{ "Event": { "published": true, "date": "2022-02-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-24", "timestamp": 1645747382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1d0f88da-0e64-4803-ae2d-535a89f6fde8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b161d8-953f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645686013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686013, "uuid": "53ca018b-c9d5-403a-b404-fa4164790ac2", "comment": "Malware payload (RedLineStealer)", "value": "dc384479a24c1a5f6e001c146ab37eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obsidium", "colour": "#414187", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686013, "uuid": "ae220c74-3c88-4aa6-9ba7-916618e4ea63", "comment": "Malware payload (RedLineStealer)", "value": "00381e17c361fb9ff02a75fffced2f6f3ebec66d204cc56714eb58a13fc3fbf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obsidium", "colour": "#414187", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686013, "uuid": "9e4023d8-94e8-4825-9879-5764895d96eb", "comment": "Malware payload (RedLineStealer)", "value": "c47c91816e55d135e032b71ae1241cbb9a12d907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obsidium", "colour": "#414187", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686013, "uuid": "c4c22723-0780-47e9-a58c-6abbea2f5a43", "comment": "Malware payload (RedLineStealer)", "value": "28cd3c3ca84e29ca145af76bc70487a5f077130511b5f52347a71b3e79f5fb820b9101b49bbf0188e4628aa8eab36af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Obsidium", "colour": "#414187", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686013, "uuid": "4aa8a5d3-0f9a-4d12-a071-2b7356dfa037", "value": "T145455A4223FB526AF1FE5A3555B342148F6AF81B65F5850A4B3CE8EC0474904CA3BF6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686013, "uuid": "a0f7cb28-df98-4a4c-8770-66aeb37a664b", "value": "53638aa731e27f451c89cae8b37f6257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686013, "uuid": "ae1ebc76-70e2-4863-ba0a-339105a00a80", "value": "24576:YvZKBn/TliabMzs1jxvn1sconjUB3mkuCj8A6:1LlxQofWjje3phj8A6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686013, "uuid": "15479542-9a8e-4476-855f-c3acec9fb9af", "value": 1278320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686013, "uuid": "025826d7-0b15-4c00-be70-421469c2863e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686013, "uuid": "4b5f32fd-6483-4f66-99af-ea28b14e146c", "value": "data64_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b9237e-95ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732418, "uuid": "3ca79701-2e8c-42a3-a308-dc4274fe03b1", "comment": "Malware payload", "value": "5cee9f5471e84ef4df2733d371e019d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732418, "uuid": "4c5483c0-a8c5-4c5e-8e44-01c5d6e6854b", "comment": "Malware payload", "value": "008a674e33435ce0b892d0a68ac6d01f9606c040da87b21a10ed069729ee04ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732418, "uuid": "c0a1525b-8d3b-4aa3-a2d3-133ac91f6c13", "comment": "Malware payload", "value": "8f3d62d73b70267156e40a3cebe16430718aa4d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732418, "uuid": "3409ddda-904e-455b-9338-3c8516829b1f", "comment": "Malware payload", "value": "c51dbc5fcdff2b4b9926aa26bc017fa3d68bbfcf736247c1d6df41077d80f447408590289680c6b7087de0ccf54fa7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732418, "uuid": "d9865871-539d-46ed-bfd1-663e80a713fe", "value": "T1CDF37B17B2A540FFE0B6817585A72717E37378110770DB5F0BA44A7A1F273A0AD6BB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732418, "uuid": "855f7376-8fea-49cd-ae43-3e32d4ffa805", "value": "6739a8e2099115036a82e0f2cc7f27a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732418, "uuid": "260e31dc-b4ad-4524-9b1c-049299125327", "value": "3072:LgjO2yg5iUN+Sh0dCh/0HSMRNX4+OCMNego6AZ+qZoz:Ltjg5bThmM2SQNgAZ+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732418, "uuid": "1e95cbba-9bb8-452b-ae93-2b2d49e1a230", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732418, "uuid": "592eccfd-1dce-4d7e-9772-ebd3e0e118ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732418, "uuid": "6042c5c6-6ca8-48e3-a55a-d694d347f3fd", "value": "008a674e33435ce0b892d0a68ac6d01f9606c040da87b21a10ed069729ee04ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844f304a-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "27affdd5-e3b4-46eb-9d17-333cd2bae6f7", "comment": "Malware payload (Heodo)", "value": "bde24688775e623594b6f5d25572f8e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "b0c2bd4e-9d09-451e-aeff-7f57eca42654", "comment": "Malware payload (Heodo)", "value": "0151dee60a4de41889f77d433db59c300f51b26886930375903011c42cb0677d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "a96d7eee-0a47-40a3-8b92-a15ffb7509ee", "comment": "Malware payload (Heodo)", "value": "63a90948b938082ee5a0b9a910126c4f79a97704", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "2c049b59-a920-4b45-940e-8017db48feaa", "comment": "Malware payload (Heodo)", "value": "577f3201a7eeb01e76cb58f971048dc996ef27c6dad4320c5e8688354c0c7cc102a52b1d3ccc1e904cda52e99045b93d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "fdcc3c69-8b48-486b-9d82-0f0901cf853e", "value": "T1DEE4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "13900457-40a8-4921-a50d-a8931d28fe0e", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "39205c23-6456-48bc-bc9a-e0e604b1cfe7", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKfKDYjX3rUXY:ygHpbVy97U0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710539, "uuid": "4bb1e966-26a8-49ae-9541-9d33aac7e15d", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710539, "uuid": "ed60afb3-3862-431c-a7bc-17e4982c6efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "b16044b8-2c9e-4106-a14d-a6f59c6e4f62", "value": "emotet_exe_e4_0151dee60a4de41889f77d433db59c300f51b26886930375903011c42cb0677d_2022-02-24__134852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e94c0d-95b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645737358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737358, "uuid": "56466705-0bec-449c-96e8-d31dcc397124", "comment": "Malware payload", "value": "0a85c7126c5dfc5b1e347acccc25dae3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737358, "uuid": "59c8d541-df0c-44ea-9334-662b0bf80fad", "comment": "Malware payload", "value": "0158277e8e55640a0c0a111ad2e7e4f8140879729b9034733c973e7566bf8804", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737358, "uuid": "0cc6574d-a8bd-4ff6-93b3-bd023bfa4682", "comment": "Malware payload", "value": "94d702e75c0ac430003d7d986a038bac61689a0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737358, "uuid": "23870d15-ab25-424d-922a-c15d423e6ace", "comment": "Malware payload", "value": "eb0599ac0b6b36bbe1ae630a57ac441438eb42eeecc1a0417cd5f26f1bafb062e43fd00a57d7058f16953a0565cdc256", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737358, "uuid": "bbd3ced6-9950-4416-a258-5f1dc7165d79", "value": "T1D2E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737358, "uuid": "0e940ca0-800b-4874-9674-e552713c6f92", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737358, "uuid": "bc9db166-3024-4eb9-b6d1-363985d0c5da", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XMsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWMa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645737358, "uuid": "b6cabb36-8000-4716-9f39-bcd389cbd968", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645737358, "uuid": "6184bb8a-f639-4b87-b565-502f9e3d3a01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737358, "uuid": "ba98d673-5ad8-4f58-8cfa-74bf7779a942", "value": "0a85c7126c5dfc5b1e347acccc25dae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22739b4e-956f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645706509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706509, "uuid": "1f4869f6-fc29-4d52-85c4-8d8e6f35d3b2", "comment": "Malware payload (Loki)", "value": "a8231fe34ac997fb497be32ea7dd5ec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706509, "uuid": "055b23ff-eb3b-4a92-9fc5-d9b3f8ee3d23", "comment": "Malware payload (Loki)", "value": "018eb063bdb706558a85175f0be8cd1f6f7fc06c43d322a764b77741f6a0f004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706509, "uuid": "21ba6503-4616-42c1-a1d1-ca1f52c8f51b", "comment": "Malware payload (Loki)", "value": "6404f8cb22f39d24b47156231ff021efef84c204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706509, "uuid": "51c527a9-f0b9-4756-8aea-4c00593f8b35", "comment": "Malware payload (Loki)", "value": "263ab590b75f5b63e6dbf4888adf20e987ec226467491995ea4592968cf3923ecb626f4b55ac5d5c8340938fd7870765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706509, "uuid": "aad6b22b-97a9-420e-82f6-f9d6a136a5e7", "value": "T18944D02135A0C931D5A60E7188B5C7D0A62BB8969B70920BF674AF5F3F313E05A72357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706509, "uuid": "996e6ec1-f240-44ec-93ba-53b62e92c1fa", "value": "92a1c69795a56ffbd20c91bd1d013fdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706509, "uuid": "f674c58a-fdb9-4732-bd71-1cbc6fb74391", "value": "3072:Dv1RScV9ppGVlFIBJmEt+L/nsxkgaBCh6aYVh+1zRv4:T1lP7GNISEMsigaM1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645706509, "uuid": "d2a18956-cb4b-4921-830d-c0846ebbad80", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645706509, "uuid": "e4796448-6ffd-4784-a1ed-0d46b19a132c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706509, "uuid": "6d27e0b0-b5fe-4114-b112-30d77c726a73", "value": "a8231fe34ac997fb497be32ea7dd5ec7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27be17a-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645693060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693060, "uuid": "a92b9662-3d0d-4f31-a555-b8e5a1cefa4e", "comment": "Malware payload", "value": "de5774ebbbc86c9076ccce5343ea7cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693060, "uuid": "e0f4082d-c659-4904-a0bc-f53fab384624", "comment": "Malware payload", "value": "02cb1ef905c2350c7a95abc21de6cd41798581dea839dd5c02f2d2f274aec268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693060, "uuid": "de24d02a-863b-4da1-8313-83d731198fcb", "comment": "Malware payload", "value": "129604c77078fda585fce8d9dd2ddcec24bc74be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693060, "uuid": "f5fa2f8d-869a-4ad5-834f-4990c2824874", "comment": "Malware payload", "value": "9e31c7a7ed2b6bfe3761629d03f0fdb22ed7a925474509f6e46d5d5cdb9f6e52e9eb61bc90e62c8ba6b78b5021e26e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693060, "uuid": "08450a47-ed0e-4462-b669-58d080bc4263", "value": "T1F0641A543DA75F3DF1B18B724DC5ECB4BA98FB231C08B37D78556646C6A1B8088432BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693060, "uuid": "b83fa431-e947-4c5a-b9ab-b73eaa9681e8", "value": "6144:AUUwoO1hFPLd5K777777777777G7cF9cUEYhaDCjd4EWD:UO1hN3K777777777777G7cF9ciUDed4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693060, "uuid": "fd94266d-56c3-414e-9b61-d2f1c7c2b7d4", "value": 332709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693060, "uuid": "44abd67a-2145-4823-9bdb-cb18810934fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693060, "uuid": "cbd64d9a-b6ec-4ef2-89c6-50cee71d2c0e", "value": "de5774ebbbc86c9076ccce5343ea7cb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5b86a5-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645688787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688787, "uuid": "84975d40-85c9-411a-b7a4-213358ae961c", "comment": "Malware payload (AveMariaRAT)", "value": "b490e1c3a363d84178347203f4a39b20", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688787, "uuid": "49c6c7be-7a5a-47fe-bebf-c3ab3c852a3e", "comment": "Malware payload (AveMariaRAT)", "value": "02e038ab4393164f91b8dc9bf2e09ddccde0f4dfef9aac731767b241d4fea47c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688787, "uuid": "d2b4ee2c-59b3-491b-b911-8aeff39860a8", "comment": "Malware payload (AveMariaRAT)", "value": "0b4aeaf7f83b7fa9d467126397fb864954be0b8e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688787, "uuid": "fa510600-6c6c-4d41-9802-626952eb4bda", "comment": "Malware payload (AveMariaRAT)", "value": "8a7c90d426c52c2ba1d8fd988eda82d06acd82bf7da3d0c678cb4f0f1b0e15e3d1970db35e9a6f5050e6e01f7f65dd82", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688787, "uuid": "659c01da-9349-4abb-a9b0-1b3953318e7a", "value": "T18D35232E9AD30DC4E6BC24FD39B58A60CAC795603E72131632A7F055C93BB136B4D6C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688787, "uuid": "128cfda5-6454-4dd2-b2ab-15b93c2cae70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688787, "uuid": "388fde47-4fc3-495b-9df3-7167d96e36b7", "value": "24576:o88wUt8KzKSaQdLLn5LByK1adBkR/79MSQZ2RfuXr:qPtZaQ3PyDdCR79MSe2RGXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688787, "uuid": "ba0c0181-33f6-4679-9c0c-a6af3004bc9c", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688787, "uuid": "d2fa5861-6f63-41b5-bcf6-778c9e64bbdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688787, "uuid": "3be864d1-ca78-4854-910f-5f12b58ab24b", "value": "DHL\ubc1c\uc1a1\uc11c\ub958- 20180904153201117119330^^PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094e6237-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "4546dd50-52bd-4958-975f-075323120e33", "comment": "Malware payload (Heodo)", "value": "43fe3e24d90214d0d14e003b136cd27b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "de1f80fc-4de2-4f5e-82cf-1bf38f99c8d1", "comment": "Malware payload (Heodo)", "value": "02ef98ed1d00425c2874212fc9ab9d8b17e477159dd8801d0b26c68d26282ad5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "f3bff901-a2e4-448f-9f0b-d6df6cb339f1", "comment": "Malware payload (Heodo)", "value": "0b203344b0e690c55a562a7080075f6c24a9d14f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "eb10d4f8-837d-45ad-b9af-c51bb5a1e518", "comment": "Malware payload (Heodo)", "value": "21d1228f199aa3ee344e6f671f78a88c17aaa9a989bc30d6cf9fdd04302285587ce0102aebfe007b2656835370957dd4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "229081ee-032f-4d2a-9e52-2115ce12f3f8", "value": "T10DE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "3e059c98-00ca-41cb-afd6-13a13f8e45ad", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "2a75d790-10c8-47e4-a72e-54c6da8a887b", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKAe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKALzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660940, "uuid": "37240ece-281a-43b1-9660-b9d1b50d0374", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660940, "uuid": "a7ab24ae-6642-40c1-ad43-95e719c446db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "3f158503-4710-4aa0-9d31-45ca07e3454c", "value": "emotet_exe_e4_02ef98ed1d00425c2874212fc9ab9d8b17e477159dd8801d0b26c68d26282ad5_2022-02-24__000211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f31697-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696292, "uuid": "df7c68bb-4c68-4086-9ac5-6e1dce451648", "comment": "Malware payload (Heodo)", "value": "6770e4811ef01bbd551accd55e71f4fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696292, "uuid": "6eff005f-ae6b-4099-9efd-3770213cf97b", "comment": "Malware payload (Heodo)", "value": "03138781557045c8954ceb16dd59db0e3c77f536136fb7c703b891ba278c550b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696292, "uuid": "193a1476-eada-4beb-a820-ba0b46056f05", "comment": "Malware payload (Heodo)", "value": "d7c353a352995c32c6b20adf4c140eca5f254fb1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696292, "uuid": "1be01b13-5108-474f-86e4-c243bc923644", "comment": "Malware payload (Heodo)", "value": "099d89a6b0c30f270fd9d2a7531696933ccad45519197c8dacb466e5b5d8dea01c587a6da32ace850bb619e9b0549aa6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696292, "uuid": "74153999-49cc-4951-9033-63e16aa8b28b", "value": "T146E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696292, "uuid": "ca4a9f89-0c4c-4001-909c-774fe2892c98", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696292, "uuid": "e54053cb-824d-4cfa-866b-cdcc3b6cf91d", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK7e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK7LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696292, "uuid": "971cb5c7-42ba-401e-a6ae-e580dbdabcb4", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696292, "uuid": "ccf45bb0-fcfd-4e73-88a2-740a578edb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696292, "uuid": "e331c0bd-de59-4f8d-9289-8838bf6ffedb", "value": "WtnDorkf0kdtAq5mL4E6sc3pnXF1BN2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10cb3ec-955e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645699420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699420, "uuid": "1a5d5370-d223-461a-9068-e8854110c387", "comment": "Malware payload", "value": "84ba0197920fd3e2b7dfa719fee09d2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hermetica Digital Ltd", "colour": "#ED37D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699420, "uuid": "2c6e3439-3d18-493e-b503-0d6b62c41337", "comment": "Malware payload", "value": "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hermetica Digital Ltd", "colour": "#ED37D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699420, "uuid": "6ac400fb-7e3f-432c-9689-fdbd5409c1ca", "comment": "Malware payload", "value": "912342f1c840a42f6b74132f8a7c4ffe7d40fb77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hermetica Digital Ltd", "colour": "#ED37D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699420, "uuid": "3aaf9dd3-a6fe-4d2a-9017-19e63d60df17", "comment": "Malware payload", "value": "21ef7092c3a3a7ea4b500eda21b33d0c80c4b24e95856b99d1a332233cc90fe982567977a2746343e6f3d339063247c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hermetica