF88FE236A43729F7721EE94747D4767084950D87C913998F78AC1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076158, "uuid": "cebd407a-5f20-47af-a4d3-c842d1b30e57", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076158, "uuid": "523c3fc6-6a24-419e-a8c6-e8e169818978", "value": "49152:qoDejVHldWjaR3e5hYT/dS8/vU7kElfCdXYgLOLdgORW7Q0RAzU8eGbDIiAE8ePl:vKjVGa1dU3ClLEmFQZPIiA/ePq0w8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076158, "uuid": "47a7e9c2-09f8-4e0a-af77-41391c54f058", "value": 3266981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076158, "uuid": "330d3ff4-d25d-4d2e-b5a1-fb6064eff03a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076158, "uuid": "33786937-2862-40b1-936d-8b1767916464", "value": "cae815efaa1525b49c738affcffb8021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5df70b-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "4f2e6e72-adb3-4e6c-9c82-5eaf5d0f7d1f", "comment": "Malware payload (Heodo)", "value": "401cec547d096b179c3b894ee854378a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "ada41c43-b5fc-4462-bf50-5a84e3d2a7af", "comment": "Malware payload (Heodo)", "value": "add72a49a8bbc9d4c69666ef6c1446db62c872bb2aec93904f2e284ec37bd73d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "8dd5be6b-6ec8-4f61-ade8-7186ab51b65b", "comment": "Malware payload (Heodo)", "value": "f078d2e6e328a4f8e60af1953a316ae8394c2e03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "099cfb15-2a85-4b31-8fd7-a287ef426238", "comment": "Malware payload (Heodo)", "value": "f8fc2f520ee1f58b1a3329c02e490b9443bfbbd2533a8dd1adbecba6e5f5084eae6a0ba6bca0d3a4343503dc77b797fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "cda387b7-d02d-4bdb-beff-f639c0ef0637", "value": "T14635AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "1c3d49a8-e64b-420f-8f1d-b30e342cdd7f", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "9e8cbf7a-3bf6-4396-9a45-b3a3f8ac609d", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTEFIIm2m40:wfv1GVFF+765nFvFf6dlzzSYFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019867, "uuid": "6506b2b3-03ee-42dd-a641-7324518489bb", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019867, "uuid": "4e647ba2-3f27-444c-8791-2a5405d4c16f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "d6159b23-6270-4ebe-9f5f-0313250617cf", "value": "emotet_exe_e5_add72a49a8bbc9d4c69666ef6c1446db62c872bb2aec93904f2e284ec37bd73d_2022-02-05__001058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3af4d7-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075379, "uuid": "5141d654-6c98-41de-acf6-db2e0f6a51d1", "comment": "Malware payload (Heodo)", "value": "157d8e8f5bc984dacb6e901b82a76db1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075379, "uuid": "cb7a64a8-7723-4e99-b0d5-0d3deb4c3f9a", "comment": "Malware payload (Heodo)", "value": "af0bd7e752d0f7610900427e677c486bc1272402f12adb556b9d8af754b4f8dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075379, "uuid": "ea4a5ca4-d2e3-4c8f-885c-7436b4ff3b3e", "comment": "Malware payload (Heodo)", "value": "b795cf754d9dea9e16ba299784d5ff7b962abf4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075379, "uuid": "1a3a168e-e7de-4292-97b0-c674407d41f6", "comment": "Malware payload (Heodo)", "value": "fac7a42744249c2e3e7f17c6e179121c937788e8515330784df011b315b9404f5a1ed699f32fd041073c419358a777b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075379, "uuid": "64b4c01f-58c1-4509-8a6d-665eb1603e91", "value": "T1C535AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075379, "uuid": "9eaba217-9565-466c-811e-36ce0dc86d69", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075379, "uuid": "25426f00-7445-4375-ab33-78cd58f5370f", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTtFIIm2m40:wfv1GVFF+765nFvFf6dlzzSpFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075379, "uuid": "83b0657f-b53e-4e04-a2d9-bf90888ba7e7", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075379, "uuid": "ece1cc8f-882e-4902-9be9-747bc1af0f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075379, "uuid": "c8d27232-643d-4066-bbf1-23e5e2ac37a1", "value": "af0bd7e752d0f7610900427e677c486bc1272402f12adb556b9d8af754b4f8dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b4ab80-86b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087315, "uuid": "29daa6f4-16a3-44a3-bb56-fc9482ccc06d", "comment": "Malware payload", "value": "0a4e37025fec58713036fa88a28a070e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087315, "uuid": "c83b7482-059f-458f-a8cc-09b354e825fe", "comment": "Malware payload", "value": "afe0a54b66aecdbb28311a50ec56a7c808f600986ea59da2dfaf2071a877ec8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087315, "uuid": "494e148b-69fc-43ce-aa13-70f371c0b517", "comment": "Malware payload", "value": "d85aa3be13c031e015b7378c7cb1951fb7ba2efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087315, "uuid": "32b7f4bc-2a85-4223-991e-62889ea9dceb", "comment": "Malware payload", "value": "e74fcf6b65af518240d98aac64b5aa3e465dc22d4557dbe1bf9efe265f4b901add0d4a45dba2d10cb422dde551e548d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087315, "uuid": "a2e8bf3d-ab17-4142-8768-61d7a01ecbdb", "value": "T180B12ADBB1A437B3C58760321AD27820BC6E3CB04FDA87E36955B06F58D54B80E4CE18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087315, "uuid": "979a5e2a-1c40-4d20-84de-ddff527458fa", "value": "288c6247dfdd0fa8dfe2dc2cf875fef4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087315, "uuid": "e62ab605-6ae4-4ebf-9577-b29e7373701e", "value": "48:OEPAhG5uuAbZ3iXTQdXuoCZ2FjbQ+btMhCKGzUvqA0QqSeJY8JTah78cIDBc:nP5ubyjQNhCsRbQ+xMuACrC78TD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087315, "uuid": "485e8e30-baaf-45b7-bf27-bd8938143959", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087315, "uuid": "7d49ffd1-6968-47b6-ba7e-9f93e9a9ab9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087315, "uuid": "0b8c1ece-b63f-458a-a7a2-3190217d3b55", "value": "Passion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9914ec-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075381, "uuid": "1aebda46-134c-4e21-869b-1424c5232b37", "comment": "Malware payload (Heodo)", "value": "83d72cc5a4f01e0ef44b8cebb9cc5fb5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075381, "uuid": "fd344cae-7864-458f-8c26-b2f1a3f0f993", "comment": "Malware payload (Heodo)", "value": "b0a13e78350cce119c3b1770e812c827b96f1e19b0189cf034f0363f2f6c7024", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075381, "uuid": "9a7e96fc-ae19-4d1a-aba9-387b407088ba", "comment": "Malware payload (Heodo)", "value": "ee96544f2836ebcfe65b2a03765a97286c73ecdf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075381, "uuid": "ae1d49d9-21a5-4178-8ffb-329a7b101bf3", "comment": "Malware payload (Heodo)", "value": "cf4245911026d07db6a77093b6599589f7a9480d7c08209dbe882676023d1e4ec30f197fd20ed589580d83443cfc0aa7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075381, "uuid": "8c62ecd6-934b-43e9-bb0f-db438052a68f", "value": "T12925CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075381, "uuid": "d4a202ed-6fae-4b55-aca1-9b7353867d56", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075381, "uuid": "021be933-68d2-4dc2-88b3-6a2ca7a2d8ab", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPfFIIm2mHv:exyq2kpWGWRCLWeNWO1tyXFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075381, "uuid": "93956b97-5225-4a45-8ee3-97324682eb47", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075381, "uuid": "403920ea-1874-442c-9426-1c7bc741a989", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075381, "uuid": "2a49c0d0-d956-4d3f-bc7e-687fdf529996", "value": "b0a13e78350cce119c3b1770e812c827b96f1e19b0189cf034f0363f2f6c7024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8d929b-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "c6b973c0-4f0f-4fe5-a216-45cd0ced5be5", "comment": "Malware payload (Heodo)", "value": "e970cfdf10cd8939ac99262b16a7b771", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "bf728e14-3a8f-4684-9b5b-73c5a3cab59c", "comment": "Malware payload (Heodo)", "value": "b2a51cb1d9d87c76c7e84806bb3181a003007ba8271a82207b1715f8575daaf5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "ac28bad0-5474-4bfb-a0be-47d421670fcd", "comment": "Malware payload (Heodo)", "value": "a1c7440d24c665ff1f8936a0317bc5bac2478f45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "03954ad6-669d-4fac-ab6c-689a54ac7cad", "comment": "Malware payload (Heodo)", "value": "cd0af1eec8e44fd38b145b1947e6655501334f2c8cc038b7d2508f7eb89f2ab23a0ed214fdd0a14b31e30e92f0a71bdb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "77255df9-0912-4a32-b5f0-e16d37f34d50", "value": "T13935AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "3c88c924-aa1e-4c35-9cb8-35890672f860", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "eacac9ff-3278-4086-9499-07cab74f2cea", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvToFIIm2m40:wfv1GVFF+765nFvFf6dlzzSMFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019869, "uuid": "94a3b817-5d96-4cb4-8b97-faea63df7aee", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019869, "uuid": "502a3c58-da70-4192-a1e3-a8d0924ad418", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "15be60b6-d513-4717-b55e-b2552ce088aa", "value": "emotet_exe_e5_b2a51cb1d9d87c76c7e84806bb3181a003007ba8271a82207b1715f8575daaf5_2022-02-05__001100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5026942-86b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086720, "uuid": "e4a6e390-0edf-460c-9d7a-c2743da83552", "comment": "Malware payload", "value": "4ab0cac7b6a88138863e19db5177801a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086720, "uuid": "6645888e-8a2a-40ad-87d0-05e361811f78", "comment": "Malware payload", "value": "b3e1842d258c8e873289ce27144138d7b25d10a6abbe01df45a9de4dd1d34079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086720, "uuid": "164475fc-59b5-4fff-acf5-44d533a86a54", "comment": "Malware payload", "value": "393aa9048f2aaaeab2d5951942d8f46abca14b25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086720, "uuid": "8bb4de88-9207-474b-8e33-61260da52e47", "comment": "Malware payload", "value": "11bfeeb02b7dfa49a5a67eb0eb5380d76e302b2e82f2961d818b766ea1642ebd969e3bac74909fea3619a08c6f3f46fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086720, "uuid": "51d46198-10b4-4a62-bbae-8ea903642874", "value": "T13C6633E1AD7474D0D0A4A6B37898693C3BD38D48CE744D60A78BF91628E1AD974FBC07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086720, "uuid": "d42134a9-07bd-4b94-8c94-aa1e7a3c0f6d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086720, "uuid": "419e8928-4e49-41e8-92f2-c2c28c7bb716", "value": "196608:T/WFm1RrhDbhY0hm5zz3zgQHOKVV9kTP/CIVwbFmWdDAf:TzFHWKmR0QuKVV9UaIVy+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086720, "uuid": "d6b826af-549e-45dc-873e-0c7bb1353b68", "value": 7024195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086720, "uuid": "32ff1ce4-36d6-4ad2-98e8-09cafae54aa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086720, "uuid": "b16e3253-ee53-4ad7-8c8f-156bcb8c70b6", "value": "KRAKEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d67067a-865c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644049207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049207, "uuid": "9d9aec35-c237-4a15-b29e-46221e12d666", "comment": "Malware payload (AgentTesla)", "value": "fcc22fd308fdec0b2aae0f52fac056fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049207, "uuid": "7ed4e160-c6b1-4a9e-8812-9999b380072a", "comment": "Malware payload (AgentTesla)", "value": "b530e3a33c49127f6a4142df2ac6fa20968723372d1a984e12e2297bc0c19fce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049207, "uuid": "74c9dc73-7c5d-46d7-afda-fbe3aa1cae8d", "comment": "Malware payload (AgentTesla)", "value": "319a4c3206b85a199e4933ad4f7face530cc57ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049207, "uuid": "cbe338b1-fa43-43e1-976c-1ed456440626", "comment": "Malware payload (AgentTesla)", "value": "1617ce8bcaf3fc233dde455d3b3e4d3ce1d1e5fed018b50e353ad97b0c967c20a82314b17985a44a0e34723b6a546eb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049207, "uuid": "54ea4a63-b247-4809-95c3-78b20db02f9b", "value": "T11BE47C7123A8AF94FD7FC73D632694149BF4E427E316EFAA7E9221CD0890F444A51A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049207, "uuid": "0a87c6cd-b328-4381-a183-ee8e89fa11ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049207, "uuid": "492b96e6-eb57-4f83-ae3f-07f8c92f2efe", "value": "12288:NJMwhIMOpNdghdmD7IIjApsgfkqDXVSlSNzhHbm+9AfIv50vcPD83dhR+CxwT:NlONprghED7PjAegfbDXEluzUEAfIRK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644049207, "uuid": "33f84b3b-09a7-4e60-b9e3-9663ef19e958", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644049207, "uuid": "0bb3d65d-cf09-4c8d-9b43-b5048070f8fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049207, "uuid": "8a62726d-a78a-4ea2-887b-676a06d64387", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd87505-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "482397f8-3e78-4818-81f2-5a23c3e45683", "comment": "Malware payload (Heodo)", "value": "d0c39803abbd9b209e320a725e219a35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "02987beb-c15f-4817-a744-987af538bd8c", "comment": "Malware payload (Heodo)", "value": "b55cfd84e028d252aad173766377f6d50db7aab5be591dfc72cb41fadb940b1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "cb78ac49-4ab1-4516-8750-d5e52919824f", "comment": "Malware payload (Heodo)", "value": "3ee8e09e5cb9af6533c0eeb7375d103c56a6561b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "d13672b9-f02c-42b3-ac19-df079aee653f", "comment": "Malware payload (Heodo)", "value": "84be3d2767b352922d252af224a0f8d6edada786cf7c08fbf39b9583d11be95f8c248fd5c325bec08b8687a76d30dc1c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "5fce66c2-fc74-4372-9224-b7ae3e49f7c6", "value": "T1A135AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "22a5567d-7d61-490b-b7e2-420d6b44de43", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "2d28c4fb-e1a7-4518-a60b-dfb918501d70", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvT7FIIm2m40:wfv1GVFF+765nFvFf6dlzzSPFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019867, "uuid": "3f5aabf0-5ac0-4bdd-8cd4-d7e1f4a84bef", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019867, "uuid": "6e228516-db63-42d9-af4a-029d5275d31d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "4454c6f2-7fbc-4f9c-a542-8066c8c00fdf", "value": "emotet_exe_e5_b55cfd84e028d252aad173766377f6d50db7aab5be591dfc72cb41fadb940b1c_2022-02-05__001100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5e08f6-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075382, "uuid": "41ffd1bf-e348-4561-9cd9-b540575c90d7", "comment": "Malware payload (Heodo)", "value": "7a1ee9a3bd7e28515c2ca76e3503061d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075382, "uuid": "5a00c43e-c087-4527-bd1b-bc62216cf67c", "comment": "Malware payload (Heodo)", "value": "b6651466a46e7f0fa6357a286e9785fcd8e2ea79a57b49a739e56720beaea312", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075382, "uuid": "9b405b8c-5d35-4426-a836-fdf4af03990e", "comment": "Malware payload (Heodo)", "value": "6d32afcf06876980d8c62fa77c4149a3bcf3498e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075382, "uuid": "e6234924-4eff-4000-8a5b-9913bf5c0c5b", "comment": "Malware payload (Heodo)", "value": "7c3b7ad873887a3d29794bce012a4761e7f1541f9319e49f88907924f00cffc4ed60e464c9780c45fa8ad3ca5893f7f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075382, "uuid": "77e5d743-96d0-4e68-b605-e9f8ae5d91fe", "value": "T1F625AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075382, "uuid": "c4b4a34c-5309-4569-b5fc-94f79b8dd850", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075382, "uuid": "4f33cae1-2ddd-4a78-8a31-e80099a48e06", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxMfFIIm2m42:1ZsYB7vLsnZI1Hb9DHFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075382, "uuid": "5be0f0cc-e2c7-4427-9732-48257478635f", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075382, "uuid": "353a1f91-3a39-4a91-a7c1-19282092639e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075382, "uuid": "6373eb53-a2e7-477a-a64b-1193c0fb4164", "value": "b6651466a46e7f0fa6357a286e9785fcd8e2ea79a57b49a739e56720beaea312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d002580-86ac-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644083646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644083646, "uuid": "056cc724-091d-4805-a7b5-66d0383436ab", "comment": "Malware payload (RedLineStealer)", "value": "0be08b56ec9c9b926b336ec062c55eaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644083646, "uuid": "ede3e4f2-b805-46e7-b359-36b35014c722", "comment": "Malware payload (RedLineStealer)", "value": "ba195a9f090cb803df55df40d839f95e335234a13d3207f65efa46c3d0f837d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644083646, "uuid": "71ca857b-acb4-4f3a-8959-0f702c57ab3a", "comment": "Malware payload (RedLineStealer)", "value": "32b1f1e9ee2aee5a239ba8b37f4c7a98046fd44e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644083646, "uuid": "c11c98e2-e0f6-41c1-9b5e-3a05e0a65a49", "comment": "Malware payload (RedLineStealer)", "value": "83806c906f84df60b17dab8afe4683554415ff0f9f94de59c2f1a9fa00f45b6814bed2d058e818117b5b84e92e3945b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644083646, "uuid": "31a03966-2ca2-4243-87e7-1b8505d87600", "value": "T1BB84CF10BB90C035F1B702F449B693ACAA3E7AB15B3594CF23D51AEA16346E5EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644083646, "uuid": "bfd1c82e-f4ff-4782-961d-30546ac74b87", "value": "1a3cf179d845c62d49a765b8e54e41fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644083646, "uuid": "84aba322-21ea-408f-a2c2-4b2cd8185f11", "value": "6144:JbyySzXaaks8VCYfWPon3AK9PNsyHUHzZ3Pi2s2/QCk2g2aTxv6FKr1bP:JUXa6MCYfxn3AcuB3ns8QCbla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644083646, "uuid": "ab933f8b-ad24-4bdd-8590-e09b0e020439", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644083646, "uuid": "9581c5de-f200-44df-be48-29ee8cf4d3b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644083646, "uuid": "bebde034-7cb7-48f2-bf60-a1745c7b8c05", "value": "0be08b56ec9c9b926b336ec062c55eaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404884e0-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644073612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073612, "uuid": "c72bdd5d-fecd-4e08-81fc-89ead333f6ee", "comment": "Malware payload (Heodo)", "value": "a57eace6459aecfa828974dcd036116e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073612, "uuid": "2ba6b26f-ae60-4337-b487-6102f95d34b9", "comment": "Malware payload (Heodo)", "value": "baf46bd42d3de66e3f6e4bfcdf282e588910ed0872ca9cd809c97b3547551078", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073612, "uuid": "1b6ca568-ed4a-48c0-8ad4-05e5d637ce69", "comment": "Malware payload (Heodo)", "value": "0013d75da615de3d93dc9fb43f653c36671aafc4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073612, "uuid": "1be5dab3-7864-4f08-983d-2e70ad4d0767", "comment": "Malware payload (Heodo)", "value": "2959b1d269b43243a70c2bb856406079a1f6fafd973e2d3582236bdeec95884b81d199beab3de7f8cbd6ce98449a01bd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073612, "uuid": "f806be6f-ef5a-4da6-8b8d-9cb38124de75", "value": "T1BEE37C157245E9FADA04233109CB8BFA3627BC434E7183E77249F31E6F776509AD2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073612, "uuid": "2d5fa6d3-ddae-418c-b821-ee4a3de6dd67", "value": "3072:tcKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgX4Lc1:tcKoSsxzNDZLDZjlbR868O8KlVH3yehD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073612, "uuid": "6c0e155f-08b9-4542-aed1-cf86346a51b0", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073612, "uuid": "4f16a7aa-9f49-4230-82f6-b5b174e81461", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073612, "uuid": "73df8588-8709-4c06-bb80-eed5d091cb33", "value": "openaccessebooks.com.