Digital Ltd", "colour": "#ED37D0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699420, "uuid": "12648cda-6cc0-4df4-85f1-f042372d6006", "value": "T15CB325539AEC3CC6D47913B137BFA3E5D32EECA46A90C09E96D01182D57C5933A227E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699420, "uuid": "777fdf3a-7e2c-4fec-9c4c-90da26ce37dc", "value": "4233d97404e1fecedef6a46e0f7c09b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699420, "uuid": "f271bd1c-d470-4b4a-b465-886e55573ada", "value": "1536:lV3+WmNcWbwurilmw9BgjKu1sPPxaS5qY:lV3+WmjbwxlPwV1qPkS5qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645699420, "uuid": "7eb71532-3829-44f3-8348-3ebf0d4dc509", "value": 117000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645699420, "uuid": "1883a6d7-b600-478b-89bd-814483d34078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699420, "uuid": "a09428e6-8d05-4756-a0f4-35845024a315", "value": "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb97aa4f-9549-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645690525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690525, "uuid": "1bf8f762-27b6-4f38-a8d3-d0cfea806a17", "comment": "Malware payload (Formbook)", "value": "0e89e3b6e7c0a97c7ec8a5a9cf8d4339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690525, "uuid": "8a9db641-86b8-426e-9de1-e0258ae6f124", "comment": "Malware payload (Formbook)", "value": "03c24fbe7c863e8337b0c944f96847b5166297283727edccca056c4f6f688d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690525, "uuid": "ce1fa932-410b-4e72-89b7-054ae32d6d83", "comment": "Malware payload (Formbook)", "value": "96df76e5ec82eeff5e11c9c6e8ed8fa4f9d2b4af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690525, "uuid": "3d182170-36f5-4dae-a75c-05a2de6955f5", "comment": "Malware payload (Formbook)", "value": "e291cdf28ec467960562cb63008c4777a8d60de905e2140de6f0415fa64952f65119caecdfa11cffaf82c83bec740fc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690525, "uuid": "a5a5286d-52fd-4876-aeb0-3a5449987db7", "value": "T146159D62F191C432D01B16389C4B92699C26BEF07D2CE8477BE03F4D6E3A64D391AD97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690525, "uuid": "80ecc805-a341-4956-9538-e8f887051c78", "value": "1c02903d270a37655f586f4aa8bf43c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690525, "uuid": "c8f8cdb6-5ecc-43c3-9474-d30f74ada5da", "value": "12288:Cwkcdx+EleOmksXHxvkAhNSpCsJHr3A5W9S2x3pxjsppdTc:CBoxpeOmBBtQRJHrw5W9d3/j+pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645690525, "uuid": "1f36a265-7f1b-4851-9388-1c290e1eade9", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645690525, "uuid": "31a9a99a-cf20-4d9a-a170-127e820abc86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690525, "uuid": "f15c4349-d5c8-408e-bc4e-89806dc36bf4", "value": "0e89e3b6e7c0a97c7ec8a5a9cf8d4339.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f5db55-95a9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645731674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731674, "uuid": "8dea9e8e-4c7c-48e4-8db5-0a2fafe80feb", "comment": "Malware payload", "value": "905c07f457c24898927c4377a4366570", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731674, "uuid": "594bc870-bf07-440e-a5d3-47d069b863ff", "comment": "Malware payload", "value": "03de061a0a8fd5673e86457d82df0834bd553ab8aa2241e862456e19f7cc924a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731674, "uuid": "3e02e46a-a461-48d3-9bc3-303c5133898b", "comment": "Malware payload", "value": "0db427a615ffe6427b34ae37017c207be09fde60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731674, "uuid": "bc0be0ea-5763-4442-b2bf-e687f28f9c7b", "comment": "Malware payload", "value": "5dd9776860fdcfc6a8aa87dc5a3248cac5fb322d11ef04d51eda7e275c0041f8120d82de099f8ccca9fd175ba7680a16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731674, "uuid": "6cc66e2e-05a3-4159-9d0e-a5d6157fe4e6", "value": "T18CE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731674, "uuid": "7f181c46-114b-4796-95cc-da71453aaba8", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731674, "uuid": "acdf2231-f0d3-43fa-afe1-4a64789104ed", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XhsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWha1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645731674, "uuid": "e942a34a-e8b8-425e-8e30-c9433cfe7d2b", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645731674, "uuid": "8a6415dc-5ce1-42f8-ba3c-2b5a375d4741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731674, "uuid": "8d52e988-2582-4dcd-adbc-7b3aa5e3319e", "value": "905c07f457c24898927c4377a4366570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64da45d6-9541-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645686863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686863, "uuid": "dd1d719f-f1fe-494e-9ec6-0180e7149193", "comment": "Malware payload", "value": "4a32155b4125504e47642fab072421a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686863, "uuid": "fcf8340b-6dad-452b-a273-dd85a0f05eaf", "comment": "Malware payload", "value": "03e11ce0887aaabf456f42385c0b85c9099457393137df7bf2b97ec1dae28c47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686863, "uuid": "e00559c0-668f-4f6d-8a69-5e65380903d2", "comment": "Malware payload", "value": "55a286c8b4a697a81cc6b2d7c0fa88e0916b860c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686863, "uuid": "5c51e00d-e7a7-4f72-bcd9-c44ae4f6eb6d", "comment": "Malware payload", "value": "317ff41f49e29959379848a8c63fe3784678cc348d840665047eb2391a05de8eb93f60a398290764086367e0411a2f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686863, "uuid": "8ebaa14b-b3b3-4f4f-84c3-62cffc64c413", "value": "T1CD9512252AEF235EF064F5BD9BCBC23EDA45FCE551034EFB10556B9B2B446122E82870", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686863, "uuid": "d5fdc24d-b22d-4ce0-97c2-a12bc004d70e", "value": "b6e8aad2316b84657564d4c6133d2471", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686863, "uuid": "c14d0f1a-8e68-436a-936f-f894ff721c61", "value": "49152:aoSsL+Ax4UH/9LEnzjMdtCd1U9zfb/QiIBk+QqX0NmXqxJxl:9Iu/mnzwA1U9X/fI3Xgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686863, "uuid": "9d788fc0-5a90-43a2-a824-479610197f7b", "value": 1935360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686863, "uuid": "b9cc317d-664f-420c-8e66-bf75919288c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686863, "uuid": "2d1df2ad-90f8-4c0a-a1ca-58caac14d096", "value": "lilay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6ed075-95ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "d195a82d-d3b4-4c3c-b91b-fffa0750f59f", "comment": "Malware payload", "value": "aa7c29ff43f203ed9cd6b49961b55e86", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "8e0bc113-42be-40db-8aa9-fbe1cb7c391e", "comment": "Malware payload", "value": "0420dcfe1a2338f16264162a234d245736b51c06e62fd3ecdc3a5484a81d055c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "6a134fd5-f72e-430f-9cca-073a30fb3c78", "comment": "Malware payload", "value": "df57c50019aabdfb78bdf59b4db10f5846023595", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "8c96ddc2-ee1b-4741-b42c-bc43835c6b69", "comment": "Malware payload", "value": "5e0f4937dc41dd66a7a72a69609a96e1fb65a8209ffd8f122de521fbd289c54507d601d578560ae717c808caf0387f59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "f25b0b7a-6177-4bbd-aeba-80341103775c", "value": "T1A5E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "8c1ae156-ce3e-454e-b91d-e02c148264de", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "b779ae39-59c1-46fe-b854-d850d820578c", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XdsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWda1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732487, "uuid": "f1bb512d-6f06-4545-aa66-2ea1cf480544", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732487, "uuid": "341efece-0073-49a5-a59c-82702c8bada9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "de4e6a37-8bfb-4620-bd72-8241f2e53c6c", "value": "emotet_exe_e4_0420dcfe1a2338f16264162a234d245736b51c06e62fd3ecdc3a5484a81d055c_2022-02-24__195440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da522a0-95b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645734418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734418, "uuid": "0817494b-2fb5-4f48-8c29-f4592a7303e0", "comment": "Malware payload", "value": "8c405251de6c2168b32ba7c78e2685e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734418, "uuid": "4d84d005-b314-4fae-901e-efe7b9e2c57c", "comment": "Malware payload", "value": "0480400ddfce4148bae37d609f3b51255dc2f796e38a9abc1a0c26a7026d30a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734418, "uuid": "a3845c62-23dc-484c-882a-368eaad59553", "comment": "Malware payload", "value": "3d7c1ee692f1cedc7ba37556f3b0946c2c98a846", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734418, "uuid": "f2084140-4684-4789-b833-63fdeb1313c6", "comment": "Malware payload", "value": "ce67f7f72280a65ad76885acf6cfa3d91ab5d6ef034d415be5f0ad9ec5938eb06b5bf3cfc46b48d72c1203b60789af1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734418, "uuid": "433d12e7-6472-4c9c-8132-b1477a3df9ba", "value": "T134E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734418, "uuid": "d6886ab0-fb79-4d61-bb18-0dfe3d2328d0", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734418, "uuid": "d76a1bf5-9138-452c-8ef8-2dad6b7ed4c7", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0X0sD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFW0a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645734418, "uuid": "ef487a5d-9101-474a-9ae7-8ebffece9e1f", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645734418, "uuid": "8c6d334f-8e16-4b18-92db-4a3a9677ebec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734418, "uuid": "6b39dab4-98dd-4a49-966b-fcc4270ab5ec", "value": "8c405251de6c2168b32ba7c78e2685e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21aba04-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645693006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693006, "uuid": "824450ad-caae-4c87-b6ad-d25ffd55c582", "comment": "Malware payload", "value": "46072ee816a576f1b3d5ab6272d1ab43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693006, "uuid": "ca7e34df-2c22-4684-bdc1-3de2075cb11b", "comment": "Malware payload", "value": "04ae99f710a0ae503dcbb06ec284747b5ef037ba274ad9f912016a8a3f245709", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693006, "uuid": "255a8f11-c636-4848-a2ea-54b50ce66f9e", "comment": "Malware payload", "value": "8dc5ff001f7dddde515fc5bf8e765c9108980b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693006, "uuid": "14c7789a-5694-43b4-bc9f-f0b680e866bf", "comment": "Malware payload", "value": "81e05519ab4e8c36cbf98ddd9a1f562aaf7537c22104406ed987209aaff2a29b6655c3c9069cc2ea4e697f6ab5fef5e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693006, "uuid": "7cd50a84-6da1-4570-9693-609049088af2", "value": "T19FE36B1467FC4B56E57EA3F86938402907B6388E7161DB8E8ED1E1DF2D32B814412FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693006, "uuid": "7b0de51e-d40c-4ee3-a0da-27ab70fd93e5", "value": "3072:wtiT8H3IUvWvCs4c3Og8+9QwzQ9Q7PjW/USZId2:wtiTZHacQ9Q70zr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693006, "uuid": "ef26795d-2acf-4af1-b418-2ae48805f48c", "value": 145918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693006, "uuid": "0fd95eb8-4ce6-4bb7-b6c6-931b894696ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693006, "uuid": "a3bedd8e-4488-4ace-b8bc-bb44d81be0ca", "value": "46072ee816a576f1b3d5ab6272d1ab43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cb0f34-9566-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645702973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702973, "uuid": "c5bf4e8d-069f-4c12-b11e-c537f3270880", "comment": "Malware payload (Heodo)", "value": "83643dc581901ae878e8b628c1dcd495", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702973, "uuid": "1e8d4927-cf67-4262-b6e4-50ae0c460de0", "comment": "Malware payload (Heodo)", "value": "051a9a77b101a8192e42240484b1184348f2f0532f2da3429a78a32bfde26555", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702973, "uuid": "53bcbe17-fa9f-4844-bd06-305aa56ed91e", "comment": "Malware payload (Heodo)", "value": "976fec7e1a950713e82ee743bd670ffa44d03f0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702973, "uuid": "62432670-18f5-42d6-9448-9397401a220a", "comment": "Malware payload (Heodo)", "value": "43ffe7dc5a17864d8045fe08a91babc6ebd10dedf16bb2e6b04ddd231c8ea840e8a248c0ae6c898db0b635ae4ba779d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702973, "uuid": "1b0748a2-4e03-4bc2-8985-ec277affdb3c", "value": "T188E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702973, "uuid": "a7b59aa6-00c4-4275-8c86-67bfe6d39b7f", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702973, "uuid": "f9f1450a-50c2-4e55-ac71-4c89ba9f9478", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKUe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKULzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645702973, "uuid": "97be072f-87c0-4276-bc44-757df863a435", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645702973, "uuid": "fa1f1beb-f893-4556-ba6d-37ec79257ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702973, "uuid": "31b16bf1-a3a1-4bc9-b61e-e960277ab623", "value": "83643dc581901ae878e8b628c1dcd495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dc2473-9586-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645716364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716364, "uuid": "de149a9f-76b2-4db2-beb7-f9a5f78745e7", "comment": "Malware payload", "value": "172101628cd4fdfdfc83cf58b87119e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716364, "uuid": "a0adf68b-353e-40fd-9e9e-fcb2906af8df", "comment": "Malware payload", "value": "059a6c067f565735b25659c9537eaf1f4ce72f47ba325900f09872aea288bd0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716364, "uuid": "49d428e2-e291-480a-a5da-98d3a66ef8c4", "comment": "Malware payload", "value": "c9d154e743d03bf5b508746448563b8b2b4293f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716364, "uuid": "2fa43394-ffcd-40c0-8bb3-c09c1b39008b", "comment": "Malware payload", "value": "bd97f9a98286f971ad910aa8541027aed0c9d2c079fb55a730f3f93c5d11684a8c8f32758d2d1f45e5f29208bfd11048", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716364, "uuid": "6d1f28d9-2e4d-44dc-99a4-692250dbc76d", "value": "T1D105AE1253724835DB3B4F38ED4B12A89C15FDF2F86898F5AED4A8687B386512C5B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716364, "uuid": "15b70892-4e79-4fa4-be08-9040f8eb410d", "value": "c1121acfcf8b9aeea983fd06a6c0a74e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716364, "uuid": "d43ed864-17f7-4b04-92fb-51e65d729f4b", "value": "12288:l9hhPVn6mBXIlb5oC7QMbkbWlV4AuBmzKT5NQMvNHgTJfnoHu:/XometXnb+WHTWT59O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645716364, "uuid": "c33a61f2-6cb7-4e7c-93a5-29dc8406a76f", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645716364, "uuid": "4610e8f6-89d1-458a-9bd4-68ddb2b35566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716364, "uuid": "06dd1d08-8cc5-43aa-a8fc-0fdc2e12b901", "value": "44616.6383127315.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b282054-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645723408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723408, "uuid": "76291c28-93db-4edf-9742-e1c8e0520ff1", "comment": "Malware payload (Formbook)", "value": "657475d570d867ed6186a7c8290b767b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723408, "uuid": "5cd14cfc-5fb4-4129-802b-4caf3373f892", "comment": "Malware payload (Formbook)", "value": "05de97a65c6fb9cc4c6ca8382aa1e43e0caf779edc6b476fe6f725d6b2bc7f36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723408, "uuid": "45c190b0-c1fc-4a13-ace0-626c209cd428", "comment": "Malware payload (Formbook)", "value": "18a142ac15565e094dbc72d514a0dee1b10f420b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723408, "uuid": "2cd5fb08-7aa4-4356-8667-29563eb532b1", "comment": "Malware payload (Formbook)", "value": "808e6d7203f3ba659ba51c59f2ae3338a987b382cf0e27bfa35fccdcb3e24e539431d042999212d6e1aae0aa02a57017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723408, "uuid": "f7ffbfe1-f830-43d7-91c7-8ddbf65ad743", "value": "T11CF4E6B6CEF0D199ECDD9B3960F20CB116577E7EAABC695C5949B12222730C39172C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723408, "uuid": "47feb219-bdae-4860-9bbc-f5a542b7c7e1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723408, "uuid": "183ebacb-1017-4788-b734-c8fff8186b76", "value": "12288:6KlrJEbOUcBDmTO9iCv0WzXe3NDsyZ172BP0wC0Y93:pTEb7M7iCv3kfP7y6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723408, "uuid": "b393de84-2540-4aab-8d7a-68f7dc94d06c", "value": 774156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723408, "uuid": "b744eb9c-aa8c-4394-a154-0a4779b84b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723408, "uuid": "255ffd0a-5e8b-407f-9353-9a9628b62c4b", "value": "HSBC Customer Information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb87144-957b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645711653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711653, "uuid": "124da096-c201-49c1-a3bf-5226d276f51d", "comment": "Malware payload (Heodo)", "value": "dcce25ea507eda8d142e136e93d8f2e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711653, "uuid": "d1e60492-a9c0-48b9-9b6e-928581273c87", "comment": "Malware payload (Heodo)", "value": "067020ad8514c0522033fc9e5fcde225803f07dd1c10abea76f9ac30927b850e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711653, "uuid": "c5d010d5-fcdc-42b5-b415-57867f6001c8", "comment": "Malware