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f5e948-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644073619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073619, "uuid": "7ae3e7ca-da39-4965-ac24-de97ce15d5c8", "comment": "Malware payload (Formbook)", "value": "99f1807a23a0e099fa15f6f7c459069f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073619, "uuid": "e8d780a8-d9e4-48ec-b9aa-1e2d1ae8d389", "comment": "Malware payload (Formbook)", "value": "bb471ed6ba36ad162f1d35775942a36b9bd20f03f4d7dc730a921350dfc05b69", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073619, "uuid": "6f910dee-ef31-4c94-b160-af4c8cb620ca", "comment": "Malware payload (Formbook)", "value": "f512dd9aeb04635de33bb19c5f648686f9da7773", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073619, "uuid": "f9c12c71-ef3f-481f-80b4-7ea67965bebd", "comment": "Malware payload (Formbook)", "value": "15eb3f80a1b25138b0c3164340fb81edeba166a0c6797fc48ccef73b10ac2d802f7e2847086aae1b98b40834495e2b81", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073619, "uuid": "5a586336-57f9-4c9b-a6d5-a99a42302942", "value": "T16945129359D894A7D5294B73027393BEC3F8B2021225855B3F2C8F253F1D0D6AEE616B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073619, "uuid": "d50043eb-829b-4adf-852c-52532d515c51", "value": "6144:jwsCNp1mRAeP2C09RxE7Gyl/rD4QVlI0O:XCFgPPSjSGmrcQVlIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073619, "uuid": "90c41d60-fbc6-41f8-ba4e-a5c037359142", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073619, "uuid": "37894d0e-0817-4d9b-8d18-46e00df86690", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073619, "uuid": "440ef731-3c85-48ce-be67-52f4833d4a9c", "value": "Order-807190402-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ef21c0-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088468, "uuid": "805a088a-7d7a-46e0-8ce3-fe3d635de61e", "comment": "Malware payload", "value": "6e8ba64159c0520ecd7781951dd11fca", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088468, "uuid": "e26f602f-ca3e-4883-a981-3b176625ff13", "comment": "Malware payload", "value": "bd2901cb43b873fb0ba5573641a56d24c066069302c7e275555665b12c86a2d8", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088468, "uuid": "74b82ccb-b01a-4109-84cf-63e6d7633ce3", "comment": "Malware payload", "value": "3a176e6646fd14f44074dd9d59122278bafe608c", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088468, "uuid": "46627fa0-dc56-4927-b2f0-c5761e5f26f9", "comment": "Malware payload", "value": "f556d116c6500b0be3383a3d770d0c942b460180f674b441ef338ff3648c06437f97380aa9b6ee04de7aa656e91607a9", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088468, "uuid": "080b0114-9a43-425f-a233-1e71e0a9deb4", "value": "T1B05152497A03CB6660B17AE274D3505BFF7185E12E3044EE7B1885D72A7153C8E581CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088468, "uuid": "37996aed-327a-42b0-a6dd-35e697f718f0", "value": "96:lAl4gXaozDFMo9j3B449wsrwlXAlAzEgamkrqxTqBoQw2QW0a:pgv8497WXATgJ/o0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088468, "uuid": "cc21f81d-4cd6-4dbb-888f-47ba39e4d94e", "value": 3112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088468, "uuid": "e332893b-2ca5-4579-899f-deac44c7ed41", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088468, "uuid": "54c55325-70f0-4fd2-a43b-523b4035df54", "value": "Delirious.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53b30bb-864d-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644042938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042938, "uuid": "9cdc0658-b069-47c8-86f5-7d6d357ab207", "comment": "Malware payload (SnakeKeylogger)", "value": "862cbba53016d572657ae8fac0935faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042938, "uuid": "9afa1bbc-a050-4625-924c-87ff57eab3a5", "comment": "Malware payload (SnakeKeylogger)", "value": "bd8379477bda9b06ae4f495398b182b1ef208d1fd03ca32736a7da30e4670260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042938, "uuid": "ef8c5a9e-c714-4dc0-b2d6-129b86cdc9b4", "comment": "Malware payload (SnakeKeylogger)", "value": "41a8b4a915ac441b7106a1962cd373e13bc7b0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644042938, "uuid": "11ee9da1-9c3b-4d1f-b9c7-a42ac402d7ed", "comment": "Malware payload (SnakeKeylogger)", "value": "2928dcbba7bf5a87ac6d0bc048388dcf4cb0cd05b79e5011e18c93ea0880a8e9c74cd8631048f27124c65aab30836f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042938, "uuid": "aa28b4e5-19d7-4e20-94ec-56058e760cd6", "value": "T1BEA4BF9075B98BE1E43E8BF8152D7CA007F1326FA4D6E51E0ED961C66AF4F412A44E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042938, "uuid": "1c35c41a-0723-4e7e-9b99-5e3286ae22e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042938, "uuid": "28feef0f-b04a-4996-aae9-5088ab67d184", "value": "6144:hBBVoIYEX5OCNbO+RnDZFiae+ONNfv2SptsFrysQL1kN8cF2Exoo7yTa:JVoi5OuRnDZ4ae/Npv2S/sFrEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644042938, "uuid": "ce07ce2f-c824-491c-8819-6ce8f6f3f7e5", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644042938, "uuid": "d5d32858-71fe-4c18-9cd7-16e4d214f7eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644042938, "uuid": "9db62d33-058f-40b5-a704-b52f40e0b716", "value": "BE415054 NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a0856f-8634-11ec-9275-42010a9c0029", "comment": "Malware payload (Meterpreter)", "timestamp": 1644032222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644032222, "uuid": "5ea6eb7f-07ce-4a89-a421-5c2468a8d10d", "comment": "Malware payload (Meterpreter)", "value": "0afc6fd75ca56057cc9b341319cedd94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644032222, "uuid": "f1b18515-8acf-4477-9d0b-4edbb4c88d61", "comment": "Malware payload (Meterpreter)", "value": "bdc9b4576df059ca895dc4f4d5491059ed86f74fa9b99ce5e9465476c4f6d9b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644032222, "uuid": "351c4f6c-dfde-4d59-87bf-59954f6772fc", "comment": "Malware payload (Meterpreter)", "value": "717497a06a74f8ee04a9a452e35f11d21ee36aa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644032222, "uuid": "65a88c2b-7ae4-47cc-a9ef-37c03efe123d", "comment": "Malware payload (Meterpreter)", "value": "f4a943230139deb063cf5146e5e0daf120809685d8c07ee35b512be196d1d32368946d6e5620c2efaa131c6083598a67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644032222, "uuid": "d2f0efdd-8e61-45e6-b196-388fc476d493", "value": "T1A0E1652377004CB6C45C567546E3FC77729969683B7753B74A4C02163A5252412B5E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644032222, "uuid": "908bb19f-93a3-4eff-af61-0281f3252d0b", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644032222, "uuid": "d954e531-d36f-40e7-9c76-ebcad3860853", "value": "24:eFGStrJ9u0/6IgnZdEBQAV8aKq9K9qCeNDJSqUmZEWdXCIGDpmB:is0tUEBQpE9ISDoqUjWZCSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644032222, "uuid": "d1760061-c88d-449b-9de9-0ae9a28a3f5e", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644032222, "uuid": "baa60496-02eb-4401-93b0-99cb704f5e0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644032222, "uuid": "a0425baf-8a74-4ba9-9ea5-ff1dbeadd3ed", "value": "0afc6fd75ca56057cc9b341319cedd94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60bddeff-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075385, "uuid": "c226248f-4531-4aea-a690-509654411cf0", "comment": "Malware payload (Heodo)", "value": "2275e17390c0cc78b28e2366e15fa344", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075385, "uuid": "f9df369f-ec21-4ad2-9c2b-f3f051fcc9e5", "comment": "Malware payload (Heodo)", "value": "be079fdf34a3de655bff626121864f28204e2694e55e754dd51c272aa7e4161b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075385, "uuid": "6c0f21b6-7bf1-4380-9f77-bdb439eaccc4", "comment": "Malware payload (Heodo)", "value": "d6cd6504bd30fcaddff21238df22e622cf5dbfac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075385, "uuid": "dd0697a9-926e-4a09-93ac-0db1ec6a9b86", "comment": "Malware payload (Heodo)", "value": "2a9f0dad57c3dbdde6dde589d1d30b089f1bda706c94cc5941a3d71c9f0ff0756980ec597ae488da666e56629be3d1d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075385, "uuid": "3b3a8841-826a-4955-973d-86d6dac9a0b2", "value": "T11435AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075385, "uuid": "f07b3687-e68b-4f80-a3ce-131d1da04950", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075385, "uuid": "36411cdb-f5fe-4001-93f5-99eed9d544ce", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTlFIIm2m40:wfv1GVFF+765nFvFf6dlzzShFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075385, "uuid": "6306878f-fe28-482a-a171-cfb0b9e393e1", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075385, "uuid": "dee99ad5-80fe-45b0-8c47-c4f80ed53ad6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075385, "uuid": "47b87196-4e27-4350-baf0-12f60e5b3ccb", "value": "be079fdf34a3de655bff626121864f28204e2694e55e754dd51c272aa7e4161b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85f2d52-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "69b0f0cf-f25d-4057-8ec9-721e94595a38", "comment": "Malware payload (Heodo)", "value": "8e02887e8dd4ff7032a54a52e49c384a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "35476dc0-222c-4cea-91ce-8a5bdda73100", "comment": "Malware payload (Heodo)", "value": "beef1d47ca208a02f4efc25adc27f8200ddb8d24e58ef28416a462d1d3c553a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "9e1d45a1-cee6-4222-8b51-0982eee3fdc5", "comment": "Malware payload (Heodo)", "value": "2e6b29d3fd755815fd1acc4057db42167fb8513f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019724, "uuid": "d648c09d-a64a-4aae-ae55-caa209a4e151", "comment": "Malware payload (Heodo)", "value": "0112ae461fed3be8d92cb8f49c5ddd925c25089a3c283d4a56119c7f84aa96269407bc805860007b84afd5681e525df5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "88aa14a9-67f8-4dbb-ace1-ee65be938eed", "value": "T19F25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "db4b09f9-02af-4f20-ab33-06d7aab9d353", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "fc1d4343-5849-4042-8df7-1851bba27813", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYx3fFIIm2m42:1ZsYB7vLsnZI1Hb9DyFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019724, "uuid": "d2aeed6c-f3b6-47e2-bfd6-6a7b67d92467", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019724, "uuid": "f953b27c-33d5-488c-9576-10a27fefa29d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019724, "uuid": "a6452759-84e0-4f30-a832-313a005c5c28", "value": "emotet_exe_e4_beef1d47ca208a02f4efc25adc27f8200ddb8d24e58ef28416a462d1d3c553a6_2022-02-05__000836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ad0da6-865f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644050642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050642, "uuid": "b3bf4bd0-97df-4cb4-b220-4e5297b34802", "comment": "Malware payload (AgentTesla)", "value": "d8042c08042ddea0bdb4058a3560d41e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050642, "uuid": "db22c384-7627-4e5b-b520-7f4125f81b36", "comment": "Malware payload (AgentTesla)", "value": "bfe2be210318bb81e0452bb2aaeb256c88773b53156da0fee351fccdbf46de4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050642, "uuid": "cdcf19c7-8b69-4349-a80b-fbcd9704bfab", "comment": "Malware payload (AgentTesla)", "value": "4edd87c7160ebc9a25f56602471ed38e61b01ea0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050642, "uuid": "4db43386-7cae-4ea9-b065-dd38b262d15d", "comment": "Malware payload (AgentTesla)", "value": "24ff4ae340dcddbef69bacdeaa01a3a2e5fe535619cac985a3edb327049f4ce697b924c136e564e847172295a88f9975", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050642, "uuid": "982f3102-6bfa-4cf6-afdf-0550614192d8", "value": "T144C4E19075B94FE1E47E8BF8253D7CA007F4316F98D5E91E0ED962C26AA4F421A44E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050642, "uuid": "f055092b-06ca-444a-afdc-2fcd5956c6a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050642, "uuid": "6f1a9243-19e0-49c6-b7db-884425e3161c", "value": "6144:g8EPZVoIzUuAOxN32kkB248hnHAT8YUpJujxu3yIZ9+mDMFw4fzempSoqN5G7yTa:MRVoPuAOf3jpiT8YGL5MW4fzRpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644050642, "uuid": "1c368dd7-193d-4caf-a0a1-86bf2e7a40f4", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644050642, "uuid": "7834d03d-ec0e-4ccd-a8b5-c8bf936d266a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050642, "uuid": "bc671296-b253-4fb8-955d-15c60867643c", "value": "ETD - shipping invoice documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5f1e50-86bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091084, "uuid": "a60f9cc9-35d4-4cec-b8fd-948d578404f0", "comment": "Malware payload", "value": "de34d735d30bd0e107e14bb6aa8bf3e0", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091084, "uuid": "68265cfb-3402-4b93-b6a0-095c6cdb8367", "comment": "Malware payload", "value": "c00b0dfc5a1025f202e05202361d2557ed860238f51692337122d42a889cf412", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091084, "uuid": "75de5212-6801-4bc8-87f3-0568bdad26de", "comment": "Malware payload", "value": "8d976194e4ae851e0408c53f0db41f9c6f994a46", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091084, "uuid": "ded2e777-8156-474c-8394-01e045ea1c5e", "comment": "Malware payload", "value": "8b5a082afa4b90d3075074171fc388bd8401d63b47413d8f73d58759da6c49e82a52eb4136f2938cbf04216911745a56", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091084, "uuid": "c64cc9f0-d5d3-4a0f-8206-f413f129cd38", "value": "T1EFC123C22F02D2BDC1F185C360C1DC49E66003F6CF394C993A68CDB79B299ADEE58599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091084, "uuid": "dc3553e2-6c63-4244-b0d1-754812029bdc", "value": "96:fA4D2iMzdd9b0ieOHd/jSi5GwEzA6WgbccDXo+jAk8TcA23BMAbS46AA0pZB0Pgy:vLMxd9zFyd7CljG0gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091084, "uuid": "712284f9-d74e-42b9-9a63-3026fa2f8c0a", "value": 5770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091084, "uuid": "9518b4c7-fcc9-4cf8-8ce7-239f03d6c9a9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091084, "uuid": "6468aded-a6db-478b-a62f-93eb8262084a", "value": "xchange.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd91724-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087082, "uuid": "9d874376-3a39-4b8a-8257-ca75abedb712", "comment": "Malware payload", "value": "722436ae848608575bdf5d7036f3d1a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087082, "uuid": "1fd061fe-3e5d-4e2a-9bcd-e4dcd5fa8ad7", "comment": "Malware payload", "value": "c052cf59d1d8ddfeb3a75ef2bba81c5b1963e44c31c1e24610297761b68c0798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087082, "uuid": "d5f28c45-8d09-4e5a-b1ff-5919d4d548e7", "comment": "Malware payload", "value": "ca97b2f3ef477f327875b1373f14a34b88b565c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087082, "uuid": "ee6e7783-1dea-4caf-bbee-dfeb8d09f46e", "comment": "Malware payload", "value": "18ea356b1c59c735f8ac61c8471dbb24d100b9c1288c3044bd3f9d5b05d55f02c9a42b25bd90cbfc3183fb3c3a2ad832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087082, "uuid": "80f7e736-8636-4c7b-9444-4fd73370d6e6", "value": "T175B14C0F36408AF9C0556EBA8D6711A5D6E3B4346666A1730DFB2E3B00CD30E84DDAAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087082, "uuid": "7d8f0a50-b246-4e66-8f33-094e6d11adfd", "value": "c5705d8786b1abeb038125a9abf04d1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087082, "uuid": "78227587-f1b1-417d-8b61-41c8ba1ac687", "value": "96:/Pb6INK7bgg06rTnChC1e3o+Wbf9xxwIoJJVhKNOuQ:/e7Dxn2ce3UbPC/gOuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087082, "uuid": "bfc1faac-2046-4607-92a6-1e296f786844", "value": 5192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087082, "uuid": "33bb4a3a-a4bc-4523-8c89-b1535a63c7b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087082, "uuid": "b95442f8-bd7f-4b6d-bc63-af6a203a74f3", "value": "haram.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccfa44c-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "41590c00-dfe3-424b-9e45-da83c0d47265", "comment": "Malware payload (Heodo)", "value": "134a4c391ed150788cec1a437a227703", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "fe6ca4b7-be4c-4138-8940-aa6b43ee2c52", "comment": "Malware payload (Heodo)", "value": "c0ad65495da426fd3f4b1f42541fd2b898aad035e980b049a85ea54487bcaaf7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "c58e45fc-bcf1-4370-a2b6-cf3eea5f0f3e", "comment": "Malware payload (Heodo)", "value": "25b57e9207d4c05df022898426513ed2aca0143b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019866, "uuid": "95a5116d-e9f0-4c7d-8734-8e4e20b3bf9e", "comment": "Malware payload (Heodo)", "value": "5ce95b6ad8fef10663fc32c4600a0fdf5bc5249d678233a6372ec4885f4421dac9065fee1f1b6fdb3ac8759a2e9f55f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "8e3eefe3-c07e-4570-a4e7-4c585dcef753", "value": "T10235AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "18780811-e2f7-46ea-90d6-3517cd1374c1", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "0ce5ccfe-b056-430c-9140-89c2f4d41845", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTkFIIm2m40:wfv1GVFF+765nFvFf6dlzzSgFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019866, "uuid": "2f409ca5-9fe3-4874-a1fc-627016868e6d", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019866, "uuid": "266a5855-491b-4d65-a81e-165fa111cdc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019866, "uuid": "c745d981-7ecd-4f8e-b4f2-4778c256ed26", "value": "emotet_exe_e5_c0ad65495da426fd3f4b1f42541fd2b898aad035e980b049a85ea54487bcaaf7_2022-02-05__001058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3413cc8-8680-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644064866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644064866, "uuid": "662a7c55-aeb4-4547-8d73-0e532b2e5409", "comment": "Malware payload (RedLineStealer)", "value": "85e2e6203a4688cc13c6df9960e03a2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644064866, "uuid": "f3f97ff6-d59b-47e4-a135-ec3651ed2f59", "comment": "Malware payload (RedLineStealer)", "value": "c23f8fb51280ddaeab80bf54bf24d8232a5a02b5cbc2c4750c67a349efdc60c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644064866, "uuid": "5bd84d09-fd35-477d-bfa8-a597168d992c", "comment": "Malware payload (RedLineStealer)", "value": "27ac434a7ec076af3ee2f69c02c68c2f52338d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644064866, "uuid": "fa89c295-39c2-4ef8-9aab-c47ce772ed44", "comment": "Malware payload (RedLineStealer)", "value": "cae266adcefaf5f4ba9f3cbee10df00632f6b1ff080b2a37ae5a739b9e9a2a612aafbfec483d2a9c1e1b396e12965a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644064866, "uuid": "dae49e3c-788e-48b5-916e-5cdef23f471d", "value": "T1F9B512392168A079E071053654B2CD3E47F76C5232187B9EFED01E6B3610AD365B2ABF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644064866, "uuid": "1b673420-ea3f-40f2-9d84-2313f7f4d89c", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644064866, "uuid": "aae1b1d9-bda5-4234-b3cf-8d7d7e44a7cc", "value": "49152:6kQTACZxr5tLi5giYqfcDakWyiGtodQvTJSySgNPH9R63jmJdSVZyUf7:6a+rfL1+fcDr2IoQvTEybNPHr/dS3yU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644064866, "uuid": "e6dcf5cb-acbc-45c8-9f47-41499de24546", "value": 2444288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644064866, "uuid": "5ddfbfab-e6ef-4d34-8af1-96131079db9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644064866, "uuid": "105dfe8a-c979-494a-923b-ca947561d303", "value": "ShpatelFreeSoft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cf928b-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075387, "uuid": "31db664b-44f1-4dd6-a604-a67bba9f9563", "comment": "Malware payload (Heodo)", "value": "9c8fd012d1ae254238681fd189e781b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075387, "uuid": "3a76fb02-9456-4f6a-be65-afff8308a828", "comment": "Malware payload (Heodo)", "value": "c263c2922693c8a64e36b5482a78ec07c469a69c02835cfcf0d760d105401b30", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075387, "uuid": "deb17f2d-3227-4206-adae-469054819734", "comment": "Malware payload (Heodo)", "value": "dfdfd9f56fed2d3b7ecf3f6db61ba53300111e8e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075387, "uuid": "53f2df94-04e6-4e65-8fe5-2a8f7cc0ed60", "comment": "Malware payload (Heodo)", "value": "dba0fce37f9915358f8bdae8bf2cc459ebecf51abc57ee74ca806e43aa2a9f7bb1c5ca007887816b00955ea704fe211f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075387, "uuid": "2b97d521-449e-4822-9694-92e0aea815be", "value": "T13F35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075387, "uuid": "facf33e2-aad6-4bd7-97c3-ce03c491f2b1", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075387, "uuid": "cbcdf9da-5d0e-4b53-9082-d794a2d5c852", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTXFIIm2m40:wfv1GVFF+765nFvFf6dlzzSbFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075387, "uuid": "e210763b-4bd7-4f70-aa4f-4a6c0647b2c3", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075387, "uuid": "c9313a8d-87f2-4bd6-aa94-7b3c759e8642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075387, "uuid": "5f6dcdf3-8bc3-44e0-b719-6bccb10ee10c", "value": "c263c2922693c8a64e36b5482a78ec07c469a69c02835cfcf0d760d105401b30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63250046-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075389, "uuid": "e5e90f0c-bd68-4727-9686-3e0b7b7b3043", "comment": "Malware payload (Heodo)", "value": "d9ce7f1f5517f0b346805d86c48deae1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075389, "uuid": "a3f9b37a-f0b8-4231-bfa0-578a54e5fab0", "comment": "Malware payload (Heodo)", "value": "c2ddc1c90a97bb08464c46cfed30c2cedd5d63b27eb8d69b0ada3826f18db4fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075389, "uuid": "5dfbbcb3-db2c-4104-b54f-422209850cc4", "comment": "Malware payload (Heodo)", "value": "5cb4e7690f7e396d32bff6eb6bda0256acf085c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075389, "uuid": "907c997d-98fb-43b1-8c19-7735c869f30b", "comment": "Malware payload (Heodo)", "value": "2100aaa069ea96b29f3258ac559018825026da37c11da27a9ba0f08ba63f15e5d88636a67ab322622135ddf95e3ae49a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075389, "uuid": "75dbf537-afd3-4a78-85c3-042397836aef", "value": "T1DC25BE516E9A91A5FA0B247E00AA73470FDD791117E0E8CFEF44F5A71F21CC2963889B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075389, "uuid": "9983d693-eb13-461f-bfa0-6cb84d35a5af", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075389, "uuid": "5afa853f-a3c1-4646-af94-eeb06f26d0fc", "value": "24576:vGvafwy8HdhFsvdjNxcnsnPMf9yoro8ult+s9CdRP332L6DFIIm2mm:vBft89mjtMf9yok9lgdZzFIr2mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075389, "uuid": "a8e0ea04-cf20-4906-a485-1faf51ef71ce", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075389, "uuid": "550a326d-963a-40c0-b48b-14677e9f6b68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075389, "uuid": "9e872fea-2b12-471d-886a-317799b8995d", "value": "c2ddc1c90a97bb08464c46cfed30c2cedd5d63b27eb8d69b0ada3826f18db4fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f1c3a1-86bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091931, "uuid": "be91db32-d422-426b-a606-648b36809100", "comment": "Malware payload", "value": "0b6d3ba97c607d4c334e45fda1907912", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091931, "uuid": "88aaba06-2df3-4457-96f8-7942b69379c3", "comment": "Malware payload", "value": "c3b412b22bfebc7b5b3193ce249e51c1cc42f78e486cb88e604a7ff59da805df", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091931, "uuid": "03fbeab0-7f0c-4abf-be5f-3f0201b91962", "comment": "Malware payload", "value": "826552b0aa5837a1c4c205d8c980d103deaafc01", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091931, "uuid": "ac0476a5-bb72-43b5-bd7c-6c4a384257f4", "comment": "Malware payload", "value": "05504836b55c04c219fb18c6c26b0a6309cb93de5bd3ce35d102950edda9e153653ca10a4fe1cb3561c7e76bfc1ddb3f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091931, "uuid": "60afe51e-d462-4321-a3f9-f4fe558e5126", "value": "T13603314072D5EE17E99562310EDACBFA77797C41AE02C25F7084737E3C3AA648BA1781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091931, "uuid": "938ca053-f5e4-490c-be13-e15f00e96166", "value": "384:TlABtmEON4uleA5s2g8uy3xHA551uuUwXuH30jnwXps:TlAYePNJy3ZUUwXAswXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091931, "uuid": "2737fac1-f0f7-4d51-a722-abba6bb0118d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091931, "uuid": "4100fd4d-85ea-461f-a685-4d65a9426df6", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091931, "uuid": "a82b1c78-43cd-4e46-9ba7-63ea2f64216e", "value": "ApiWord.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3d659e-869d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644077201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077201, "uuid": "51ed802e-ffbb-4fa2-a5ff-eed4e9075bc1", "comment": "Malware payload", "value": "03851a2a3ee21b1d36e1917e4596bf6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077201, "uuid": "e81d79a1-862c-4172-86bc-b30e293f205e", "comment": "Malware payload", "value": "c41d9c68c367fdf7651d35bc0d85b950681ac26df3f65a05bfbf9af19d3dd368", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077201, "uuid": "a5ba0aa9-924e-4f26-a0a6-29583eb059f6", "comment": "Malware payload", "value": "74bcfd6ff268a2a5be55442fd87e405d15915378", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077201, "uuid": "f2e62c28-d898-4da3-b53c-0782ba5264d6", "comment": "Malware payload", "value": "0950247cc29eb4f641ad5bad72cb909b8a19362a79eaa8cb735bc5cea99fbe34d98f34a2e05b3fb87dea94cc93cd4be1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077201, "uuid": "11e074a1-d40a-4b67-b417-6818cf19f138", "value": "T1F1E5330471645C60CA84AEF0F3EDA2936D40D20A91F1077E3F6A5D34992BA4BBE27D77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077201, "uuid": "49e48aba-52d8-4df3-ab12-2a8897f53c3b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077201, "uuid": "e7c44687-e902-4e83-9314-ea177eb25cdd", "value": "98304:eQ+Oi/rXsWNj0rgKquY/hESzLoKOyM91l24No37rj+RK:eQniTLNj0kDuYqULoKOB91l24aIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644077201, "uuid": "11e9f7ca-11de-41a4-b275-17776bb897a2", "value": 3252413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644077201, "uuid": "d3f41e39-06c7-4992-b252-67086dcd126c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077201, "uuid": "2c75a997-f8f8-43fe-a30d-0a24daf26b3f", "value": "03851a2a3ee21b1d36e1917e4596bf6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e1f546-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075390, "uuid": "ed07202c-90a8-4100-8f14-8b10e95fa5e6", "comment": "Malware payload (Heodo)", "value": "91e53263f6e465bcfca50b675cc66072", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075390, "uuid": "63576c43-28fc-4f7b-9042-1735e6fe1531", "comment": "Malware payload (Heodo)", "value": "c44b09a7920588fce1be549bb10e03b82a95773f48d446590f9ab83be0070ec2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075390, "uuid": "3dbf0eaa-77d1-437c-b790-772091b42c30", "comment": "Malware payload (Heodo)", "value": "4f7b6c81ea6dd1bcb8c2ab256488768e8795a395", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075390, "uuid": "c3706e21-b750-4d19-be42-05274dbc6294", "comment": "Malware payload (Heodo)", "value": "e1475fba6c7e0aa91099237fdfd15c4bc09c9364505b6993f6c7f1cdb28d9bf80b5ae132796b65e7dd13955f65b638ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075390, "uuid": "c28baae2-0747-4429-a79c-6cd5abaeb7f3", "value": "T12B35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075390, "uuid": "6c8a0d5c-9b02-4203-8b71-207b52d8ad2c", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075390, "uuid": "1f8f5287-3647-4cb5-86d4-c79627708f8c", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTyFIIm2m40:wfv1GVFF+765nFvFf6dlzzSWFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075390, "uuid": "581d8795-4704-41a2-97a2-2d7d5576b8e1", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075390, "uuid": "b64868d2-e8a4-4f89-b6aa-05a4ccf6b771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075390, "uuid": "ebfa4d11-21ef-44e1-9eba-9f044b462e51", "value": "c44b09a7920588fce1be549bb10e03b82a95773f48d446590f9ab83be0070ec2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e81051-869d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644077140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077140, "uuid": "d7cb1566-4068-4b84-b380-08ae6cea1e7b", "comment": "Malware payload", "value": "5e11eddc26f0c2c322738ed976395cc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077140, "uuid": "cabb044a-04bb-4897-9746-d3e2bc1a7292", "comment": "Malware payload", "value": "c471a7d1efb47a817be82dabe73c69c038600746fc2945f5434363577d98448b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077140, "uuid": "b62430d0-958a-4c98-9ca8-1f3517369e87", "comment": "Malware payload", "value": "c56b00cfabca05e63f35b4b8ad4d0951a28a9948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077140, "uuid": "fc1caf4f-5fd7-40cc-bc08-adc3ad6ca4fd", "comment": "Malware payload", "value": "f14ebe7130c1ef5e9cf9f5e4dd5f5bf6692e0e42035b31de8caa7da2da4f8f099a30ac7e59a7902f713fef329e95c5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077140, "uuid": "24d00c15-9fc2-4e65-b3c3-9573d068d270", "value": "T1CF5633C85FFA601FD405B7B2AC6F0B2CFBB777412B25CBFA1448DCAC244949621A7A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077140, "uuid": "042764d7-17c7-4c8e-98db-52c9edf2f34c", "value": "08ce2bb5c289c22487015109b09aeba3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077140, "uuid": "02578bbf-fa65-4ac0-8b8b-d0a77cec55b2", "value": "98304:LmkYqZGt64MdUvutmMOmNn+8Ehwr3prda8yXSoEe7g3jJ+1eipzrTk/CYzeM0apJ:L95GaKvuM7WnLguprrfe0jgLnQ5yrawU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644077140, "uuid": "5ec46226-408c-4b8e-9b70-bfde7fc5a6f9", "value": 5923542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644077140, "uuid": "a0ccdb0d-a6df-465e-84c0-2516c9bd972f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077140, "uuid": "aa30992b-0c6e-4e48-9e62-f51503644d16", "value": "5e11eddc26f0c2c322738ed976395cc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2bbad2-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "9a5f6a24-daed-41ab-8322-66a7385ed1c5", "comment": "Malware payload (Heodo)", "value": "73e40201f476206b44bf7782b453b3a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "9b5bb763-aa87-4cb6-9e8a-00a2215aa235", "comment": "Malware payload (Heodo)", "value": "c5757027465eff3002389a60ebcfdcc849d34ad450fe6b44912f585e5f75f238", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "32666045-b090-4bfe-ade0-6d9b400b6187", "comment": "Malware payload (Heodo)", "value": "d62741a47d0d364f3526b00d2cf69256c00dec97", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "287ae79b-a32e-4505-bb13-e8269c2d2a8c", "comment": "Malware payload (Heodo)", "value": "83a368139777c162b8a37c675fcaae4fd5aa7c6d56437964f69560afe0fdc15a8d53f5f6023436cc2a7000c171da3f47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "b23dd1ec-828b-4ed8-9951-84a7e61f1888", "value": "T1B835AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "78cbbf31-ee84-4ba7-92e3-009380c280da", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "2b8883b0-d1fc-4586-891b-0e74be40a4c2", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvThFIIm2m40:wfv1GVFF+765nFvFf6dlzzStFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019868, "uuid": "89eadf76-af0e-4559-ab17-09aa20979e9c", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019868, "uuid": "26c279a3-e79b-4863-88d2-7f53c64db3cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "c237f2c3-9318-44e8-9e19-13c50eb21289", "value": "emotet_exe_e5_c5757027465eff3002389a60ebcfdcc849d34ad450fe6b44912f585e5f75f238_2022-02-05__001101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb64dff-86b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087619, "uuid": "439b4e21-9867-4973-8069-8e8fa4c4e8bd", "comment": "Malware payload", "value": "61ed2fc0c60eac81856e07055621b5aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087619, "uuid": "d99bb748-b13f-4452-8728-41ff4fe20136", "comment": "Malware payload", "value": "c614ce8516b1b5d5d36d23e9b7104c48895d6cfd7cbb4188ebd9d19d95d74731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087619, "uuid": "0d49f0f9-caf2-4f17-9c8e-24e24215c865", "comment": "Malware payload", "value": "f172dd91c6e866ad0dfdafd9ea8d6412cf66c42e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087619, "uuid": "3a60d428-4f2b-48e0-91de-a7707236717a", "comment": "Malware payload", "value": "61abb699f81db2dceec82851879771fdf12b9683266634477c01f803d507080349d032501997da66bed01cca9e8313e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087619, "uuid": "17f80b54-6f7e-46e4-a47b-cc82be066f7a", "value": "T1A0F1A5577E8098C0C9E19AF416F50625C4A4F1701ABD53098BE8CDC56B7A2F5CC6CB4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087619, "uuid": "52231405-cd98-4285-a34e-9c28b8d3bbc0", "value": "2bed10be40d7d6bfd1144872c41e1720", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087619, "uuid": "f6797893-3129-4f32-8ee9-fe0fe767a717", "value": "96:nPxmG5KmKdvKNC1j077fZW+fCFXXFvcyIIHF:n5mG58dve1SvcyIsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087619, "uuid": "71058a6e-9a54-4fa5-a1b1-c401e85ab37e", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087619, "uuid": "b24b7dc3-c005-4eac-ac8a-cedfdab4e915", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087619, "uuid": "6fa129a6-b1a3-4b04-9c1e-3066a2d36bd7", "value": "ie042601.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25e5346-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088514, "uuid": "d79115a1-75d4-4330-9b79-ce0b5b703a4c", "comment": "Malware payload", "value": "cfa6d1d7f6e6223bfdf9ae6350cc05b0", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088514, "uuid": "cf305c2a-27d1-4826-8214-32a690cd5a86", "comment": "Malware payload", "value": "c67e38cf7b37519d8663d89f16f5a170e42e76938e6712837dabcadc5af0cfe8", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088514, "uuid": "fe61c3bd-bb8e-41f6-8554-35e971a57e05", "comment": "Malware payload", "value": "8d988bc367ce0b20adcc177f2b73764a233d77cb", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088514, "uuid": "655aa531-5069-4f1a-944b-4e0a2e1823e2", "comment": "Malware payload", "value": "3ec6849a53937db8beb36682397c58f044ffbe152500b6a2466b3832e1d6e3c6a15e32c45e61f9c8464824dfd20702e9", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088514, "uuid": "a6de63f7-6d9d-459a-babe-255427fb00a4", "value": "T18D5167196D02788E51356DC3BCE0C869E43167F3DC280CB86750CDF7987A6ED6E78068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088514, "uuid": "3f56aba5-ad24-4f15-953a-931c5f390409", "value": "96:vAzdNlUAM87BvoAAtQtQqKoO2G6SjttGXn8X5kf708WlWXojrH:2NluzvaPKr6SJEukQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088514, "uuid": "0cb7b02a-2359-4cb7-a253-99ba088e080e", "value": 3107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088514, "uuid": "283f9838-c83d-4711-b750-29c1d9525fe3", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088514, "uuid": "a37cc084-0aa8-4362-adb3-0bc953226610", "value": "Park.