payload (Heodo)", "value": "b690870a963ac645f10ce8230995d3e185d040b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711653, "uuid": "4ff4deb0-dad3-4694-8443-aa84eb00e674", "comment": "Malware payload (Heodo)", "value": "801f601ab3865f0b031fad4d39090e4b75d252ab8bbb9ec9fdc1143851579b1237beec7b0bf60b95cb89a08db50047c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711653, "uuid": "4bb1ffe3-2844-4105-b5e5-593a933ca5c1", "value": "T156E4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711653, "uuid": "56c297da-f753-4c10-942e-40051bbbc2e5", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711653, "uuid": "8f5931ee-fc8e-4c46-9186-961fb9fd15c0", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKgKDYjX3rUXY:ygHpbVy97f0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711653, "uuid": "39c46eb3-06de-4a0c-8a17-4444f5489923", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711653, "uuid": "f496b9e4-a8e1-4f79-8f87-e9e27a3b4438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711653, "uuid": "a7addf94-bda5-4e84-bb3c-f6bf0fa91b86", "value": "dcce25ea507eda8d142e136e93d8f2e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff703ade-95b9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "d372fc38-f5fd-40c9-bc47-7f314abb605c", "comment": "Malware payload", "value": "85971b190d18c21ac4a4b979a2ca2cce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "609c0f99-84ec-4fd2-9ecc-85d57d1768ac", "comment": "Malware payload", "value": "074f6e0fc30e76facbec4a6bb20b9a624adbc1f2a7530739f09fd2b5a8c68888", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "2464a3e8-eb40-4228-b93b-9ef7a8ac752f", "comment": "Malware payload", "value": "5ae468476cc37c390321abb219be256adcba4bf0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "fcd23ed2-9b98-4461-b244-0c6bdcd84df1", "comment": "Malware payload", "value": "ce104c7867749a63437615113cfe279af61fcbbee13eac938bead0c267228bd6cf405342eaa7207fcf5693569208ba84", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "829e3dd5-5ff7-4315-a64c-724921048497", "value": "T1E135BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "b51aaa39-71d0-4a5a-b31c-bd0a12efa405", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "c6ef73e2-3b44-4724-83bf-74dea0fd403e", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+u0VOe528JO6PC:6iRGcUY0UvDYNFtu45Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738662, "uuid": "57b61be1-4ef9-4d3b-bcce-0a7bf078364d", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738662, "uuid": "4a1806ab-2b4b-4429-9094-453b42ab4d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "ee735ed2-9041-4e67-8dd5-5d59d09263be", "value": "emotet_exe_e4_074f6e0fc30e76facbec4a6bb20b9a624adbc1f2a7530739f09fd2b5a8c68888_2022-02-24__213734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6f4bc1-9564-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645701887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701887, "uuid": "d46104c7-8ffb-4c01-b521-815784bc78e5", "comment": "Malware payload (AveMariaRAT)", "value": "ea1b6482cc2faebdf2c7f9feeec4e4d6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701887, "uuid": "8652f4bf-8e73-48f6-a6d7-0e3cc01aec6c", "comment": "Malware payload (AveMariaRAT)", "value": "078a2a91e21f63c459957d7ad20015209ce9b10bac9e24116d351924018da977", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701887, "uuid": "f64f5a63-1bd5-4dec-9f5e-61448f7e19eb", "comment": "Malware payload (AveMariaRAT)", "value": "9b0d88e85799c45507e747f53b9c66335686ec42", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701887, "uuid": "c0d4a150-8218-4fb0-ba3d-f05017cca9e9", "comment": "Malware payload (AveMariaRAT)", "value": "3e6600c29a3c538a9ff4c514503e049f0e685b8a499d75d7f1641f90c03db1eb8ecdfd7d9cc0c8d829d0439da3153224", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701887, "uuid": "e40e22ee-954b-4854-b14f-525185f61764", "value": "T1845445A0682F0972E748AE0E50E1704A1DF6FEEAB0C19731639FA564DFD46F19EC0857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701887, "uuid": "61b8e922-8d7a-418c-83b3-41351e4d8b14", "value": "3072:ine9uXcR06QRQe9uXcR06QRQe9uXcR06QRQe9uXcR7dCKRdzFtr5RDAw5wfQ:CdDdzFt1RDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645701887, "uuid": "a71a7e64-10dd-4662-8834-8dd37482d8f3", "value": 289573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645701887, "uuid": "8a012a9f-7399-401d-bb64-a46fce220940", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701887, "uuid": "59c16d7b-8126-40d7-aa39-a2eb5c3ae2d3", "value": "Purchase Order 02242022 Evergreen.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630267ea-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645682565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682565, "uuid": "7a99d801-05b3-4695-b098-7afac0df9b48", "comment": "Malware payload (Formbook)", "value": "4467010521ec6552ff7213b757ed312a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682565, "uuid": "177ce43b-678b-4e79-b978-336c223d7b00", "comment": "Malware payload (Formbook)", "value": "07efbf01ee958f69392ebf6f46747b63b08a47ed50d80e8cbc352c0f348030aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682565, "uuid": "85d3b241-4457-45b7-9032-d80575e7301c", "comment": "Malware payload (Formbook)", "value": "2112980989c50e0b0b48c4453030bc7476c5fe59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682565, "uuid": "5137d17b-1ab4-423d-bd88-d27330b6c05f", "comment": "Malware payload (Formbook)", "value": "f075923c0d50e5a49c8cf5a10b216f6ec11c9bcaf58d9ed7023c8737206d3b9e25d8beafc77a7dc8bba89169cf9f69a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682565, "uuid": "da47e46c-b83d-4401-aafb-561ead7edb51", "value": "T1A9A402C6FB5122B1CC559471E51309606B739D2165CADA8363F8FF26B9BB0238A73363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682565, "uuid": "9ed34b87-ff41-4516-aaa0-0d10f5f561d1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682565, "uuid": "11ea77e0-8a90-483e-87ae-7cb7dab3a516", "value": "6144:wxDTRPAFwVDjuKHfljI5fTnuETijOWXsxlcv99y878pHj5TTBRm/ug/OIBjxkqfu:wRIWHfqV7uE5VPEIHj5vIrPpxHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682565, "uuid": "389cc2d0-8fe7-4aae-a41e-fc658c58c3af", "value": 487546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682565, "uuid": "06ba161c-3e13-4468-9b39-1866ed52338d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682565, "uuid": "3b08e94e-5f86-4820-b227-8df1c9882004", "value": "IRQ210779798_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3f18e5-956d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645705992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705992, "uuid": "0bd86565-275f-4cbd-b385-a8456c2d81d3", "comment": "Malware payload (Heodo)", "value": "9623a33d3130143b6d72412257fc1800", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705992, "uuid": "8e513c76-00c1-4fd3-a066-dafce3343a60", "comment": "Malware payload (Heodo)", "value": "07fef71bb1e62f6b263bbccf372b6db69832aea9dd9f8ae10fc33d59bfa3ce17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705992, "uuid": "71febf01-2633-40e4-ad7d-ea495051a371", "comment": "Malware payload (Heodo)", "value": "c7d6c5e1c31cbee0029badb35c25a4b1ec6798b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705992, "uuid": "879a8327-225f-4015-ac04-818707e8ea9c", "comment": "Malware payload (Heodo)", "value": "511488ffef4a1fedb8bdfe1da26c1a2e1483500cd36fe7ed509dc09159bf692160193a5555485059c7ae0df987545282", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705992, "uuid": "37d7d987-9ac3-442c-bb8f-fd311b210d39", "value": "T196E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705992, "uuid": "a6098dd5-3ef0-451d-97a3-cdfd29c9c472", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705992, "uuid": "bb5e8a53-7ebd-41fb-8eed-9be8090d1a73", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XdsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWda1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645705992, "uuid": "569c0fa7-605f-4b2e-a8c9-46255f197080", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645705992, "uuid": "a75b66eb-d7de-4bf3-bde9-1c829da7917c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705992, "uuid": "8d4b8cc9-6496-4604-9a88-6c59dda9a33b", "value": "XCcGVq3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfadd1f-95a2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645728671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645728671, "uuid": "783946c7-0d35-4a39-b922-b9879a1f6673", "comment": "Malware payload", "value": "07fff221c2920931d792e283ace8f5fc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645728671, "uuid": "771da1aa-d50d-4480-bd6e-999b783d580a", "comment": "Malware payload", "value": "08d7f83b2d3d127dd1f3b023f4ba6cd0b918aa4b8b783b9ce0a1f325f7b1e676", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645728671, "uuid": "64aae2e7-5244-42ed-b43a-525c4ffdc9a2", "comment": "Malware