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653e1462-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075392, "uuid": "c07bf139-6084-43dd-9dbb-a71ae59f0e7a", "comment": "Malware payload (Heodo)", "value": "983327ba8f3dc9d5d7823e48db22d2a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075392, "uuid": "58a34162-6f19-494b-a2c7-faffd9a6b94a", "comment": "Malware payload (Heodo)", "value": "c6f145ec9b8631273f0f22eb94514ffb205cfb34984f847c9d1bac2abc9c8aa2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075392, "uuid": "13ed33fa-35d7-4120-b5f5-9b2cd5588d3a", "comment": "Malware payload (Heodo)", "value": "c305279184469d0c1b613466c3bd4f31af4d918d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075392, "uuid": "117c2f34-680d-410f-88dd-9cd37f1e5a54", "comment": "Malware payload (Heodo)", "value": "63b6524901d79b4c2599d3e53b7cb1ada8450fd0464a9c1d276ac6b555a3c03d8ede49dfe95dfed10cc123ed4950a83e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075392, "uuid": "f5cf70d6-13e1-4fe0-aec9-c4a52218e78d", "value": "T1FF35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075392, "uuid": "e65cc7d9-7bfe-4aaf-b747-671ef2f9389c", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075392, "uuid": "8bd2bfc9-3c98-4b49-97c5-547d48bceae2", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvT+FIIm2m40:wfv1GVFF+765nFvFf6dlzzSSFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075392, "uuid": "0ae669b5-5afd-45c0-993d-6a73b1527027", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075392, "uuid": "4a20c54c-2a5e-48c2-91e0-36eb182a9972", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075392, "uuid": "b6adb3a4-0f27-454f-bd5c-d73cb9c9d03c", "value": "c6f145ec9b8631273f0f22eb94514ffb205cfb34984f847c9d1bac2abc9c8aa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f97ba39-86dc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644104186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644104186, "uuid": "9fe61f57-1286-4868-b79f-c67761dac1c7", "comment": "Malware payload", "value": "2defbb7f20ad741188cffa3715cfa749", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644104186, "uuid": "89bdc40f-9c64-43f4-8ac3-30827c824363", "comment": "Malware payload", "value": "c87c9e00e2916a8c838cd4e449bfc91a7710314da2ada46f9e6a3395caefa598", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644104186, "uuid": "35f5370d-40ee-41ca-b58e-777f09b0cf82", "comment": "Malware payload", "value": "c70981ca571c9cfbbd64edb134af0afc440b8e6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644104186, "uuid": "e3b3bd35-fd05-4a8f-8801-41f1309b0992", "comment": "Malware payload", "value": "8458792bba1f5ea6817c0ac1ec78fee8bf5b8436e156e7ac0865431411523ab55cfaf313282c562da752692a140ebd7c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644104186, "uuid": "0d0b7a21-b214-44ff-a929-b43f32bb0e84", "value": "T1E4C47C3C61619C30CBBA28F765F956E7C18F6C768BDC1A9B5BFD11272D38E808934846", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644104186, "uuid": "edeb8894-143d-4879-a69c-5c473c1dc965", "value": "81bbe15a668dc4ae3d5f7e44db90ba82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644104186, "uuid": "bf3d22a4-5ccf-45e8-8752-f983f4d79d92", "value": "12288:BKx9m9TwSW/eFj5PWWWWpUUUUUUUUUUUUUUUD69OiEqHtMagzE:BUmhwSWW7dLtMago", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644104186, "uuid": "0272dc71-b70d-4cca-81f0-242358be6989", "value": 575790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644104186, "uuid": "df9cfd32-5646-4eff-9a06-a9b8fe711af7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644104186, "uuid": "51f8e4b9-66b3-4a70-8f6a-4ab4c47927bd", "value": "emotet_exe_e4_c87c9e00e2916a8c838cd4e449bfc91a7710314da2ada46f9e6a3395caefa598_2022-02-05__233621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a192ca-8649-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644040904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644040904, "uuid": "c1093859-7fee-4e04-9493-33a513bdb778", "comment": "Malware payload (Formbook)", "value": "f0d6685e51ab75d3585212478055cb22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644040904, "uuid": "4a2a0402-c80c-4c5e-87e1-d09443ff2b70", "comment": "Malware payload (Formbook)", "value": "caaa240601d0e42acb112b2c61f1f71cb12348f77259c8c98cece75735dfc1e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644040904, "uuid": "5d545580-59d6-469f-86d3-5d095d6de438", "comment": "Malware payload (Formbook)", "value": "11cc87018e7dd4620e7b824012f40cac0a1f367d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644040904, "uuid": "2f0a9658-1680-437f-96ad-c08c48a0888a", "comment": "Malware payload (Formbook)", "value": "5ef49225296f117f8ae10dfe9c01ba700660be09af81368396591b1a1a6cc87deab401e76987eecce84c2c865ccaf7fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644040904, "uuid": "3562e61d-3fb4-41e9-b02f-7992740f0878", "value": "T12294BD2EF1DCD8AFD47736328C3AA55EC5B65E8C6D26051B36723A0E23700C375B5A92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644040904, "uuid": "c37ddbec-508f-47e4-8739-a3eccf9bd0a0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644040904, "uuid": "91dd77ad-b070-45ab-bbdd-2343933b78d7", "value": "3072:BNyah0mJqN0Kv97EEidmbr1wHKLLRPl0Y2nByXLPaEPKjnLWHDlMa/Bllfg3AGEQ:Bw91F7XQGnHWLWjvfSKricktWIYiAa0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644040904, "uuid": "61ea4888-aa34-4060-bc13-530d2213b033", "value": 419100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644040904, "uuid": "3f8fca0f-4a35-4281-9d67-d6d88dc3e599", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644040904, "uuid": "604e4eaa-c99c-4022-8dbe-ea4167fa31d5", "value": "DOC40218.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890e4c89-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088337, "uuid": "d0eec523-c8b6-44ed-a879-127d3ab8e8b5", "comment": "Malware payload", "value": "76ff0b311e26f1322c63023c30c54549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088337, "uuid": "48c866d6-2da5-4fa6-b87a-a5e7861eccad", "comment": "Malware payload", "value": "cbf579a991168b8018fc086aebc9c96387a881a6136bc9a0d0985c73f98c7682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088337, "uuid": "58ee6bce-f382-40f6-b0c6-84f28bbd69dd", "comment": "Malware payload", "value": "143baa09884c13cd59eb048f756954e5a6d2bc6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088337, "uuid": "5124a4f4-aafc-41d9-a870-6909ffb2dd5c", "comment": "Malware payload", "value": "8b9c3b41a777347b89e9a76e4dd8c17211dbb173b1bcafce494f05c46a2f7bd64bb6f889a358e9b814350bbe5773be40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088337, "uuid": "0e4d87b1-2fe6-4fc1-ae30-1cd8dbbebde4", "value": "T15E329E17AE5880F3D1F600B8AAA35B134D39BC10D1978A046FBD852F7CF27554926632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088337, "uuid": "b5e31d02-a07c-422d-acf5-8708c48317c8", "value": "270dc2963fec3b37ade00fd9ea0c69ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088337, "uuid": "bade9bc2-a22e-4fce-b421-6d228c9d2e38", "value": "192:yJwQ6DP9g+bhseSPGYWsA7/+yvMxrss+6PRk2/gm7WpuOc2rxWWSQ/7Sm0e:pQ6O+bhOHW3/FkrssFg/fc2sO0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088337, "uuid": "058ddffa-140e-40d9-9554-d34a31fab10b", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088337, "uuid": "cf8b455c-46f9-4695-88e2-a6109b68066a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088337, "uuid": "c0a66edd-1d4c-40a7-a32a-4a0de788b58a", "value": "DocTor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea0f217-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "c26b129a-377b-48d2-872d-dfee7058f714", "comment": "Malware payload (Heodo)", "value": "eb8e106dc5f29df9be75b4f05f088cd1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "bcce807c-961a-4a01-a06d-ceaaf49e78de", "comment": "Malware payload (Heodo)", "value": "d08094e802d9af1c4c1c417841379dd7e42b000d90f3186f36a3c25a9e4ad010", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "288da55f-2cc2-4e30-87a9-a0a20b3dc836", "comment": "Malware payload (Heodo)", "value": "7838918f6bf9d5f6dbc1f2d7641e0ae7bc9df7b3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "3ee1d9c6-af5b-4d19-bc38-f1fb86db88ac", "comment": "Malware payload (Heodo)", "value": "f1e320821441aa054a5ac3bd598a094d4b2cc3f08ad9789df34e156a1fd1bed9dd7b8f2a9b9040cc34ea7ac957272fbf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "15675d3c-944b-4c22-900a-79ae78cbd39b", "value": "T1A635AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "29c93a71-cc16-4373-9038-e615b9109fdc", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "9df18d41-06be-459d-9776-a0dcdfae3d8b", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTsFIIm2m40:wfv1GVFF+765nFvFf6dlzzSoFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019869, "uuid": "99de740a-7e8b-4932-ba0c-2c10f503ef5b", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019869, "uuid": "c9a35f5e-b295-4e28-9592-0eaf6f77b7ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "9047a8aa-3779-40c2-b0c0-ff0524827445", "value": "emotet_exe_e5_d08094e802d9af1c4c1c417841379dd7e42b000d90f3186f36a3c25a9e4ad010_2022-02-05__001102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "338dd3e4-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091200, "uuid": "9b9c526a-9680-483e-89b9-bbcc2e1d6e63", "comment": "Malware payload", "value": "e1a99c8d213bd20c976cabc1afb709f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091200, "uuid": "6efd2cca-4ba6-4075-809a-7f6c148f8fb1", "comment": "Malware payload", "value": "d0dad21692b92cd078f91f6302f03ef1b47254627bb49df2a37acc761420712c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091200, "uuid": "64f5e2b7-bd0a-4d05-b938-c2d118948f44", "comment": "Malware payload", "value": "f886237a582c9bb29b30bb00e87dda8a067150f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091200, "uuid": "2c6c1f05-2594-40a2-ad46-b1b265d60043", "comment": "Malware payload", "value": "b488f39ace67336567539c295367412bfbaab3687e3dc6eee4565196111c22f4f8d26d5d536c182c4cfae0c8e1cae143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091200, "uuid": "68fa4d7a-fd6e-4dfa-aab2-41ba73e95e8c", "value": "T138D2F247D9E30982E89E43779D1E4DE22B70D4CC92468A4B063E68578EC9CF61E98229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091200, "uuid": "4dbc4679-3658-4579-a451-662728d239d2", "value": "d5edd595c66202f13db147e6515a7f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091200, "uuid": "db7371e3-c0f8-4993-9a5c-f645dd59b196", "value": "768:QYJc48hOmxjej72gJeoCZAZ4bJMKeUbrsUQpCf:QYCVcjilAZGJX7ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091200, "uuid": "5f232d23-af40-4236-b8d2-baf04c9eca70", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091200, "uuid": "fabd13c5-2885-40ff-8192-b7ce765c0f94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091200, "uuid": "ad0d3b63-f141-4a99-ba50-d598e4f90dae", "value": "SelfWorm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26733fb-865e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644050181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050181, "uuid": "eb3bc642-48b9-4d30-a3b4-4d0e32806288", "comment": "Malware payload (RedLineStealer)", "value": "a324f3f7a97bd831cac8a4155d96c1d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050181, "uuid": "6a181878-d8b4-468d-9fd3-9b966a39e748", "comment": "Malware payload (RedLineStealer)", "value": "d19c22fa99afdf39746a775736de31f8e39748287ee38f33e9fb3912129991de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050181, "uuid": "e4531972-c4a0-454c-b99e-ae50dd85bdea", "comment": "Malware payload (RedLineStealer)", "value": "63291994d49c1d6c1fedb8b49adc980a3d018ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644050181, "uuid": "b3aba7d5-d84f-4f45-a7b2-a77fe803ecb6", "comment": "Malware payload (RedLineStealer)", "value": "24b5828bc0b04fb0b11ed5ea7b0b87725fbaf33ca4dced17254439151cee77f44f5ad1223d81723a62b4e979dd577f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050181, "uuid": "88eff47e-7f5d-4a39-aa10-6084d0e3dc16", "value": "T1A80633C69798BC84CF06BCF16198EB31DABC30D0F2C2D8A1B277D7BAB3856517096456", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050181, "uuid": "eee08982-6945-4ada-ae31-718eb493f8c1", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050181, "uuid": "8d207ea8-2c9f-4619-b42d-f9239a9ba6e8", "value": "98304:z7qot+8X3LUSG3XhfKyoQdnQwyhS7mQ7oPhb:z7B+8rrG3Xh7dQwyhSh7oPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644050181, "uuid": "b5c31029-f97b-4d10-a3ae-e9796546af07", "value": 3721824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644050181, "uuid": "ffe60a2c-1d16-48b6-a979-60155996469e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644050181, "uuid": "9520b5d4-c8ec-404a-8fb3-e39c0616e195", "value": "a324f3f7a97bd831cac8a4155d96c1d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d290c2-86c0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091988, "uuid": "ad193111-108b-4842-a92c-3e38f2ff02a2", "comment": "Malware payload", "value": "e56a9313f5b25300de504cdce5c84bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091988, "uuid": "951177e2-ef32-4f3e-948b-6cd9886d07e1", "comment": "Malware payload", "value": "d220d6b4c63dc754a007ff58dbfeb8aeff126ac9eb5fb2f3576b3a91d7539106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091988, "uuid": "b0666970-6d74-48bb-ab90-39d93354bbc8", "comment": "Malware payload", "value": "6901d7cc53cc5a3223fd9efe399082b119e80cf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091988, "uuid": "d0e666b6-6deb-40ad-b007-176972915cc8", "comment": "Malware payload", "value": "c9ffaab2160e058310a8e0dc523f51da6a11b76bc1d28bddf2344bde0b14eb7a1edb90d6e948b7f1bb3d1f32920815f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091988, "uuid": "02b27333-f5d4-4b1c-a2e8-9f4bbf9f2150", "value": "T16EB10B87311C95F6D8F253B253A94D33601668A0D5B92A4D3FD86106F4E12BC615CF94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091988, "uuid": "589200b3-d962-4b4e-acb5-89e65d55cc12", "value": "5c03c06f0edcd272135fb852d0b96575", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091988, "uuid": "071f4234-9c14-4eba-967a-ec004e181590", "value": "48:OEP3XGGFeS16tqE2kNPKs5BWXqt82ho07zIaSeJY8JTaXNLB:nPnGG0Vqrkh57s/NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091988, "uuid": "f1baf523-2890-4876-86af-ab4e7984442e", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091988, "uuid": "8903225a-344b-4efe-89c3-499608c22986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091988, "uuid": "533e57f8-f726-4ae1-9605-c7df3cdae057", "value": "dilan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df39797a-8680-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644064860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644064860, "uuid": "27a59207-e1a5-4ac1-ac38-13f138ab162c", "comment": "Malware payload (RedLineStealer)", "value": "80286211e348fb262323c664430553f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644064860, "uuid": "45e887b0-3373-4e42-9738-24e256fe439d", "comment": "Malware payload (RedLineStealer)", "value": "d23aaa6690b8141985a4237e4660246f83a59460d1fc7c614ae88eeea9d7fd4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644064860, "uuid": "ed0a2f05-0124-44b2-8de8-5fd134fc6c2c", "comment": "Malware payload (RedLineStealer)", "value": "c9a55f6c23c55d33925635fcee5fb72ad4c3f001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644064860, "uuid": "c603d178-925e-4f84-97bd-b77494727bac", "comment": "Malware payload (RedLineStealer)", "value": "9a978998f521946bde7ac51064c27617c4abf69c7d82112bd5fba27c852ca9e333ec0def89f2b055b84432527b58db9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644064860, "uuid": "5526ee41-45f0-44d0-bbe9-c461f85d9238", "value": "T19095E04C5002B79FFC703BBB5EE6AE82F2F24DD5A262516D39C1BD23DA71A95113C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644064860, "uuid": "f97d5184-18c1-4a13-bdca-fee3b5c503df", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644064860, "uuid": "38502a45-abe4-4e56-83a9-c9fa0be13b0c", "value": "49152:Z1V/6eVTfG26s5XUxEzjMt9q4tS9SxlXaFCk4:226sDjMG4tHKF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644064860, "uuid": "3a34a2a4-5e4a-42e7-9dd0-39396e3c263d", "value": 1906726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644064860, "uuid": "736e3fbf-c4b3-4c9f-b0b3-2472f4af6106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644064860, "uuid": "8b98d38d-b789-480f-8ca1-21390223b96f", "value": "d23aaa6690b8141985a4237e4660246f83a59460d1fc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f149fd8f-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091519, "uuid": "7b87aff0-5cdf-47ed-a967-8fd422021bed", "comment": "Malware payload", "value": "2da09a30217238b84e87115ef698a720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091519, "uuid": "21f5c831-793d-4a07-8ee0-4cb680c927e3", "comment": "Malware payload", "value": "d3a1bdd3ea570b33d18209bcc19d229229c95de8d4b13ffe76248ca72c17e09c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091519, "uuid": "9c58d431-6737-4f4e-a8ac-2f6125cdef9e", "comment": "Malware payload", "value": "f73cd85f1442ca337b069eb61481731b588e5799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091519, "uuid": "8fbe65ab-72a0-4378-9a2c-32fec0906aae", "comment": "Malware payload", "value": "aee6161a8d9387856c7a259d80ef1740c0583bbd8bb879956844e2ef30f7d2eedce36a1436e8d443bc758b5b7a95c4ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091519, "uuid": "86f3f811-098b-4fdf-ac9a-52e5831d4d04", "value": "T158063343D3E2B495E4C39630265F312792F897A16C78A8F2A5B5975C0AC8E71738EC38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091519, "uuid": "98b5020b-e7b2-49d2-899b-d347679b880e", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091519, "uuid": "10caff2f-50a9-450b-aaf5-b2bffe7ba9f1", "value": "98304:fJwBI7lzey6pGuqvjKtT+cEpTgo03LNMPsr:fMI7Jek5LKtTkSNMPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091519, "uuid": "a1280166-a994-4a7b-8a64-eac7caa76efa", "value": 3729200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091519, "uuid": "102614d2-3047-4a08-94a7-5469a976489c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091519, "uuid": "7a97e24d-5e00-44f9-8948-cb5d48f802dc", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6645cbec-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075394, "uuid": "430ef631-b61e-4f1f-a77e-c550edc8bce0", "comment": "Malware payload (Heodo)", "value": "2fdc47f4685008a2f126cf69ec4b28cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075394, "uuid": "abee02e1-6a28-4a8b-9d9e-d058471cc90a", "comment": "Malware payload (Heodo)", "value": "d428ac0f25146f0d427d8b0f3d5d64046bcccaef748083257b6278dea2d455e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075394, "uuid": "6086caab-fa74-4a20-9932-019c12654692", "comment": "Malware payload (Heodo)", "value": "0925385ad96f3e82a6be2d74f7b15fa8bc44a840", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075394, "uuid": "1445be65-5451-41b3-8ffe-ca4ecc5be242", "comment": "Malware payload (Heodo)", "value": "d2d2421c35e0a17288a6b0e0b00a1bc4d0c025ffa4be9090a84d2676db20a319ab7feadbe778f74025fa240277c5660e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075394, "uuid": "a3100f84-6ad8-470d-b845-4c5c87bae17f", "value": "T16025AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075394, "uuid": "b6456e25-8b56-4a86-819b-85be64d50971", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075394, "uuid": "98a4d734-e861-435d-ab77-dcf5bd6e55dc", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxdfFIIm2m42:1ZsYB7vLsnZI1Hb9DoFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075394, "uuid": "3427710a-f7f6-47fb-9914-c4defa9fa37e", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075394, "uuid": "ce8c3bba-c99d-4739-a9f2-20d75ec7880e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075394, "uuid": "057a2757-4188-4ddc-9276-234261b6539e", "value": "d428ac0f25146f0d427d8b0f3d5d64046bcccaef748083257b6278dea2d455e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea6d320-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "6fd86eef-e375-44fe-a565-b840dd3bf63f", "comment": "Malware