payload", "value": "d9dd6a80ac5ec8904ecc9c80afc86f8a2f5b352a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645728671, "uuid": "3a59f470-690c-447e-814e-74b08ba882ab", "comment": "Malware payload", "value": "92c2ae67f90b8470bb4a5a4cb8c7cc85c42debf159d5c8c4afc3ab7514819c165711de71f8f854c22f6d8b207b40b7e6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645728671, "uuid": "85de5b3c-f40d-456b-bfdc-b3c2ac9b7242", "value": "T14664239ABEFE9AFE510F392235436A55F0F9873D078D82112156CD7A2B74BCC98B4843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645728671, "uuid": "f77982e6-5f61-4f26-8647-dcbd3011f0f0", "value": "6144:04b99hWUfhNKE1oSYfY0klMU4giUbmss1gd69fWPVJNSqa0n72fno+r:04bf5vKjfcSPdp9fWPVvdV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645728671, "uuid": "7e3c25d7-f217-40a3-b23d-4764027c774e", "value": 336809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645728671, "uuid": "c3e9d572-50c7-4316-960b-c006a6f2a542", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645728671, "uuid": "f4320b36-5c44-48a3-ae63-ffe731031ab4", "value": "cc3cbaa26c901bff78f726f8b800ca7f-sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ded3d30-9519-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645669565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645669565, "uuid": "d88520e1-10cb-4583-a2db-dec80ea2dbe8", "comment": "Malware payload (RedLineStealer)", "value": "27b8f48c5402875ce3d4e2cbe912be72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645669565, "uuid": "f7730732-d030-4f3c-9b85-e97f4315cc7f", "comment": "Malware payload (RedLineStealer)", "value": "0931826deaf2d247bbd4bf0f9db8b9ec4b1b1830f5763155487afc8dec645c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645669565, "uuid": "1e0a1cb7-3a21-433c-a3e0-90aadaa915c7", "comment": "Malware payload (RedLineStealer)", "value": "4259e9f43ba3de082f72d1c5049702cf3a250353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645669565, "uuid": "a09c8251-1805-457e-b567-9007936b2a6a", "comment": "Malware payload (RedLineStealer)", "value": "f82c69dd249c62b82755f1165197092a8f60db9a98c3387abe02fb78043206be09335c8538d2e96ce92cab0bd498aa0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645669565, "uuid": "dbd24d91-811b-4b6f-bb95-e8a94c77b38c", "value": "T1410633186194CD1FC0E34BB4853A67C26891EA003A44BC3955E87D39B97EE47F73B726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645669565, "uuid": "fee821a7-ed9a-405c-a986-605dbdef4429", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645669565, "uuid": "007c0719-e7d3-45fc-b9ed-553d5f8201d8", "value": "98304:J3ONipCsB44nUnacyYDDW9AHahmigSY9xip:J3OYpC84ZcY/W9vYfSIip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645669565, "uuid": "f8fd0247-84ac-4412-9e58-04104963c670", "value": 3762027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645669565, "uuid": "3b1a8f6a-bdd0-4c6c-833a-8d50350ae993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645669565, "uuid": "3692de2a-e92d-48c9-a8bb-f700e40c6ebc", "value": "27b8f48c5402875ce3d4e2cbe912be72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab5a7f0-956c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645705342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705342, "uuid": "7d74bb86-6301-4aee-998c-d8cbbc26070a", "comment": "Malware payload", "value": "3018f5774f92ba0f9f9a1b34840cf51f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705342, "uuid": "257b3550-3dd7-4895-ba48-a10056551c45", "comment": "Malware payload", "value": "09f29f0ace28dcc2a951a4da4aff98d1524cb60d78255a429b22cf9b4c691de5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705342, "uuid": "5a8078eb-d38e-4b5a-801b-ffd43924c375", "comment": "Malware payload", "value": "2a8a8cc1cbeb7b3ea57e70bd487df30fc007c8fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705342, "uuid": "8bb818a4-2cfc-4eb8-9fcb-595b828b4961", "comment": "Malware payload", "value": "efb75917c4997a8706324de65dcb7d05fd64beec631e73212ae8b30aa88806e57649c47caf0f2d4015b84218d98eb1ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705342, "uuid": "12edebaf-5712-43e7-95bf-e60e6327aaa9", "value": "T102A1F850112C1AB07246597AD26FFB52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705342, "uuid": "7578634c-680b-4c50-9773-a2772cfc0e14", "value": "96:6RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:6RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645705342, "uuid": "fe0d9e70-838d-4106-8bf6-7d888fb5ba53", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645705342, "uuid": "ae30adfc-7a4e-4f4c-bd9d-6d25e22b5c1c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705342, "uuid": "dd310e15-941a-43f8-943a-9f4b5c004212", "value": "09f29f0ace28dcc2a951a4da4aff98d1524cb60d78255a429b22cf9b4c691de5.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08eb8a1d-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "8cd1382c-c6a8-49f9-ae0a-8494aa76d85e", "comment": "Malware payload (Heodo)", "value": "7dcf7738edf7b5cba46f125a97761581", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "1bcb2977-4898-457b-b5f8-5e8d3592d4ee", "comment": "Malware payload (Heodo)", "value": "0b9309969c7bbaa86e6845564bc4d8795c079567a93dd2eac070adc0bbc23f00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "9fa76cab-38f3-49f8-a589-0a0b089e5808", "comment": "Malware payload (Heodo)", "value": "a5929bf30190cfe7f57f3ba67962ed3c5afb39ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "1e0d01aa-ffc1-482b-ab1b-f8df26d1b248", "comment": "Malware payload (Heodo)", "value": "d69066f7a580888e31f529cafd0e34e4716abf494ee1ac01bc58f4f50f1544c0a15bf63e4514e12ab428047af695f434", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "d6512e71-10f8-44ea-b55b-07e549aa9a0d", "value": "T1B5E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "ba1178f2-30f0-4f75-81d5-be1d0f509b4e", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "ac1bb2cb-27f7-46c9-b1e4-e69b10d2ab5c", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKUe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKULzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660939, "uuid": "cb960c5c-2e3f-43fe-926d-34c19f3e767c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660939, "uuid": "e7a01d41-d5ac-4c80-b090-455178afcda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "e7a12378-07b6-4184-bb7e-622e043cd895", "value": "emotet_exe_e4_0b9309969c7bbaa86e6845564bc4d8795c079567a93dd2eac070adc0bbc23f00_2022-02-24__000210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f364cc4d-95ad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645733488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733488, "uuid": "d4948f10-d5b3-482e-955a-d7d2cefa2b91", "comment": "Malware payload", "value": "08cae1555f1bb92a6ff6c787a6681cb3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733488, "uuid": "6858db55-b85f-498f-837a-b9cef4cb0b95", "comment": "Malware payload", "value": "0b9c3f69f919c2a1c4b0b0d009944d30ee6eb58869844aee5d4038d236af40f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733488, "uuid": "0ae7c3d4-649e-4477-aefd-258eed8f2d18", "comment": "Malware payload", "value": "b11c1884ff5e7751ca707edf3b92a1a3c6898adf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733488, "uuid": "d8103f4a-12ef-4d71-8021-074684919cc9", "comment": "Malware payload", "value": "a2e99d4b1471f23c099c827b005ac3433ee6e8e5af71afa06bf496e5470250c76f9a3439b8a31c7c74b126dd087b23fa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733488, "uuid": "28a7645f-d105-4048-a20d-67688178d4f3", "value": "T11BE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733488, "uuid": "8e2fc64b-e4bb-4b6e-a28d-cbaf3fa38390", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733488, "uuid": "0ed735ce-c32b-4aff-89ae-5e9813b18d6b", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XssD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWsa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645733488, "uuid": "757a17ff-54db-44bb-b817-f1f2e9c265aa", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645733488, "uuid": "8f1cba89-a6f0-48fa-be96-4810f94559c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733488, "uuid": "24761aa3-2deb-413c-8add-c4befd98ff0c", "value": "xmSg8SPHlJDOO3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c487704-95be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645740509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740509, "uuid": "e634e094-e36f-46ab-8d67-83192cccdb95", "comment": "Malware payload", "value": "56532069c5e2dc8b57a1fa3fc0a7aa7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740509, "uuid": "ba69b9d3-e3b9-4089-97b9-c5db8f02a24c", "comment": "Malware payload", "value": "0bad95d7b82584dddefc9f47cb96b2a00076326ee05668c91ed94dda61b003cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740509, "uuid": "7371b1e2-57ea-434c-b53d-57da61967afe", "comment": "Malware payload", "value": "362d53a8336889a663d3bcf3fcb19d8d03bef517", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740509, "uuid": "af67922a-0543-499d-ada6-633a3a0393cf", "comment": "Malware payload", "value": "218304ddc5f3f0bc95e85221498ff2ab1a9040a0666278b4753a819f5e6eafd62b33e1276d4170b122a13f37e2c98000", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740509, "uuid": "cdca63a3-44b2-4868-bd2d-28929c7e6bed", "value": "T114E4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740509, "uuid": "1fab2ba3-5198-455e-837b-b9ecde8db7d0", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740509, "uuid": "08c974ba-5976-41be-a683-3ae721692b47", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKLKDYjX3rUXY:ygHpbVy97g0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645740509, "uuid": "19552e2c-5100-4fb2-9948-8455b5e31405", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645740509, "uuid": "11f5c874-558b-4b9c-9746-c6f83aea5ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740509, "uuid": "b6a9ccb5-30c6-4707-85b9-8769f8b4db7f", "value": "56532069c5e2dc8b57a1fa3fc0a7aa7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43237fd-956d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645706002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706002, "uuid": "97e2b2fb-5920-4072-9bb3-c5ae3910ab5e", "comment": "Malware payload (Heodo)", "value": "5acc6f1ff8366ddc895392da4e6a50e3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706002, "uuid": "445f4f22-4dd9-4c2d-bed7-f66278e39b1b", "comment": "Malware payload (Heodo)", "value": "0bb184f9c3e9cda4571bd806b90dbda484c331d9dce7af784405fd211f6c71c4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706002, "uuid": "91e67879-c772-4add-aaf2-bc7448f2d37e", "comment": "Malware payload (Heodo)", "value": "45b3ef65a4dabdbbefec603fe3dca9bfb1c5c643", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706002, "uuid": "735746d5-6a28-47e1-b35c-544921ece56f", "comment": "Malware payload (Heodo)", "value": "f240fea4270b07308ec6ff8e114a4b0ee25427bd68fc24b77623d7621ba43d84fb32edea3567b4169f7b39ff54088353", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706002, "uuid": "e9f07800-c01c-489b-833f-b92c94d1e709", "value": "T1FD24AE1B5C0EDFA7D148C3F67F430CAE6B8B1758A99039FA01A22ECF6F8855259C541E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706002, "uuid": "59a70d61-50ea-459e-9f4a-31bcc34489ca", "value": "6144:CMyysPlevgOrNeduXWNOYYYYYYYYYYYYYYYYYYYYYY1:RyrPU4xduGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645706002, "uuid": "0ca996e8-6fc7-4e4b-8d1d-a687114ec691", "value": 214313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645706002, "uuid": "edfd039a-3cf6-4028-bbbe-0ac60d9461e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706002, "uuid": "4dddce16-3ad5-4d07-8914-34c69baad3d6", "value": "Documento.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28df901-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645693087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693087, "uuid": "7b838876-4c99-4d66-bb3c-997750d1bfab", "comment": "Malware payload (RedLineStealer)", "value": "0d47cc517737bf9021c0b9796de7bb97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693087, "uuid": "f17ae5a4-3c30-459f-b625-52bab88140c0", "comment": "Malware payload (RedLineStealer)", "value": "0c80e786edd67d443ed55ec6f2f4a1946d7bfa99040795443fb36265fbb211d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693087, "uuid": "5b1a7320-a47d-4ed3-95d9-6484e88f14cd", "comment": "Malware payload (RedLineStealer)", "value": "317582b4d42e03f8d45832dd293f1d5b65f994ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693087, "uuid": "d2f5b8fb-55b2-4b03-8dee-5be06605745b", "comment": "Malware payload (RedLineStealer)", "value": "3d08c897cc1b5c06d2a3313cececff7d2f02981363c4afac40431ebc1fc98747856f82ae1b4d7168a98aa86988055546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693087, "uuid": "4104f288-bfdc-4382-b083-f671131a5bea", "value": "T1D7E412E03490A831C045F5309426FEE15AAEBC75C9529A83B7B83B8E7E723C1677594F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693087, "uuid": "abc70a82-afac-4be5-87e8-938ddbfbe18a", "value": "917b0dc587f632b60bbe39ab8c418265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693087, "uuid": "7faf8eb6-a6e7-468f-9896-7af57a5425dc", "value": "12288:P6zDgCDSY+GttD0Oa75Z8GbRBulO/GhKbhV7kj:P6z0kP4maBuCYKbh6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693087, "uuid": "96000557-ea86-44b2-990f-13ee8ec58135", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693087, "uuid": "9b3f4062-e370-4a70-947d-873c213215d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693087, "uuid": "9e3be216-73b5-4c0a-b6ad-2a68e91b2b5f", "value": "0d47cc517737bf9021c0b9796de7bb97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b5d742-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "61a6d409-91e6-47b1-b02e-ec0526f74288", "comment": "Malware payload (Heodo)", "value": "08573daadb476c3762624a9a6134f86c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "63639b52-2dae-4694-8606-1a4720f8c4ae", "comment": "Malware payload (Heodo)", "value": "0d9f23c616dd19f749687167ee6603190e744bf4b6937e8768d7fbe39cfef2d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "3fc129b0-67e1-4551-955e-d736957241f2", "comment": "Malware payload (Heodo)", "value": "5e6df32f8c17240236c60a768eead6b7c7f248eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "e8bdc784-0690-43c9-a646-ff85b1a3b218", "comment": "Malware payload (Heodo)", "value": "1e0a24874ab7657d544fbcf8894dbc53b9a89de50b2b8f1bf1322a7c147d43ca216f1e40a11f091c2fa30d8e9bc4c49b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "6c3e0115-ec29-469c-a598-6f8d41e91275", "value": "T1E0E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "4f078ead-724e-4e0a-9f39-d032f354f270", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "405d6ec7-7190-4b13-8102-179643bac1cc", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XFsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWFa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697894, "uuid": "ef984a7a-9fe8-4f65-af30-ef4e6708c971", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697894, "uuid": "41f2f5b5-61a1-48b0-b757-fa5ddaf6d411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "d7c9e003-d126-4881-bd0a-c9d0b20693da", "value": "emotet_exe_e5_0d9f23c616dd19f749687167ee6603190e744bf4b6937e8768d7fbe39cfef2d7_2022-02-24__101808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cc26c8-957b-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645711640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711640, "uuid": "02be3c3e-8bb0-4e44-9d15-e8cd2711fd59", "comment": "Malware payload (NanoCore)", "value": "ade1b5241f957da2c43cf4e264a2ca97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711640, "uuid": "e558d136-fe1b-4ee8-9088-a77454eb60a3", "comment": "Malware payload (NanoCore)", "value": "0e0881351587adaa5a1b7361fdc03167ef38d9e7db2e55110e97c5a2644de94b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711640, "uuid": "b97d20df-a378-4cc9-8c22-de1ac744e60e", "comment": "Malware payload (NanoCore)", "value": "c1e0c26a3d82e43b22942be5633241cc5d7e2ea1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711640, "uuid": "b5662778-ebc3-4ae2-a35e-d822c3a0f380", "comment": "Malware payload (NanoCore)", "value": "6dab9324dcecb281a3e1e241cff9ee8c2d654237fa01599f3113a4312e3a5dd944b6cb283e7fcb5ba4c7ce22469ba3ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711640, "uuid": "5255ab11-00f1-4068-95f6-15a44fa14255", "value": "T1EB05BE2028AF66CAF1729BFE1DC8E9B18FB9E57A3519F1B91C810ED61751B01DD02933", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711640, "uuid": "e5c47b96-c33a-4fd1-9c5a-e2294229897f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711640, "uuid": "65ffd5e4-bd98-4d38-a0d1-d17dd9584202", "value": "12288:J0pjEJgYYz0bQ/rGl72IxTTZoeXY295XW56WBGVN2hnJsvJkW1WHJCtGG:g9VrGl7vTNoghHjWOA1OvJkF0GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711640, "uuid": "258e8498-636d-4a14-b9cf-ff6d244a2350", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711640, "uuid": "d21f1557-101b-43a3-96c6-866fbb4b8c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711640, "uuid": "bb924bb8-a980-464a-af3d-3e246e949058", "value": "ade1b5241f957da2c43cf4e264a2ca97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ca9bb6-95aa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732207, "uuid": "1e0e76f3-3ec1-4806-b60b-e7da377e474c", "comment": "Malware payload", "value": "e59b35429accb8cba41f06656d2269ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732207, "uuid": "3a5aa56d-af8c-460b-861f-48333e191ff7", "comment": "Malware payload", "value": "0e0b83df6829274b035eca6f45426e2bdc35bc38de7f9be70e9e9bd89cc01c93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732207, "uuid": "8b9b3ee6-3d31-4338-a793-a1e5caca86ac", "comment": "Malware payload", "value": "b5e8d628427eb22eee0d70ed64f166826efe7aef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732207, "uuid": "5cb1718d-80dd-4126-a884-806b80c0ebf4", "comment": "Malware