payload (Heodo)", "value": "72a39bc77708d203e916fc89e873e409", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "02ed3ce9-4032-46d3-a615-94a4d327ba42", "comment": "Malware payload (Heodo)", "value": "d462090243352bde5a9fdfecbe251e2787201a9ffbbaf9ff42187a9e7afce8c8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "26f422e6-0909-4b7e-b14c-7b1df8b3bf96", "comment": "Malware payload (Heodo)", "value": "7f6eaf36d1ef3f5978868770bd67536aeb8ba70d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019869, "uuid": "72f908a8-4187-439e-a79f-3485d0ed620a", "comment": "Malware payload (Heodo)", "value": "4be10335bb65d2536926cee9d1e70e67f293f21f19b2549cc0189cb136c5eb23ce6607a96c5a0a5a4164acb88261e90f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "d90c6dab-d1dc-430c-9d39-529913653ac0", "value": "T15C35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "36876433-f063-4e42-8185-5049bf1fe3e9", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "156a6c22-018e-406a-b85c-954b2361ed2c", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTuFIIm2m40:wfv1GVFF+765nFvFf6dlzzSCFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019869, "uuid": "01e0ddc8-9f41-4866-a13b-9d0e4a8a3a60", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019869, "uuid": "1d510485-9453-46d4-89cf-824e2010259e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019869, "uuid": "931bd6bd-1f08-47cb-aa50-12f1be36b275", "value": "emotet_exe_e5_d462090243352bde5a9fdfecbe251e2787201a9ffbbaf9ff42187a9e7afce8c8_2022-02-05__001101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679c8154-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075396, "uuid": "d64390d1-6c5a-43ad-b0d0-b5b722402553", "comment": "Malware payload (Heodo)", "value": "099e702cb1998e665ead9ec31f03783b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075396, "uuid": "a2b94f9c-86e9-4806-8a43-22153caea505", "comment": "Malware payload (Heodo)", "value": "d673f383b794b6a6a393c1a8cff23983e98adc98e1081312c0a98800ba460873", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075396, "uuid": "864ec96d-f3be-462e-a63f-ff5ed5e15f02", "comment": "Malware payload (Heodo)", "value": "c5c1c604b528fdeb2dfd323920e24cade05d719c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075396, "uuid": "f78f2dec-1e8e-4e7e-acf2-36dfb35edb31", "comment": "Malware payload (Heodo)", "value": "7f2977a8ffac9cf43909a0f35b4eaf1a5c4288b39cc32c22c68c770901c7d27a269f6c0c72e704fea9d29aae70b3297d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075396, "uuid": "1db6600f-a3d2-441d-a285-68e25d5fdc46", "value": "T15E35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075396, "uuid": "f6f6cec9-de3d-4acd-ad4f-12c99728bc95", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075396, "uuid": "45ac93c9-fa2a-43d3-aec7-79b12cea0bc9", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTGFIIm2m40:wfv1GVFF+765nFvFf6dlzzSqFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075396, "uuid": "982a49e4-391e-4c1e-b1ef-bd71df307047", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075396, "uuid": "6fdfe14b-246f-4e54-a69c-6a5125279c8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075396, "uuid": "4493b666-574d-43b9-9397-7f939aba1cc7", "value": "d673f383b794b6a6a393c1a8cff23983e98adc98e1081312c0a98800ba460873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94f6c62-86a7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644081627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644081627, "uuid": "391b0fb9-54aa-4555-8ea3-ccb111e220c1", "comment": "Malware payload (RedLineStealer)", "value": "ccf19e64eb4a33f7badc354687df2590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644081627, "uuid": "aa711331-741d-4ade-b17d-df66a14a0366", "comment": "Malware payload (RedLineStealer)", "value": "d8097338dd618c81a2b6a1a7079fb56adc35b966694781460b5c2fa429e1bd1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644081627, "uuid": "51442f6b-328a-43ad-897a-e97b3f4be1c4", "comment": "Malware payload (RedLineStealer)", "value": "a4f051ff8918c13db4547c28740d07986bf02027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644081627, "uuid": "c9fbc727-0c6c-454a-935a-41ba916107fb", "comment": "Malware payload (RedLineStealer)", "value": "3738c4ec91b65313b5b3984660d822a9a4cdca2929ffa3b5b3122c019f4660373ab0cb52a1b05e267003ccd20d7b82c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644081627, "uuid": "3e71025a-d085-474d-aa12-f05161701608", "value": "T1E1D4D0132B9485CAD9A2DFF14E3459939FE78A631C13EA0A1FE834B70D35B9A8D35D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644081627, "uuid": "e5c431ce-8e14-4c4c-b9e7-bde64d0efe82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644081627, "uuid": "cee96d48-9f39-4678-b947-a780c6b641b8", "value": "12288:jA9+bNvJ8R4E/JGZz/rGHPgzE1oISHz9n:jjbNvJe7IZ33V/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644081627, "uuid": "5815a454-497b-4d98-a31c-4c375262bed2", "value": 632344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644081627, "uuid": "6f8b847f-10ed-4b0f-aee5-5ae079f71200", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644081627, "uuid": "1f636fbb-b058-485c-b272-6e9c73f7e807", "value": "d8097338dd618c81a2b6a1a7079fb56adc35b96669478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453578c9-86b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087794, "uuid": "21199eee-1c60-498b-be02-b78cdc885762", "comment": "Malware payload", "value": "ca27691bf2137dc610588dd9f09de3b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087794, "uuid": "30159a30-a39e-4208-a82c-d15218c05b72", "comment": "Malware payload", "value": "d893879582f0f85973f009a957d3ca23766d5a1f178de8be59df320cfed2a1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087794, "uuid": "96506831-fdb4-4596-8a3b-d6cb1d839cee", "comment": "Malware payload", "value": "5b1aac1f8783d4123f3b88c213bc8321dc8d6a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087794, "uuid": "14508452-f47e-47d6-b021-44955a939fc1", "comment": "Malware payload", "value": "9d83c5cbac77e8d66024ed4607c7e6cf6b62f2a15b6df628df39688165925c247316ed915884f9b445b1d0feca60f78c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087794, "uuid": "35c4a764-4eaf-4f09-823f-f0792426fb31", "value": "T191C129D7AA3EAF72CAB6103903D14115367E6961AA7D9AD437C8006BACA7000404DFBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087794, "uuid": "35c950c3-c5e3-4dfa-af16-04f07291adb6", "value": "81fb733f5e9a8359be9c5ae8210289a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087794, "uuid": "d03382ed-c9af-40a4-bb39-8000ea6c0f33", "value": "48:OEPv4mdoqYh9ELTLZle520w73UEnfQoybax3uunQdfMEK3cqSeJY8JTaA8UZB:nPv48ryEnLo2f3woyOouWhUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087794, "uuid": "8baff9c9-addd-4215-be82-3d185876359b", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087794, "uuid": "0d005301-5693-4342-921f-46a692593b07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087794, "uuid": "9d689720-865a-4813-8bf4-009107f65e76", "value": "XFW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9f9518-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088479, "uuid": "ee61ff99-856f-49b4-9d56-4b8cbd378de1", "comment": "Malware payload", "value": "bdd4e8ab9db0d5e79474cb50f1f0ebda", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088479, "uuid": "d94a0d36-35f1-47ea-a1ad-e5d6a9506c46", "comment": "Malware payload", "value": "d8d655cd0af6d46047c43943162fc1cbbc7ad77a31a0c5cdaba8c3a684f50b2c", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088479, "uuid": "020f0ed9-8cf3-48bc-8d4c-c3df03f3c635", "comment": "Malware payload", "value": "303d4183f401e9bf707dab9d05d993e329f71753", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088479, "uuid": "1c9090df-3209-4916-82c8-3d403b66e8b3", "comment": "Malware payload", "value": "5509451fb9c60b3b0f930542b0fad5e96e8fbfa5d133b1c7827a08baa6850cbd0f4520e1f4f1a8d0c739c2ceb9b44060", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088479, "uuid": "21cc5b52-56a1-4b62-bdde-9d7a89ca1fab", "value": "T179B10045668377AE647217C330E2C846B67083FADC237C85791ACC37EE65AED4AB0497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088479, "uuid": "bebee4b8-31cb-4bbc-b6c5-9e079916216e", "value": "96:SAl4Oj//wMqYLaByR7aAY3BezW2u1RcQRv8dUYIdqBocSmhGQXDfQ6HjSk7LjyVT:uOj/dR+v7XMEsDSk7vY322", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088479, "uuid": "c0b41230-0ca6-400b-8339-a138c33cd195", "value": 5258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088479, "uuid": "d612d689-d337-47b7-b5cd-b3da7feece9d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088479, "uuid": "8e406156-671f-40b2-abf2-154cb9d0ab30", "value": "doublet.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a774dcdd-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088388, "uuid": "808b5e3b-b9ce-41e0-8027-7d5f1460ab4a", "comment": "Malware payload", "value": "1b81a0863eafb1a4b260df5c7c1d8621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088388, "uuid": "2c42ec2f-3fdf-4ddb-8e9d-f1e2c0b1027c", "comment": "Malware payload", "value": "da8bdc38ab48cbe7b27d18b5527cf7329003467065247b622ed46df34c39f0a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088388, "uuid": "dcd31a71-70c0-4e63-ae62-14ac9a287ba3", "comment": "Malware payload", "value": "7c218fa9d30d54966f472e6703123d13e38152f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088388, "uuid": "67b2fcd9-d5e1-4bd6-9d2f-e7f0726f649b", "comment": "Malware payload", "value": "d3124152d6666c9a7e0dc1484eaa7ea769e2bd90a8ca5fea1ca88bf5b61085e7ca7a8179de7db9b50e680b1f5366c441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088388, "uuid": "cb61ff96-1011-46c4-8b3c-92be33092cf3", "value": "T118429E36BB9515B7D89405353E738F616C5A98B89618A35F07A8BF1F3C703B0A188CB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088388, "uuid": "a86b4006-d28e-41a9-87fe-cfe6333bdf63", "value": "aef439f1829f69458eb455e4017c94f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088388, "uuid": "095542aa-566f-4af3-b487-90e7aee99b4d", "value": "384:0v/QF7r8xe3OGgpCFooTMBfGnLKAKsO2:0HQFnBRgpCFXokLhDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088388, "uuid": "24f5dddd-3b50-48af-bdeb-f7490b41908f", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088388, "uuid": "df041ebd-d8f4-4f30-9cdf-c0e25e793027", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088388, "uuid": "c475d4fb-4f82-44da-953f-628d41fc8ec5", "value": "WormMars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685c862a-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075398, "uuid": "dffb9ea6-cc3c-49ad-9666-07eaa37c28ab", "comment": "Malware payload (Heodo)", "value": "9df630ca4671ede1d1a85b84681dd78b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075398, "uuid": "b35dace4-c096-41ee-a9b3-33d5c9297599", "comment": "Malware payload (Heodo)", "value": "dc4d6458223f3cb767eb4089edc12f65575e20b85e168dd55f1c017b7ef815ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075398, "uuid": "aaea3c02-3d5f-41a7-9c61-8e09b1ca6173", "comment": "Malware payload (Heodo)", "value": "1f3eab65c00e77400aad7b285ad2f300c1f7abf5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075398, "uuid": "28fd3c36-836c-41af-8071-bd8338c8d06e", "comment": "Malware payload (Heodo)", "value": "1c5efee6395766091e1d53a57f03b52879edd2e18806fe9b8949f850867dd53ea9cfb640b8c1af780060ad5912bf8b70", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075398, "uuid": "3b47db73-5c28-48f5-88eb-6818f3585b6d", "value": "T17125AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075398, "uuid": "6783a03c-063a-4cb2-9831-0104951a31fd", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075398, "uuid": "3fca567d-75b0-49ef-b24c-f6e84a3f699a", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxOfFIIm2m42:1ZsYB7vLsnZI1Hb9DFFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075398, "uuid": "d1c7171a-169f-437e-8149-16e752977c81", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075398, "uuid": "b6fe5aa1-a0a0-4390-ba5f-a5ee873ec11f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075398, "uuid": "e3d6de16-def8-480d-8880-c03fe49aa5af", "value": "dc4d6458223f3cb767eb4089edc12f65575e20b85e168dd55f1c017b7ef815ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054be69e-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075231, "uuid": "0ee7786f-1d3a-43bd-8d25-777c99aadc3e", "comment": "Malware payload (Mirai)", "value": "0d8c86c2320fea951e6ef42c79c63bea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075231, "uuid": "fecba5c1-15ec-4a36-b075-a31da4d776eb", "comment": "Malware payload (Mirai)", "value": "dc7a7117ab9a9b1b0aafab5b372135178fa953e633526cd06f5fa44c66a80463", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075231, "uuid": "85b8dc79-d5f3-4d4c-abd6-2f901b1e4c9f", "comment": "Malware payload (Mirai)", "value": "ec421c73133c9e840e54598813e881df393eb184", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075231, "uuid": "85255e33-0366-4a16-b2f0-fd815a2a576d", "comment": "Malware payload (Mirai)", "value": "ff05e6669caeedeb7ae25813de68c418dba3ba4473d4c2101577a76fb0ae85778ac3101a6682e30a370089ec51d7286f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075231, "uuid": "f8c7ad9d-544c-403a-9cad-3475c12bb27c", "value": "T1F0044A05DA809B17C6E237BAF79B428E33239B5467D733058928ABF43FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075231, "uuid": "026f4dbc-550d-4e56-8f3f-7e1b73356f76", "value": "3072:uqV/Xb/dnp+eQPGCs+DKTkababzola7ZT8UbWdUs45hLQj3zVbYM/9/oHmmw3BqK:uts+Kkababz4a7pbWde5hLQj3z+M/9/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075231, "uuid": "ca3619e6-a646-46ea-91d1-5fefcd5b8f59", "value": 180232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075231, "uuid": "187b1826-9ab0-4297-8ca7-16be5a9f178a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075231, "uuid": "eb82b411-14dc-47fa-9754-c90914ad4799", "value": "0d8c86c2320fea951e6ef42c79c63bea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce50cbbe-865b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644048940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644048940, "uuid": "c298676b-872b-4b42-87a7-d2d988d9d2bc", "comment": "Malware payload (Formbook)", "value": "f2e206ae7dd94eafa9414c6035fd73c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644048940, "uuid": "6a38d912-1796-4f8a-ae80-0caf2f326e98", "comment": "Malware payload (Formbook)", "value": "dcec29b67b720887c02915f7eb210942445a64e450f03bf12ca03ed345bc300a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644048940, "uuid": "b981ff2c-4921-484c-aafb-2d1d3887ec89", "comment": "Malware payload (Formbook)", "value": "63bc860f362a66b727fbdfec783ba4fcd8e79c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644048940, "uuid": "fd96aff7-547a-4427-a600-f891cb9b3848", "comment": "Malware payload (Formbook)", "value": "4cc070a885b02298a7e9eac81b15b61d1c471a5fbaf7b768fcb4b0262ae5cf84e8e6c07321ebc459b02b55994ca6449f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644048940, "uuid": "2368303b-1ef0-4bd5-a7ea-b6b4fe6ed8fe", "value": "T1B494E0B4A0A789A5F42F9475A27CFCB6027233E389EB4D24172866045FE9F166F4490F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644048940, "uuid": "610cb7a2-fb8d-4a90-ae28-3176609ec9fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644048940, "uuid": "fad1a984-0e8e-487a-8259-35e94bf25e36", "value": "6144:FiSeLxYdP9SzKx2Xq2vsyrKKWRY12Earu+aNt1apU4jF6YkqnKarkG/hK7yTa:ISeLxYumsX/vtKLW12EfNtmUrhqnH/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644048940, "uuid": "6f7aa2d0-9059-469a-82d8-b458992f28a1", "value": 415744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644048940, "uuid": "24e7c6d9-fb9c-4c36-bc01-3c4c0837d3a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644048940, "uuid": "10986db9-9230-424d-9df7-cd4da790b47b", "value": "NEW INQUIRY ORDER IN USD.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b467fa-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075400, "uuid": "6ec3b123-feb7-4a6b-accb-78432255ba94", "comment": "Malware payload (Heodo)", "value": "0652d60142aa649b74865ced4e11b99c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075400, "uuid": "f0d1297b-59e0-433f-ab2d-d9ee53f56e95", "comment": "Malware payload (Heodo)", "value": "ddcc1db1e6439feedc916f36ba390d1f6e45b70cd28e704db1afe74617815c17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075400, "uuid": "1df70723-68a3-4be4-9f88-248e68fd8881", "comment": "Malware payload (Heodo)", "value": "2228b8fd1fcca5f11251b242389df6c79a7685b9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075400, "uuid": "e71f88c2-4afc-4aca-9c4b-d978b15a62d9", "comment": "Malware payload (Heodo)", "value": "9154c6c45bc54986e0caabb0934697496de6bc20fe2f4b9dc812601e4feb2d39d4e9f8075212ffce1253d43211c48ec9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075400, "uuid": "596699e8-06bc-4c28-b188-9cafbf874740", "value": "T1FD35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075400, "uuid": "0e688254-bc4d-42c5-b46e-37ce511d58fd", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075400, "uuid": "b669e969-52af-4fb5-a02a-141ac04ad98f", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTxFIIm2m40:wfv1GVFF+765nFvFf6dlzzSVFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075400, "uuid": "93f2740f-2b37-4a89-9f34-b441d0aba426", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075400, "uuid": "3bca5944-06f2-4345-8fd3-1a7341272235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075400, "uuid": "a7161675-2530-42eb-86ad-54e2c6a4ac9f", "value": "ddcc1db1e6439feedc916f36ba390d1f6e45b70cd28e704db1afe74617815c17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8204cb5a-862a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644027766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644027766, "uuid": "ebfc99fa-a306-4ada-8a49-62c247273432", "comment": "Malware payload (Heodo)", "value": "b61ca8c0f7848f3b54a13b643bc872c2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644027766, "uuid": "e8cc5dd8-53c4-4132-a45a-44b734a88696", "comment": "Malware payload (Heodo)", "value": "df6f448b458760c3e98c87c4ee8c5e99182f71ab29d061b03140f0e9a5c691e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644027766, "uuid": "97ae1e65-9987-40d7-abdb-4488bdda2b32", "comment": "Malware payload (Heodo)", "value": "c3d7898457ee5f30b2910ccf019eb2e52709178d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644027766, "uuid": "6412d24d-bf60-49f3-ad95-791995df703b", "comment": "Malware payload (Heodo)", "value": "32c7d80b0d734fef338cc1459b87f1fa9fe8e3d4d919866bb45a8fabf8eb6f178ca6c454590308ab5056eb262de812a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644027766, "uuid": "8cc99fc9-31a6-45c2-b6a1-aa660e27e400", "value": "T130647DD06E5A50D9B6832A2B1AC341014FEC9A1940F1CCDDCFCEFA555B9ACC2E75A0ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644027766, "uuid": "b079fe99-38c0-4cbf-9601-253fbcaae593", "value": "6144:2D/Tuk02QyxDxkXOQTnjuwibXGmkEovJKt4kI0lkI9sJD8Mm0czMm8QTymiVNWzZ:2D/Tukcyj1Giqjxq4s2IuJIMm0WKQTy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644027766, "uuid": "b58a7234-696d-4b60-ba57-7aa003f00987", "value": 