payload", "value": "afe39fc4e9f8b2242ff80da81a5ccb13f4b64f95ba5b96339b4e8f9f9cfe23818334db485a192cdc9b3735061e525efb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732207, "uuid": "6f1e0a35-dc5d-4918-99b0-7b0cbba026e9", "value": "T1B3E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732207, "uuid": "f1763ce9-ade2-4872-a0ae-dc70a49fce82", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732207, "uuid": "eebe8470-2af1-4434-b42d-1486bcc98c84", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XksD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWka1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732207, "uuid": "37f5af3a-7321-494f-a7e6-cfc44eb59edb", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732207, "uuid": "08c41b80-aba9-4d02-aed5-e607a6266374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732207, "uuid": "6d6e9f88-ac72-4345-ad30-0428067fde2b", "value": "e59b35429accb8cba41f06656d2269ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee12058e-95c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645745076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745076, "uuid": "5cadb320-1142-40b3-a712-26591e4e7602", "comment": "Malware payload", "value": "79193ca58a57ff6d48f225b46e156950", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false }, { "name": "VBScript", "colour": "#1A34B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745076, "uuid": "c7c0c4d6-9500-4bf7-8443-07cdb6788535", "comment": "Malware payload", "value": "0ef4d003e68d108da9180b47348fe3263ceb856d4f0ef4501530a7704df6395a", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false }, { "name": "VBScript", "colour": "#1A34B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745076, "uuid": "34a9f6c6-7b91-4b8d-b13c-15eecd6031c1", "comment": "Malware payload", "value": "cd6644e2a1f04846089c2ca8a2ad0aea9d6bb9d5", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false }, { "name": "VBScript", "colour": "#1A34B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745076, "uuid": "4b5fff7f-9acd-430c-929a-126436921d18", "comment": "Malware payload", "value": "8fa4fc24b3409c1ddafbb6932a0028cd036f97b7438e462544a8414465327018d07190b0fd4eb6fe53b21e1ffeea1043", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "sct", "colour": "#7EC5DC", "exportable": true, "hide_tag": false }, { "name": "VBScript", "colour": "#1A34B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745076, "uuid": "337572ed-ef6e-45a7-9a93-10ea7df2c950", "value": "T10792EE28684DDBFA3453DD8FAFCD65A088C808E39979B3B8B4B9D1CD059055C7A9E703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745076, "uuid": "f5e4f4c8-9fb9-4430-a891-16fdc731f710", "value": "384:oVwLjmpJfC59KLKnVhxc4tw5an4Ptogpb:oVwsWWKnVhxc4tw5an4lvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645745076, "uuid": "2f7c8045-4e69-4a51-a9f7-e5eb4dd32f69", "value": 20806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645745076, "uuid": "bd9638b0-7e42-47b4-be10-552f84cece5a", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745076, "uuid": "137f8313-a13f-4f6e-a8aa-bc662cf652c6", "value": "test.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f11dca-9575-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645709251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709251, "uuid": "a4427cc3-2cdb-4b12-bbc2-8cd476a98b08", "comment": "Malware payload", "value": "d063b65db146a257b43aba448aca14c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709251, "uuid": "c735fe46-ac6f-4a7b-8772-a18ef76faba8", "comment": "Malware payload", "value": "0f653aafda3d87115c3da82b34f533fddda29f7141fc0762a3519c5c8f95a651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709251, "uuid": "828686d5-35db-40a6-aa16-969bdc8f0ecf", "comment": "Malware payload", "value": "d6c05089284dcfcc96550965e0ecaa55f57b7a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709251, "uuid": "73be8132-b43c-46a1-9233-079f6b1c762e", "comment": "Malware payload", "value": "744fb21aaac9646f13b67f0f97d4d138985b7f28f55f5b565167a5039bcf55b13d190d6f31e720761c5d19700cdfc34b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709251, "uuid": "01452c98-22a5-43d3-80a0-634ba312c4ec", "value": "T178E2C62162BC41F0FAEDCDB06E12D3390A65AC4148718625E5CB3DDAF937A03CB665F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709251, "uuid": "07878b95-2e48-4146-a693-9cf6687ca384", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709251, "uuid": "cafcee4f-75ce-4b55-a5df-bbc1aa8f5d4c", "value": "384:yJfj4AbIL9nRppGQGIzll0zJJnGzMgWKsMhqJG+X:yRcAU6Izll0zJJnGzMg5qJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645709251, "uuid": "3b1e073f-5e79-422a-8594-ac69bc926527", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645709251, "uuid": "2ddf6c3d-50bb-4731-856c-3eebe847059a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709251, "uuid": "39614b41-5f49-4187-a193-d45dff7b856d", "value": "2511061072xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa9aad7-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645688063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688063, "uuid": "bfe3d13a-3959-44c3-8959-05cd73f9850c", "comment": "Malware payload (SnakeKeylogger)", "value": "501f56ab46f3f3ecae7fff3b2303d71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688063, "uuid": "2b500f57-5489-4ead-be61-290c64ba978f", "comment": "Malware payload (SnakeKeylogger)", "value": "0fa25fdc62f05ae4786a36e847f15997d377fc3f955a0d122f67cdc49c9f611d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688063, "uuid": "341c85b9-28b8-4301-b936-73ef7eb92897", "comment": "Malware payload (SnakeKeylogger)", "value": "d9c9e2e312b7408e204347f0735e6e9b8a0f0517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688063, "uuid": "89399b8e-3a8e-4fb1-ba3f-adbcf3820e55", "comment": "Malware payload (SnakeKeylogger)", "value": "596382192b2f3bd4ecbd038f4a9795412bb6f878a5a3f5b6afc7bd39c76f0a0d6e94ca13c596edc6fcff12a1e2bf9df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688063, "uuid": "a11aaae7-b3b8-48e1-9fdd-af282c874366", "value": "T16B84CEC991F7427AD8F886FCF420564F2FB9BA2D8207F27A084823594483F547A97677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688063, "uuid": "6e8efcce-9369-4b61-a726-296685605254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688063, "uuid": "706f730a-9383-477d-86c3-c000d8cf4898", "value": "6144:wsg04/Hb6v+VHHY4uqYq/K4xRjl2lCXVoBlnBej4Pcn/8r:wn04TA+VY4Jxj2sozozUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688063, "uuid": "d08c31ce-0a29-4b7d-8cd7-eca42fdc9e11", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688063, "uuid": "e20e3eab-67dd-4bd8-a129-36294bb37074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688063, "uuid": "c51f592d-6dd0-4a7a-a600-3988cc0bd92b", "value": "image-000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b2e3b7-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687180, "uuid": "f60fe466-817a-4922-8a88-6999d58db314", "comment": "Malware payload (Gafgyt)", "value": "f9a4d22925f5c38b973d5c7f4355b105", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687180, "uuid": "421bc861-59f8-4efc-820f-f1c79487148b", "comment": "Malware payload (Gafgyt)", "value": "100520ae4cfcd91e71ea3164ee3f86f24093305075cc46f88b863fa248ef61cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687180, "uuid": "11175bfc-9f6b-46ad-87a4-6dd33b583268", "comment": "Malware payload (Gafgyt)", "value": "7cb87da15f63a74ac8448af042f162115375d3ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687180, "uuid": "8d7f3920-3cdd-4861-a9ba-acc240b3f794", "comment": "Malware payload (Gafgyt)", "value": "08ae1094b8a02849ac9cf83ee7d15d85901f9ee6e6efa9125a817ef5bc59049d893122fcb822f247467eb346827e2fb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687180, "uuid": "4431bc96-5f33-4d9d-8f25-36bfd4f0b7f2", "value": "T18D734C42E652CAB3C8930BB6029B5B264A31FC3A1E2B9F59F31D7CF49B124C87217755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687180, "uuid": "4c5e032d-f34f-43a9-b567-3dbc3b9d378e", "value": "1536:YixNYpuQWuKv8xKBnq5PeOj5zMLzO5qmLI2VOCjXUfJRk:/N8k30xKBnq9eGMO5qmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687180, "uuid": "0cb061f9-0003-4c59-bd32-030a20dd453d", "value": 74017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687180, "uuid": "bed94ec2-1e3d-4fa3-bef7-efb4a5ac91ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687180, "uuid": "74545734-8d74-495c-b74d-34f61fbcc50f", "value": "f9a4d22925f5c38b973d5c7f4355b105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b4a7a8-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "46389fc6-b4e2-45f3-9ca4-ffb3f9edca71", "comment": "Malware payload (Heodo)", "value": "aeb57fab3e72dfa7c205d7c42134a441", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "77a6e47c-2f60-4969-8253-8f96fdb6b45c", "comment": "Malware payload (Heodo)", "value": "1049c40279e