315768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644027766, "uuid": "0ceb5482-6e77-461a-b0a8-d9f4826f05bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644027766, "uuid": "81f88786-718f-4f9a-899b-190d57dbf762", "value": "emotet_exe_e5_df6f448b458760c3e98c87c4ee8c5e99182f71ab29d061b03140f0e9a5c691e0_2022-02-05__022242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5dddf1-865d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644049819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049819, "uuid": "54eaf3a4-dd56-4813-99eb-e2abeb32086f", "comment": "Malware payload (Formbook)", "value": "45b58bf5b4db2259dcda75b6c7547329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049819, "uuid": "af1af57c-dd4f-4ffb-b085-dc1fb377ea6b", "comment": "Malware payload (Formbook)", "value": "dfbeb8125b12783be186e19392ac1f5a0dd449f826f50eceb786bd158a956dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049819, "uuid": "de315e6b-29de-4bce-800c-64c6ba097055", "comment": "Malware payload (Formbook)", "value": "d0198cf38134dacef611e597f0024822f1551763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644049819, "uuid": "d76ba701-d0d0-4571-abc7-ed5c562b8cf5", "comment": "Malware payload (Formbook)", "value": "31eb4706181430b35f35bea70381d6fb0d36add3e404710cd81cd988808c016baf369021bf6cb94151fe2e44ebf34cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049819, "uuid": "1919e498-f10a-4296-8fa9-5d90b4bbf7d8", "value": "T17EB4CF643275C897E53948F4201AB8D857F4329BF8CED7DA0EE994C866D9F802D4A1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049819, "uuid": "7f29935b-f7ce-473f-b242-9899c361ed92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049819, "uuid": "b7ac82d8-b354-4403-a014-439d735b5a67", "value": "6144:ydhJDBpmVoIQmKEZ/yq3rPkFBCeSdnIc++N0PCFnl1Hix2c063Qy0ecYpPuoFegk:ydhJDBpmVoaKKprnBxfl1m2Ny5zFeh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644049819, "uuid": "5fb1f4f4-ebb3-475a-aead-8a39afc633b0", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644049819, "uuid": "7afc3320-2b1b-46f1-bafb-32a89ba59ff1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644049819, "uuid": "56bfbc49-636c-4ade-af32-593ec67a1983", "value": "016-26404851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2dea1d4-86b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087522, "uuid": "9be30a26-3a82-4399-8239-3b2d54928230", "comment": "Malware payload", "value": "523d544a6926e8c52ce0ad00a4390803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087522, "uuid": "f5104a02-461f-4531-94bf-9d0add51ac36", "comment": "Malware payload", "value": "e09771f1dba3b7dae3164b716b7b7e7ece24ab94244ca27a731a1856d4820f4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087522, "uuid": "cc16db2d-7293-4e8e-8161-77faa244c29a", "comment": "Malware payload", "value": "9330c5e70be8a84627f79b7dece864a8fac494fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087522, "uuid": "183e5f40-b8e7-4c7a-b5e2-2705af914d51", "comment": "Malware payload", "value": "276395b2f0b9549560d71df1930b25c617f4186dc64b115a148c022f0d79dbf206b94248727030b96af9ce84129850e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087522, "uuid": "6f0699ac-658b-444a-9049-8b7a7a98b98e", "value": "T10473DBFE1A90D034C443CA38B4312A0E346FEE976A3E761D7467FE7A5F762562805D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087522, "uuid": "f4227f3c-26ec-4f30-a44b-dac3cd2694de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087522, "uuid": "57d85003-16d1-4f5e-887f-dae7cc7362c2", "value": "768:mFoERdC1gJ7+jZUqQG/RtTjlfDpWFeOUpF95zSgK4x0/klGpn7X04A:wobN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087522, "uuid": "e5380b06-0ba1-4cac-8f8f-1587f100fb34", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087522, "uuid": "c4fe4a8c-a69b-4f48-9b41-0497c6a23b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087522, "uuid": "33968b45-3a85-41f3-920d-bc942a0112a1", "value": "Genshin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca30662-869d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644077176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077176, "uuid": "f87ff304-718a-42f9-9447-ff17cce56694", "comment": "Malware payload (RedLineStealer)", "value": "c5a54b73786f69ca1ce0bdaa3a468e31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077176, "uuid": "717b0078-79c0-41c7-b183-ea5e0378a583", "comment": "Malware payload (RedLineStealer)", "value": "e19a6d86ae39ed1dbbe9b2e092e31133ebc9f2b071c72a98bb5a09dc27d53493", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077176, "uuid": "180a678d-04ae-4339-9a12-cf092a526e1b", "comment": "Malware payload (RedLineStealer)", "value": "c1068d2b53cc3ba0b2b2390905374b92144c1f30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644077176, "uuid": "147c96bb-a5f3-45a2-b430-fde096ab9725", "comment": "Malware payload (RedLineStealer)", "value": "b73b222b48a420ebcb88e20ad76fc0a8070bd034eb2212e38ae18a578d23f82ac85ebc5b6392dabd2d1e030b2691554a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077176, "uuid": "c7295fbf-21b9-4841-8b91-3121f0f2b33f", "value": "T13B351BDD51C55849CFEF03F00DFBE22E857296C613474BEA732E91F0AB6209EA56D4A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077176, "uuid": "15e7cfbc-832c-47ec-8bc2-48ed0c194cf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077176, "uuid": "4e964eb3-e4f6-4cbd-a2aa-a75a3b728179", "value": "12288:9b2dDqZGDLyB6HqnHh4lc3y1C8hNhyHCua3W6rci3z+ZEFQx4p:liD2Gvl8h4lcC88hNMGBrvKCQqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644077176, "uuid": "6a663f12-912e-4c72-bf36-437a0462e4ac", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644077176, "uuid": "3aad1b8e-e81d-4b9d-9b9e-f6d68c89ca01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644077176, "uuid": "7abccb4f-6b52-42bd-8000-b5245d68fe02", "value": "c5a54b73786f69ca1ce0bdaa3a468e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e626efa-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091192, "uuid": "0456d243-e3f5-4ba3-9e41-745c75901e3a", "comment": "Malware payload", "value": "4292a1ade77cb9e51e3de52101c99dcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091192, "uuid": "e1c4b02e-7713-44e3-93ba-0193e993c1fa", "comment": "Malware payload", "value": "e1c5e309075a6894dd673e9f9de201b13f0b6b4780ece2b4620c13020bc127db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091192, "uuid": "d00d3fed-bba6-4942-833a-c43c49938d77", "comment": "Malware payload", "value": "b485fdd64fda5d12221f83be8c062588f051b2c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091192, "uuid": "e69e9d55-3303-4287-8fa8-fcb8386789a9", "comment": "Malware payload", "value": "e473d2d3b002f06f7a74a5424fedb766e566e7421808c44a81f209d8c1097b9b12df0d4c030cadb9da02a83ee83c7c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091192, "uuid": "c6795ea6-ac63-45d9-a1d8-43bd02833655", "value": "T12BD2F13226B9E1F6CE81017FBA2E0B6339847EF922A583057B7660E26DD1C623D04915", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091192, "uuid": "c7e86318-504b-47de-98ee-2792c44d9a79", "value": "57a5f17fdb496fd18f0ffc2e16aafe57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091192, "uuid": "281d25db-a88b-4316-9629-404443fb8773", "value": "768:PBEEuH+USTSQSpTzJr9dNQtQWO7dKz6hKwG/6XxAx:PBiuTSJppr9dhEehLGES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091192, "uuid": "df708053-73d3-44cd-a0f1-5a45905c7a0a", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091192, "uuid": "e3af61b3-48ca-4ec2-bcbe-3b963053e8b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091192, "uuid": "6316f3ee-5c61-473c-953c-058b74545dbd", "value": "Litelo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e80be81-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644073609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073609, "uuid": "b01b4697-ef61-470d-90aa-0c336b1c5c93", "comment": "Malware payload (Heodo)", "value": "d67eeed469c3b62fc8a522fe53fb5670", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073609, "uuid": "2eea9802-a274-4c49-9572-c0ce53e0fc1a", "comment": "Malware payload (Heodo)", "value": "e3037f9e93093f45943cdc4f3d7bf394c21d0e04ca123d27860e270c79a40bc0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073609, "uuid": "306d9974-a788-4791-afa8-6ac664c3b7e8", "comment": "Malware payload (Heodo)", "value": "06ffeb52cdb63b06542b54a888390233ce090489", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073609, "uuid": "be93004b-4bf9-4fdd-abbc-291b4546286b", "comment": "Malware payload (Heodo)", "value": "7c3f8f746b99eb1405b63b05f6fbff375f192cdf95d8fd5236b0e79a56deca147abd0ea0c605f8bb23225cafd5c48a7d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073609, "uuid": "953b88a7-e868-4bc9-b48f-a47d9ba6d65c", "value": "T15FE37C157245D9FADA04233109CB8BFA3627BC438E7583E37249F31E6F776509AD2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073609, "uuid": "851dabee-e831-48a6-8fd9-3d527a8baf25", "value": "3072:jcKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgX4LcY:jcKoSsxzNDZLDZjlbR868O8KlVH3yehi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073609, "uuid": "5e4e429b-8529-4686-b12c-aed4024c7175", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073609, "uuid": "69983ef1-a76f-4398-a5dd-2e5566457f99", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073609, "uuid": "bec907c9-c555-4243-945d-717734de6f8e", "value": "Ommega Publishers.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4de762e-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644088384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088384, "uuid": "208f7dc2-a8e2-4921-9544-1d69f5edb391", "comment": "Malware payload (Heodo)", "value": "b13ebc0f8828f8daccfa7d5d04609aa0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088384, "uuid": "651f933c-e4cd-40e9-aad8-0ffeb088f419", "comment": "Malware payload (Heodo)", "value": "e416527878ff98c75748d6ace717bd4d264ea4a44814738cebb93649f4e3509e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088384, "uuid": "2761df2a-abcf-4913-b746-281563ffc525", "comment": "Malware payload (Heodo)", "value": "b7716caeae7547038463d50e260187b562d01e1a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088384, "uuid": "afd237b7-9fb5-4fe1-a3e5-faba42987d68", "comment": "Malware payload (Heodo)", "value": "27828b85294c5d4fa08c7c9fade7f499bfc53476327157c15fb41fafa904b32cd29a4d190cdfdae57643eb430ef6d433", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088384, "uuid": "5347cf1c-8a40-4c65-81b6-4c7b8c57c850", "value": "T1D7E37C15B245D9FADA04233109CB8BFA3627BC434E7183E37249F31E6F776509AD2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088384, "uuid": "43f72243-8b3c-4792-81d9-c36baf3407ab", "value": "3072:9cKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgX4Lc8:9cKoSsxzNDZLDZjlbR868O8KlVH3yeh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088384, "uuid": "63e8378b-6c24-4558-94e5-bf787b7c0ea6", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088384, "uuid": "0da5e215-88de-4170-a75f-d064b264b81b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088384, "uuid": "8bc69231-7630-4e5a-98df-9a49a6a27a9e", "value": "2022-04-02_1340.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a991dd1-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644073603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073603, "uuid": "7bcc817c-06c7-48eb-976e-47ac108a5cab", "comment": "Malware payload (AgentTesla)", "value": "e45c3a4c2fa25e1f394d89663df3c8ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073603, "uuid": "5d69c312-9e68-40bb-bab4-df8a45298881", "comment": "Malware payload (AgentTesla)", "value": "e4a3c61378f088692c9e0d4244534f576baa4104d29d426ef6d13498661b61f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073603, "uuid": "9f400fd6-074a-4a4e-8e4e-47a16373430a", "comment": "Malware payload (AgentTesla)", "value": "0bda5e3d119ceb3d18af704307dbcf357d19d546", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073603, "uuid": "32a067e8-ce57-4a4a-9377-919a497d96b8", "comment": "Malware payload (AgentTesla)", "value": "05ca87c86f042e5df80df0cdb8284f21a7ebed7829cc1ddbf44f72b4d8fc12bafde03fdf325973bb72fb968cfb97fd9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073603, "uuid": "1a9c496b-c553-4a74-a285-48a7a971c602", "value": "T19AE47CB123A8AF58ED3FC739632694249BF0E427E315EFEA7ED521CD0890F454A11A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073603, "uuid": "98c2bb00-55e9-4ca9-821a-5ee03e5feb21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073603, "uuid": "809a2515-498a-4317-9b03-46c2575679e2", "value": "12288:f7T79Y5GvH1NyhdS7ItjApbg1ryzgESefRbAdKcmPZ1+j1j:f5+Gv14hU76jAlg1ry4epbAdKcmPZYjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073603, "uuid": "d0a450ba-9e2d-4fdf-a741-6a159668db2b", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073603, "uuid": "78d38727-784a-438e-b6a7-79ce4f15d81a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073603, "uuid": "5211b9ee-932f-414d-85af-7b8b50510e27", "value": "doc20220402011566979790.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e3c87e-869b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644076179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076179, "uuid": "3418b1a3-f70e-4195-b109-76083a4f72a6", "comment": "Malware payload (Heodo)", "value": "3e801b02101f30954ea85b9da492baa4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076179, "uuid": "55a2a3f0-dac5-47b2-b38a-ae45eac77727", "comment": "Malware payload (Heodo)", "value": "e5f9cc95bf5794ff3b23cbb3be2f2536b923cdf128e95f36384d0a2010e1b4d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076179, "uuid": "80e8c191-b5f1-499f-a526-7e08fdf5085a", "comment": "Malware payload (Heodo)", "value": "ec26b464b931616955c799487dba6095871617a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644076179, "uuid": "d91506ff-437b-4b12-9714-fdd5a395b075", "comment": "Malware payload (Heodo)", "value": "55af1690afe2e91cdb5ec253bbc4846d5376e22810ca40a5efc59556cfe870a2a9e178642e1c13bdec7a3d142d859705", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076179, "uuid": "af2c367b-14d4-40ad-b205-be676a9a3605", "value": "T13E25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076179, "uuid": "55157351-0462-43e4-8c67-d3b600f41ff4", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076179, "uuid": "6274693b-6c57-490e-91d9-3554faaf8b61", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxJfFIIm2m42:1ZsYB7vLsnZI1Hb9DcFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644076179, "uuid": "f113ede4-355f-47f2-bd54-d8399f5143ee", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644076179, "uuid": "4e309277-ebdd-4227-8548-2acfaf6ff983", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644076179, "uuid": "66e8011d-e793-4690-9000-7cd34bef8dc5", "value": "e5f9cc95bf5794ff3b23cbb3be2f2536b923cdf128e95f36384d0a2010e1b4d8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d73b3f-86bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644090130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644090130, "uuid": "de76c83e-e7bf-4c56-9b6f-17e4ef952674", "comment": "Malware payload", "value": "1fa9d58f3ff02b5b040f5cde3e261552", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644090130, "uuid": "9ee48fcd-3013-449d-8d78-1201dd22863a", "comment": "Malware payload", "value": "e63774b09a49844c03618c547946a3ba2ac50d64fd0d96be4e5069fbe7802c80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644090130, "uuid": "a9ce34c4-8bf0-432f-8218-0b4e21703655", "comment": "Malware payload", "value": "4daaf3e8e5ae82b7be465420948e77f2e31361dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644090130, "uuid": "ff71da3b-5d02-4d7f-871f-38af432bfc80", "comment": "Malware payload", "value": "b550b27f22a2749a552fe0bf6e4ce78a2249016c54c57805bd7ec044bb8c6265ace180bfe8ac596c5fd660882515c2eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644090130, "uuid": "e3acd8e7-de9f-4c76-a83b-e11458eaac32", "value": "T15035AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644090130, "uuid": "292464d2-ba3b-4f9c-9036-582d0e6d46e2", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644090130, "uuid": "c46fef3c-62f6-437f-9993-7f6f0e9e9bd6", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvThFIIm2m40:wfv1GVFF+765nFvFf6dlzzS1FIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644090130, "uuid": "cb9ad1af-82c4-4401-b3c2-cbdede969851", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644090130, "uuid": "a6e9ccd3-c8d5-4a01-bde9-3f5f2b49aca0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644090130, "uuid": "dcca5bf9-398f-4c81-9f29-b0b350d2e010", "value": "5hywwAvgU.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502b8be2-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088242, "uuid": "ede73d15-c508-44f1-bff5-3545b9950017", "comment": "Malware payload", "value": "0a8cdb77f334f3f5d542509ed70ace70", "object_relation": "md5", "Tag": [ { "name": "b8", "colour": "#19AEBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088242, "uuid": "844a98a2-9a01-4e98-ab27-e71ce4c952b2", "comment": "Malware payload", "value": "e67dae94fee7f9bf703263090d673c9de20d1caedcd1841a8b867694360c4bca", "object_relation": "sha256", "Tag": [ { "name": "b8", "colour": "#19AEBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088242, "uuid": "fd4f1c68-5a5a-45e3-b586-466a5a700050", "comment": "Malware payload", "value": "95e493da53b720985007df8f28817b94b7d9a902", "object_relation": "sha1", "Tag": [ { "name": "b8", "colour": "#19AEBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088242, "uuid": "3a786a37-410a-44ee-a090-db98992b9088", "comment": "Malware payload", "value": "3c9d36e828c2899ef6b274bcf334ffc1fff3c64f87d98b416c0cebf4658d3eb544e9241c5da5bad3baf39e20ddfdea63", "object_relation": "sha3-384", "Tag": [ { "name": "b8", "colour": "#19AEBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088242, "uuid": "a037f533-4fc8-4940-9c44-ebc0078530b5", "value": "T1EB73F046FBB9A033E6E306B251E75155E071BC695272E2D9AEB83F4F0CF1281599C3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088242, "uuid": "e4e66b02-b3b8-4c65-8cd6-5d8b2e37da59", "value": "aef439f1829f69458eb455e4017c94f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088242, "uuid": "03b47652-246d-4147-806a-c9bb24052957", "value": "1536:VuYQ41LS06TLdEFVnOZ/t4RCjYWXrKMxLZkbpiaH+yDdN:JQZFTL6BeGCjNKMtGbpiaeyJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088242, "uuid": "2ecfc0b6-086f-4153-bbcc-2b628a7497d0", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088242, "uuid": "d088f3c5-df5d-43a1-952b-153aca514740", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088242, "uuid": "6d49be3c-6e31-4bd8-85e8-f0d423625fa0", "value": "b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac4c291-8626-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644026197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644026197, "uuid": "379f7ab9-e0b9-4a76-aeb9-6a7c9e851a8a", "comment": "Malware payload (DCRat)", "value": "fe948ee325358d20c686cd6063b0b3ad", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644026197, "uuid": "74df22d2-cd83-46c0-a51b-2ea688af612d", "comment": "Malware payload (DCRat)", "value": "e7bf2cd1a6e1db431b153f0263ae060e9a176c9310467d6b103a64331c070a38", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644026197, "uuid": "d8093f24-61d2-447f-ab10-7c4ef9387504", "comment": "Malware payload (DCRat)", "value": "842070eed5506dfc9380231ce9f3b12fa1aa3735", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644026197, "uuid": "d9f73654-1501-4342-a40a-e8eb4360b8d2", "comment": "Malware payload (DCRat)", "value": "7fd849a49779f1d9c550d47e68f2cdbcf1d0aa7472aa85eeb70c6b4f22a5d887644c765a498232a6252106167346ce77", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644026197, "uuid": "8296baeb-6809-4b64-b473-67977058aac8", "value": "T13F95C0342EEA5529F17BAF7DC9F07596976EBDA33717960E04A1028A0723B01DDC063B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644026197, "uuid": "cbc4f1cd-dafe-4932-a416-b6e2be34ceb8", "value": "069407361307fa34b23ade96ab2d8363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644026197, "uuid": "af15e421-41fe-4895-a60f-d9fdc430bbdd", "value": "49152:KEAmTNSb6wfoMOw+TZl2EA7ZFh/lXldb0pM9+k:IEMio7NTdbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644026197, "uuid": "fda353f3-011b-49db-aa6b-05a23d5d8f53", "value": 1969906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644026197, "uuid": "8e4ddf2a-bc4b-4bd9-8547-c6c05445fed4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644026197, "uuid": "6a8d5259-6b62-46ee-8eb2-854f92c88aae", "value": "fe948ee325358d20c686cd6063b0b3ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6b9db6-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "f00e7496-5744-4477-bf27-e3858836e9ed", "comment": "Malware payload (Heodo)", "value": "66389a8888ed1f223281d2b2e49654eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "92d23331-ffc2-4097-8581-894a2a9a53e5", "comment": "Malware payload (Heodo)", "value": "e97beb680b61be92c1ca9dd9cdd9a4fb52bd4fb59f9aae4311d571bf75eef2c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "41b3bd44-26ff-4222-9a08-216ff293f025", "comment": "Malware payload (Heodo)", "value": "f344f71015984aa0f87050ff3fa1f0fbd068ffe2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019865, "uuid": "1df18aea-b0fc-449f-bea5-cab56731e1a0", "comment": "Malware payload (Heodo)", "value": "342aa165a96ca21355ac4b60834fc1b929ee4404c7acb5c78a85d1a6510944b4752c75946613c05747416d32a89c50f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "ded05d0a-d256-4f76-8fd2-dae445434743", "value": "T1D835AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "8d3efa46-0ece-456e-bb1e-6b927dbd031c", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "31232b89-4f72-4664-8e33-b7213de1fffc", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTJFIIm2m40:wfv1GVFF+765nFvFf6dlzzS9FIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019865, "uuid": "39ec58b8-327b-4323-9c0a-b6ca068bebcb", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019865, "uuid": "d299aadb-5d14-4509-9e10-6e87393e0832", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019865, "uuid": "57c08582-ec8a-43ca-8c93-3c28b3b46cc0", "value": "emotet_exe_e5_e97beb680b61be92c1ca9dd9cdd9a4fb52bd4fb59f9aae4311d571bf75eef2c7_2022-02-05__001056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4dc555-8668-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644054517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054517, "uuid": "76e8c8d5-43cd-4f9d-9477-6da5a4a57040", "comment": "Malware payload (Formbook)", "value": "a4a7f1de4db4b63e9ef7b589db2d3dfa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054517, "uuid": "c95e4b72-d64f-42fd-b5d2-4eec6b36881c", "comment": "Malware payload (Formbook)", "value": "eaece620fa5ab5f38fb9c2b9d649e10c7e8c46982fa35a5df70a903a84e9ec7b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054517, "uuid": "a6746872-d938-459e-9589-d1ec3e93f1b4", "comment": "Malware payload (Formbook)", "value": "0e8eb97ff476535c0f2473f78afe95068b111acd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644054517, "uuid": "21ede799-bffb-41b4-a46b-91050097abf8", "comment": "Malware payload (Formbook)", "value": "0081c104b4640764ee1a5ff02d24071dccd9639b47c9ac75e2c072cc3c3eae1fd61ae21156e61baaf18b17329811253c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054517, "uuid": "9c6c3deb-0752-41c8-901d-885853404a82", "value": "T1F88423DD04BB45116B6F79E2203D03995C96FA38E5CB43EF08EAC09172A3B14B8EF556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054517, "uuid": "2b55e146-30b8-4f87-babe-4110c6aebf08", "value": "6144:7L8DmFcM/yq3rP0FBCeS/nIc4+N0FCFnl/DEd2c063QyOecYpvdaObN3F:7o09prHvxlBEd2NyXRN3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644054517, "uuid": "9746eb1b-4abc-496c-ba16-99829d07dc7d", "value": 385508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644054517, "uuid": "9ae5cae5-8348-4bf3-b1d3-0e58aea11b94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644054517, "uuid": "123b25ca-7fec-41fb-909e-12a099b739d4", "value": "1643996178.Vfc11Ibb2debM227972.dynamene_016-26404851.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb075f4e-86b7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088448, "uuid": "d0a55c11-7730-4160-a364-b65751ae8fd1", "comment": "Malware payload", "value": "175dbf33282ed471b62d616be435a03f", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088448, "uuid": "6f023560-4317-4e09-9262-ca957235711c", "comment": "Malware payload", "value": "eb02673ceb75c8eebcfacc8c00a653ca237fd8125af43f1d44e296614029c9b8", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088448, "uuid": "4e5a0d13-2b12-4568-be70-89b806aba955", "comment": "Malware payload", "value": "8d0a9298ab3af4827f47a90e3fbbe7073e5a9376", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088448, "uuid": "95bd2d2d-d164-498c-b017-8504da1f1d43", "comment": "Malware payload", "value": "3af837f8dd2706dc37ea71f4ef526974d825df3153d05035279d1543e8f12c95cbd49e2f4a3eef5141a290801444906e", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088448, "uuid": "c368c1ad-72db-4d7d-9b37-f270a4373f92", "value": "T1B351740ABB07AB94445364430DA28C5EEFD5C4645630A8ECBFACDADA314113D9F944EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088448, "uuid": "a5e213d7-2bc9-4dc0-b172-c05beac72be1", "value": "48:qbfDFR4srkHo3DshlBMF1rOzn+e8WHeFoNrmdi284Zj09gRKggO:2fZWsIQ/rYn+e8W+FoJMi2td0ClgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088448, "uuid": "c3faa233-fb00-4ef5-9366-c51a11dfc4fa", "value": 2832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088448, "uuid": "74755904-5e61-46f0-aad0-4c9cde6a305a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088448, "uuid": "db49a20f-b8bc-489d-817b-63cafb200567", "value": "cachemire.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb1cd46-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091221, "uuid": "2748b46f-54b2-468e-b461-fda2cb0904de", "comment": "Malware payload", "value": "f3f60781ccd4c9c429a1431f0162a295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091221, "uuid": "0924e4ce-7873-49cf-8f8f-c760802d38d9", "comment": "Malware payload", "value": "eba64fbdca2336cb01798ae6914f60f8b2a0a792224d9ad42c3ca006308afcd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091221, "uuid": "aae5ffee-ea11-478a-9929-a7201a108b26", "comment": "Malware payload", "value": "d6ff0b428178a9898f1552a0d18e59b48686cb67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091221, "uuid": "12c01097-cda2-412a-a6ea-923657897ea3", "comment": "Malware payload", "value": "345c8c83fdd49530ae17c1eb663117ed910f38efa30173eb7c559a97a81566885a494d6cc89c75ead124e104fbefdf90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091221, "uuid": "f98dd948-5ce8-4658-9252-7449120b5155", "value": "T1707301F26AD6F79AFB1166BF145029D48AD44B9CA14380B28747409DBEBB5F38D34F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091221, "uuid": "0c7b2258-274e-4d41-9d66-dd2cf82e7f8c", "value": "8a745e211dcde36e69f02b5f08644f41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091221, "uuid": "a54a13ba-2f54-4792-92f1-d44550c80a0c", "value": "1536:P1W8xCqs5dv76tt7/rzrfEqDG7q9PubDY8x8c:P1Lx3C76fPzrc77OWw8x8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091221, "uuid": "b0431479-b303-48e5-99b4-8820d0dd071d", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091221, "uuid": "f3e3ae22-8953-46e3-814f-d4b460091a18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091221, "uuid": "f55bfaca-825b-4220-9ead-7df1ad357e03", "value": "wargames.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569ae4fe-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091259, "uuid": "21e4e21c-34e1-46ca-8fc0-5a1c337c119c", "comment": "Malware payload", "value": "3da254ab9def856d64f0779ea6a6057f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091259, "uuid": "6ff420a0-e9f6-440c-a0a4-73f1ff41ec10", "comment": "Malware payload", "value": "ece298679b5588da28538bdf7e2f8bbf71ede40b7c591c658a607a7eded7234d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091259, "uuid": "1a6ebd55-15f5-4c11-a3cd-91bfa2327853", "comment": "Malware payload", "value": "31a005985a793d2b8e84dd747c3fa17c721ddf60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091259, "uuid": "30bebd83-29fe-47e4-9f31-9fceb7c0496a", "comment": "Malware payload", "value": "528c9c22cddba524e0d5ffa7e5ad911aa397d7ea7885f5e77aa57c34c09bfae636aee84ed233f3dba7300ea481476640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091259, "uuid": "4c00fd40-cddd-44a7-98a9-f0a13bb05e48", "value": "T137D181E37A3D61E2C287823643A929167E9EA0F067EB9B407E40B54B6CC6144443CF29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091259, "uuid": "b3dbd091-4ff8-4fbe-a67e-66ac5df80fcc", "value": "f132c3ccb9140d21cab2ed20c95cd228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091259, "uuid": "232f8f58-afd5-46ae-9642-60dec338e9a3", "value": "24:OEhu70gYjO4RajMcT6rn1bKBQgDnBkddoaSEm/r6qSeF6kY8NjTdwZZW9uBp9j:OEP7StjsKB9BfEmD6qSeJY8JTaZZJB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091259, "uuid": "58dc2b4e-30b6-406c-ae15-79fd07f10572", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091259, "uuid": "270b84e9-2847-4a30-a530-dd75579902c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091259, "uuid": "9060d27a-de4d-42d5-8556-211f9708c344", "value": "Twin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaeeca1-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075401, "uuid": "488c92be-8fb5-4342-a5b1-962d81e29c5d", "comment": "Malware payload (Heodo)", "value": "48d1f61b52efd01a2ca8c05ff882f390", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075401, "uuid": "4bd20115-2edc-466b-acc5-4efdb42b52d3", "comment": "Malware payload (Heodo)", "value": "ed5cc4c4878fb3433c853b6129232a6dd8da5eded42eba915e8c52ac0c201e7e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075401, "uuid": "6524c3c6-0249-4208-abc6-e521519217c1", "comment": "Malware payload (Heodo)", "value": "2ad6b66303680ba83ceec047263c923181e75577", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075401, "uuid": "96d0dc26-6788-45ac-bcfd-546aa1452dbb", "comment": "Malware payload (Heodo)", "value": "c5eeaf16be39e1f88e1216ae8567943855e83d4d8346a4c59bbea6968b77b85146aa8946bf853eec04451f508ab75257", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075401, "uuid": "83387b48-256f-4628-a43f-d850f3537e60", "value": "T1CE25CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075401, "uuid": "8ab675ba-3325-4d3b-b1bc-15641a55b481", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075401, "uuid": "bafd0a3e-09bf-4cbd-905c-2815bf58349b", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPxFIIm2mHv:exyq2kpWGWRCLWeNWO1typFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075401, "uuid": "f9a01463-bb74-41d5-920b-0197f9e9a116", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075401, "uuid": "dd63b18b-da71-40ce-99b0-7c7ef5023776", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075401, "uuid": "ad966169-f8ab-4d2e-abcf-007f876ba15b", "value": "ed5cc4c4878fb3433c853b6129232a6dd8da5eded42eba915e8c52ac0c201e7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b623b155-866c-11ec-9275-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1644056201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056201, "uuid": "0776c8e4-e8cb-463d-93a1-6604a1310249", "comment": "Malware payload (DBatLoader)", "value": "6254756ba22957a2da1ba23584781134", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056201, "uuid": "3dcfffd1-3b4a-43b5-b9b6-db3079ed9e33", "comment": "Malware payload (DBatLoader)", "value": "ef50c5943a01eb155acc81b7a4de6749ec5e438666bedc6be95f42ad92bb7c36", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056201, "uuid": "3f6968a4-e7ff-4b80-8b82-d75b2399da54", "comment": "Malware payload (DBatLoader)", "value": "4ec6729d6a69a658138cfb5ff3ba642b8603a5b0", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644056201, "uuid": "952aa3bf-b347-46b7-86bc-4cbf56d290f9", "comment": "Malware payload (DBatLoader)", "value": "db24876b02e4361f86c65ebce0eea5df4bc1a0a51b94be92233d3dea17b71ec9e9082bd41b27617bcce6c4679f7b83b5", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056201, "uuid": "ba4b1431-c6cb-48a3-889d-43567f9e2e12", "value": "T137F4AF23B6D24837C466167D8C1B87A9593ABF113D28A9B62FF42D4C4F3A74175382B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056201, "uuid": "1c6aba56-87f2-483c-b73b-928022e693c8", "value": "dd1ea92b29a7e8d5025356e5f058d9f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056201, "uuid": "92756729-07d5-45df-a485-ffcdc3b0e7b4", "value": "12288:VESyijagWIAzEgLznWIRQ1FaV8xV7/w+C34OYsOuok/Y1b2n:V/RWFFCxhIz4jC/YN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644056201, "uuid": "29276109-32b8-4374-afc9-1ace8fc56725", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644056201, "uuid": "e3e16fd4-2f74-492c-ac99-aaa3e33362c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644056201, "uuid": "2b7d576e-5178-4973-938d-1853946bc023", "value": "Order Confirmation.088373637.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfaa3d3-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075404, "uuid": "d3457296-cd8a-436b-8b3b-4a8ffbb3ddb2", "comment": "Malware payload (Heodo)", "value": "e9b5c0d74ccd5b63d7a6a6ff324cf73d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075404, "uuid": "c3d5362a-45a3-49a8-abf5-dab0ec141d35", "comment": "Malware payload (Heodo)", "value": "efa6e280425ce3b3cec5dd6902b27ad7bf667e3cb8156a2327b0e7141eee8c40", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075404, "uuid": "969a3ade-d29a-40f0-aade-7cbfca46a449", "comment": "Malware payload (Heodo)", "value": "c7bacdf68302acd657fe17214eea779313af7017", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075404, "uuid": "0273ca89-664f-4c09-8532-f6191a5107bc", "comment": "Malware payload (Heodo)", "value": "9bb3af5a163cc4ff26e4992868e6d842fceb89a9d59f4527036f5f9232f7cd61ff6a6ab095b9071468b95f3b9d3c7f79", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075404, "uuid": "2d3a8e12-c448-4773-a001-0c70387418f5", "value": "T14425CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075404, "uuid": "1f55d3cd-2667-4684-a4e5-2e0d75bac64d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075404, "uuid": "68e30642-8d41-4c03-8fc5-118d5be5f049", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyP2FIIm2mHv:exyq2kpWGWRCLWeNWO1ty+FIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075404, "uuid": "7a8d019b-7544-4f75-97bb-51acd327befa", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075404, "uuid": "1998305b-9382-4e8d-a678-328e1a6d9ed1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075404, "uuid": "1a5fcf78-198a-42ab-8522-3a3a3ae19e98", "value": "efa6e280425ce3b3cec5dd6902b27ad7bf667e3cb8156a2327b0e7141eee8c40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e70e60-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644086992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086992, "uuid": "34b729d1-4859-48fd-bfb7-2a9426d481d1", "comment": "Malware payload", "value": "f19278caf2e95e3abd31ad269e1b0814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086992, "uuid": "a86aaa30-dc4c-4381-8e9f-7dd0068cd4f5", "comment": "Malware payload", "value": "f0ec1164f2ad00eaa7b24b3f5bc40cf5a2baefdb2a2bf17b721092386d126e3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086992, "uuid": "656408e7-cb54-421a-bc1e-4a82756d5a91", "comment": "Malware payload", "value": "4b202c2aabe0a59addf103626cfb304835ecda2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644086992, "uuid": "abac0b24-8eee-42fc-a4a2-92671b846958", "comment": "Malware payload", "value": "a53652c4917bcad5e2d7de78779efa4c95ec7de004059ca6bfe6dcfe7e95fd605d2b8114547ee6697baddba422535664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086992, "uuid": "5ee8816e-ca77-4dc0-a648-e5a187319f40", "value": "T17AC119C3AAD815A3C111C23363D169A779ADB5E213DADA5DBE8C93476CF36108224F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086992, "uuid": "467a7854-2f5a-4dd5-ae5f-e785f907a042", "value": "e4d5cae16bfc63bf92d507022478da26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086992, "uuid": "d4c341dc-1512-4d14-9a5f-6c2b95978423", "value": "48:OEP6VIVpr2CmtYMACnOWSudYm1dZz2M2qP0ZLgxiqSeJY8JTaCqCB1:nP6VIVHXCnrSu+Sz2dHuqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644086992, "uuid": "2d1949df-1d5a-4747-8477-13c523266072", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644086992, "uuid": "51328b0f-f78a-42da-a319-fa72f3797eab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644086992, "uuid": "9b84c206-63e4-447b-8f66-c1ee507cabb2", "value": "Falken.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f47c4c5-86ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644089663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644089663, "uuid": "7c5f56ad-ce9e-432f-9446-a85751b4cbbf", "comment": "Malware payload", "value": "66e036bb883e6e1385f9f67958bc27ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644089663, "uuid": "1e9ec127-68ac-48d7-860f-ca453e1bf13a", "comment": "Malware payload", "value": "f2b1129e2deaa21ad1cbaa014d087d9ce536c7e04ec44fca36afc556508d10a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644089663, "uuid": "af25ddc2-ed90-4a61-aff2-15607ec11299", "comment": "Malware payload", "value": "5cc09c2448494bad393f6c208eff73d5fd5e2659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644089663, "uuid": "70fcbeee-91b7-4a65-a801-7ed5c6da6c54", "comment": "Malware payload", "value": "5187dbb2f7de35d3c741c8c1e52d6d00794cbbd8aa3b46c19c8f441293215ef56ebc4651b235f5094ff9dc8e95dd7991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644089663, "uuid": "91ca1ed9-d789-4489-bf09-0dbe4d81d0fb", "value": "T1E6B32B456F0C951ED714417BB4F4DD68EE6C790C3BFA86D36F932ABA24093E198F408A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644089663, "uuid": "3e79a725-0919-4616-a936-116dff0ab9cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644089663, "uuid": "539ba21c-7d01-4e63-a498-02a6b01754ef", "value": "1536:UJNi1F9bdbpbENQW0CYfYGt5G+P59mL6PAQJlnpxPW:UJNiL9bdtgQlxqoAQHnpxPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644089663, "uuid": "4f3b8499-1d5e-4bef-83c3-cc09d378e9ee", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644089663, "uuid": "13f9e2d4-ca09-4f31-a727-67c3ca7be89f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644089663, "uuid": "121f56c9-34ea-42af-87a4-9f06bac6d686", "value": "MIX1h1_20220204-214440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944152a7-86b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087068, "uuid": "286b5300-2cb1-41a1-91ee-5b12dc0b3acb", "comment": "Malware payload", "value": "997ae169da2f57e7e48e6862eb70223a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087068, "uuid": "773dd10f-c5aa-4b44-9cec-4da93e3f6d0c", "comment": "Malware payload", "value": "f47edab8a435f3c36fb92e25dbcaa2cc0f087f96cc1578a62cbf165fc6be8321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087068, "uuid": "ce6dfb4c-aff5-491e-ae5e-a50ef4d79c94", "comment": "Malware payload", "value": "b7349d6e5c65551d1162597cf4871b0c8e04e6b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087068, "uuid": "73ce0dc5-a468-4cee-ac0c-4740eec1cd6e", "comment": "Malware payload", "value": "b2bc1bb3cedb2661958b97d02045be712856757f2d2b36e624140190bf32117385cba598cd554c700bef50af6b83b108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087068, "uuid": "1f6ceef9-3482-4641-b333-6bfafda18011", "value": "T12D02B51F2A20EC81C0D4C7B0072B563CED31D67213A9A6074BE4AE4E2C393B4B85DA5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087068, "uuid": "ba24dc65-ab42-4972-88c0-dddc119401d5", "value": "a960387868727f7af935ac913e01e6b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087068, "uuid": "be993ff7-f7e2-44bc-b32d-b367c4becee4", "value": "96:nP2Y7tOvzNose5rLXVIJgAngqcqBnmKWPknzJyJJyTn0hwocxdWS:nmzOLGx/7B5JQJJhwocxdWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087068, "uuid": "b3099307-385d-4269-9af7-dacd2dcb4684", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087068, "uuid": "aee7dd04-da57-4efc-88fe-618ccf36812a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087068, "uuid": "c93966c1-253d-4245-92b8-6b3dfbab6c21", "value": "SETUP.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b50470-8617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "178cd1a0-fb4d-4655-a36c-7c1e0e1e2712", "comment": "Malware payload (Heodo)", "value": "99ccfc76a65fdde7157a533fc5098446", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "6e4f7b23-d5ea-4833-8acc-a5b5739c27a7", "comment": "Malware payload (Heodo)", "value": "f493cb1ba25345413385d61d38c0e8ec6b880273df80280ed5e5033e44865a88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "6cdb80b4-225d-4a37-b722-1181cc4696ca", "comment": "Malware payload (Heodo)", "value": "29030c542ef11f854e57364f43314b083fe91571", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019720, "uuid": "42b4ed3c-a8f6-439c-ba0e-87b1a8222ff0", "comment": "Malware payload (Heodo)", "value": "1f0d84e925e69261fb17ea9c12048d0a84a8aa54d16d136b1935865a7399af9e350af1d72eda90f3a19239b8b40ad17b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "078d6774-21ab-4469-83f5-cc481819a7bb", "value": "T12325AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "1e687112-eec8-45fc-969b-a75b10eb55d7", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "51a16a6f-2aed-458f-9444-b8d9c33f7a51", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxHfFIIm2m42:1ZsYB7vLsnZI1Hb9DqFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019720, "uuid": "92d093e2-4302-467f-afda-a968c71cc85b", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019720, "uuid": "61329ec5-d9d8-4cfd-9071-d063063d6785", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019720, "uuid": "7a7179ad-8470-4279-87ad-d96e8c885b44", "value": "emotet_exe_e4_f493cb1ba25345413385d61d38c0e8ec6b880273df80280ed5e5033e44865a88_2022-02-05__000833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4704da-8695-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644073604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073604, "uuid": "a5e707af-8115-47e1-b034-f258ce249972", "comment": "Malware payload (Heodo)", "value": "191f2a997a991529e393aec2781f7370", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073604, "uuid": "c9ad3634-7350-482c-b6b3-b508e93a01e1", "comment": "Malware payload (Heodo)", "value": "f540bc86a250f3ea8c0f7237d504afb817aa7a55db935fc97e3362c0a27a898d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073604, "uuid": "0cc07f20-164a-4176-a211-a28c9291f1b7", "comment": "Malware payload (Heodo)", "value": "7dcc35b90f3b7dc373600efb17fa288f5921bdc1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644073604, "uuid": "f6d971a4-3ba7-43c5-8c2b-6e4b5902e050", "comment": "Malware payload (Heodo)", "value": "fe34481e5aad9e024caf82f68d271282ecac169e91ac0c1208e3ae1fb3e8acb5fb3945b462cee54399a374e0cb1595a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073604, "uuid": "4281a9c1-23aa-4dc4-ae1e-34730ae379b6", "value": "T153E37C157255D9FADA04233109CB8BFA3627BC438E7183E37249F31E6F776509AD2286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073604, "uuid": "3568ea2c-8861-47ab-ab42-d9a4eef6fcdf", "value": "3072:wcKoSsxzNDZLDZjlbR868O8KlVH3yehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4Lcq:wcKoSsxzNDZLDZjlbR868O8KlVH3yehQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644073604, "uuid": "9dc02e9a-74d1-435b-84bb-e58833b9e903", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644073604, "uuid": "9ff2b4a3-5141-44e7-8c84-6993a0a73a37", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644073604, "uuid": "83bc7638-395d-43e4-bdfa-067e8f258698", "value": "eBooks.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0f0674-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "d3ade03c-441f-49e8-a596-1e410e051fb6", "comment": "Malware payload (Heodo)", "value": "6de0bbcf3fe40ca8764487f848f2740c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "5a1cb835-4f15-4caf-ba56-c48e721defbc", "comment": "Malware payload (Heodo)", "value": "f8710d009bdc36b02d1715b4f4a3efb136c4a21fe1e3e07011a5de706e505c12", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "189cbc93-af2b-4ec9-99da-d79eaa118af5", "comment": "Malware payload (Heodo)", "value": "d386eb4d934b12ac26063f785469f2946c451012", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019868, "uuid": "8c559b65-02c8-41be-9ab7-60ae8a7349b6", "comment": "Malware payload (Heodo)", "value": "744648ef8567b2c80824da2763cf304218a225ec27225b991f2d347bdf5b8dc8264b54815b0e61f7e344ebc485f21e54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "ef53453c-d174-4179-becb-5b35e70c4912", "value": "T19335AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "6cd9aba7-c106-4ae5-903a-5b3ab90c8971", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "6c1c5c25-68d3-4d05-ab1f-8175d3db3ec8", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvT4FIIm2m40:wfv1GVFF+765nFvFf6dlzzSMFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019868, "uuid": "f98342b1-026f-48cc-bae2-22484be2b787", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019868, "uuid": "3361a34d-b897-400f-aadb-558ee3de7d03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019868, "uuid": "09406e51-e1ba-46eb-818c-295e9bb59de9", "value": "emotet_exe_e5_f8710d009bdc36b02d1715b4f4a3efb136c4a21fe1e3e07011a5de706e505c12_2022-02-05__001102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076326ce-86be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644091126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091126, "uuid": "4f4071d4-18ab-4a3e-b847-3278d4b60e81", "comment": "Malware payload", "value": "6079048134255a415e569a57402d7c56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091126, "uuid": "349fe1e0-c947-4022-be03-426cc8eaf354", "comment": "Malware payload", "value": "f88aec37d60795ac97b73574b674bbf40bd8466dac54a33b1e1a8c0df8035391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091126, "uuid": "a20849cd-6582-477d-b5a8-82ed2ff40f19", "comment": "Malware payload", "value": "35867a4491825a6c2557e6103cb6164705d6328d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644091126, "uuid": "48a30c53-0e0c-401b-98f7-1327a68d5c79", "comment": "Malware payload", "value": "10f180ee97bc440bdbcb5b9064abff5c2643877e6a0aee1231fcab8ac691a9575a05004de71e8c1e44c2f4df181a901e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091126, "uuid": "747013f4-6e48-4bb4-bfaa-0f80e9619298", "value": "T198A2E021CBA9E6FBDFA18CB23A0F49C133A4B0F7B8462F430A6503017DD452C5C726A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091126, "uuid": "955e965e-c406-4acc-b125-f584e52f076e", "value": "9d17f950ae0b5e5a826e0d8260db8e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091126, "uuid": "78f5a185-23c6-4d42-88ea-dfe0ddf6b39e", "value": "384:lSJ9HntI4fzugyjNfGUhGbv2KDEGP9t4oidkUNIboJ0703NbLD5vesNvS:liFntFfGjN+Uc9wHoidRqx8jjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644091126, "uuid": "925c178b-548a-4081-85ee-e4e63e203841", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644091126, "uuid": "26cc2373-d183-4fd6-9541-969e8d923a11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644091126, "uuid": "880f8127-2c23-440d-aaf7-9a3daccca319", "value": "archiver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04a3b333-86b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644088545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088545, "uuid": "ee457b28-f70b-4908-9da3-47946b0734fc", "comment": "Malware payload", "value": "8781b9a791c0c144e97a466486f6ef33", "object_relation": "md5", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088545, "uuid": "4c6d1630-87a8-45e0-b241-8ff3f701a330", "comment": "Malware payload", "value": "f8d2aa73c17690f81a9c5127ed5a9fb87776fc51046fd13f4e39b95d9fb7366a", "object_relation": "sha256", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088545, "uuid": "38ae43f9-012c-46a5-a1c6-315b52ce68d5", "comment": "Malware payload", "value": "6872bc5747eb4701e579305c68c517e712f680ec", "object_relation": "sha1", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644088545, "uuid": "6a540833-07ae-49f9-a451-7b982ad30642", "comment": "Malware payload", "value": "cf07415b3014206034dc62e98a37fdd62b24b7dc35382ffcb9be484712405f00c57564b03c4db17339df5debdb5d433f", "object_relation": "sha3-384", "Tag": [ { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088545, "uuid": "2f26e5b5-87f6-4c2f-baa8-d31e008bdb98", "value": "T1FD71E7093741C8E276733D876BC24A4ED61188B157341EC8AB6DCDE2A6D1A6CE7A80D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088545, "uuid": "8b7e127c-84e2-48ca-8a38-0819f1fbdd24", "value": "96:ZMA4l1WiSgyVzHv10qBlEtpzXnT3BgpK81g0f7gO:y1SXZjF57gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644088545, "uuid": "34317504-8086-417f-954b-aafea402636c", "value": 3626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644088545, "uuid": "9b265862-b8fc-4c14-bf97-b3455c90d03d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644088545, "uuid": "66b2c32b-2180-4b14-8213-e6100dc0ac46", "value": "seven.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00248ce3-86b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644087678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087678, "uuid": "8e394446-918a-40cb-9fc6-97380d7b4e3a", "comment": "Malware payload", "value": "7b523f10e09815dd401a4db17a9813c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087678, "uuid": "f3a91c86-1541-4538-be0b-aadc94ad910d", "comment": "Malware payload", "value": "fa1940af36ed9d6756727d8436b01309c65ca123fbc1690ca9edae3b5136c92d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087678, "uuid": "28452f9d-6272-4585-89a4-36ffa5a12e56", "comment": "Malware payload", "value": "b7f647c90aeb06ee2ce145c152d09bf67966559f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644087678, "uuid": "429e66bc-8fef-4329-93da-39d0461a20d6", "comment": "Malware payload", "value": "c03a82afdf860ca7810d5abe3d1d50037eebd689095d323ef7cee5bfe5ae5a6598893ee454091041fae07448dd08a70d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "petikvx", "colour": "#883F6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087678, "uuid": "cebb406d-fb9c-400e-8c6c-6ed4bd929dad", "value": "T12FC11BD3217E6367F1C70336C6B1F034B99D74300A7F5A8B6C95E03769D75486828E64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087678, "uuid": "6b70a734-07c1-4b06-b9aa-d03f1385adee", "value": "76e5a93b5e3b659ae2823130b46e8307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087678, "uuid": "726fe15f-3831-49fb-9ee4-eafae6fa8fc4", "value": "48:OEPIg0s6W7KR1umlUrfHs7OY/UytwrMmsmTMQzl7hWqSeJY8JTa1r5B:nPILD00/junsm1lCr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644087678, "uuid": "11532967-edde-4893-953a-ed7798116ba1", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644087678, "uuid": "7e8f881f-5ba2-496a-aa15-8666f4f6e5c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644087678, "uuid": "b85f7789-7b26-41c4-9e45-78a94e2a03a8", "value": "Rush.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35ada61-8698-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644075121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075121, "uuid": "996e7de9-446e-4bd2-9322-e9c6fdb467bf", "comment": "Malware payload (Mirai)", "value": "865030a0984f3309cc236b67313e49a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075121, "uuid": "1ad6fd47-2ca0-4152-813b-65eefe4a9118", "comment": "Malware payload (Mirai)", "value": "fc5c76a017a40ed90461add50e7002f17633c62f90fac20a659be14860c56cad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075121, "uuid": "8b13f7aa-e9d0-45a3-9d75-9c38bfd17f52", "comment": "Malware payload (Mirai)", "value": "738b6243c8683bc958ef8da889964404a167e397", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075121, "uuid": "3f37b9e5-dc45-46f8-aead-860c714e025a", "comment": "Malware payload (Mirai)", "value": "69711a29956299f0f56c67d524c95891aaaa926788c35a0d34c2b781d2021c5b2e6c6bf137a3dd7bb9a84ab582be650b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075121, "uuid": "3af34128-2757-4ae2-87d7-5f646823172f", "value": "T187B33B0798615F73C045ADB529AB5530072BBA120F4F1F99B57DAAB4074F8CEB40FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075121, "uuid": "30d51cd2-b387-4d77-b071-786d8399a538", "value": "3072:QoT4WKZOYWIpEZhX5hLwn/nW9RLkY0Px9gQNfR:Qo0JMb/hX5hLwnPWbLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075121, "uuid": "ed257834-e9e8-4620-ab96-f5fdbff74fb1", "value": 108447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075121, "uuid": "17c145ea-e3aa-4389-8e59-02e9e3587efa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075121, "uuid": "291c3910-e5ac-480d-ab8b-a1dc71ed4b7c", "value": "865030a0984f3309cc236b67313e49a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb94d6e-8699-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644075405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075405, "uuid": "a7e46464-91e8-410e-9147-89bca86aef88", "comment": "Malware payload (Heodo)", "value": "dc14f6f270f4c3df38866a65d6a3ddd4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075405, "uuid": "028c3af2-0776-47a6-98fa-1566994bbe2c", "comment": "Malware payload (Heodo)", "value": "fccfaadda4fcf6f6a9665f9a88f81c0ea014baa849abdfdf9c0cf8725f25cc60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075405, "uuid": "2feb6a88-d060-4070-8adc-bf9715295dec", "comment": "Malware payload (Heodo)", "value": "777faa72b0e5a54e1fc046e46e7320214ad94171", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644075405, "uuid": "b6b3fd88-990c-4d4d-aeda-ba676aa52902", "comment": "Malware payload (Heodo)", "value": "c0e0f17ef4ac3615d8c65a7b487e17a3b8984ecd4d3a7e1d24d7063c53fb85589bf43b19579728e8c3aa298aa0112b14", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075405, "uuid": "a7128cdb-10ad-4fbb-bfab-c80527e9d2da", "value": "T1D635AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075405, "uuid": "d7e8519b-d68b-4511-8852-94ab5f2603f1", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075405, "uuid": "2048b3b4-017f-4352-bc59-af6811e076c9", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTwFIIm2m40:wfv1GVFF+765nFvFf6dlzzSsFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644075405, "uuid": "09ce2a56-3105-4fbf-a821-848376d7d168", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644075405, "uuid": "9d18a351-f73c-45bb-a562-758a14662f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644075405, "uuid": "3279918c-cb9f-4be9-84ca-d0579a08d4fe", "value": "fccfaadda4fcf6f6a9665f9a88f81c0ea014baa849abdfdf9c0cf8725f25cc60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc413b4-8618-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644019867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "55e995bf-694b-4207-84cf-1bebbc0df188", "comment": "Malware payload (Heodo)", "value": "88bc07897308f4db7815ca35f1a8bdc5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "dd27c357-c2e1-4346-9b29-e0bffffb5b01", "comment": "Malware payload (Heodo)", "value": "fee263a58e5d8a0389a13041fbe276808c4aba9bac171f2d2a37166f52a656eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "82ab597d-0611-44cb-a78e-b0f94c6048cb", "comment": "Malware payload (Heodo)", "value": "8b3bd2e9b2648efa6a3d8e5fc0568161dd4a1aea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644019867, "uuid": "36e824df-1fcf-4add-8f1f-d91d9e8e6808", "comment": "Malware payload (Heodo)", "value": "9cb1d189a1cbcb1590f41245915f5c6d26234452907cec371ed7b9d0298832fe07d2f733148d5fe949e054fad2ea6e54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "a07db546-e416-41cc-ae57-775e08776eb0", "value": "T15035AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "94f43c15-52e1-45aa-8c0c-f08e3ac3e893", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "1cf0ab89-7ff3-4f2e-9e47-11f285b8b293", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTuFIIm2m40:wfv1GVFF+765nFvFf6dlzzS6FIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644019867, "uuid": "817b2b13-2871-4457-b77b-8f93fc5d73f4", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644019867, "uuid": "cfb8af48-dcfe-499d-9480-b3db2bb83591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644019867, "uuid": "002cf451-fbda-48b2-a0a3-1088b0c63031", "value": "emotet_exe_e5_fee263a58e5d8a0389a13041fbe276808c4aba9bac171f2d2a37166f52a656eb_2022-02-05__001059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }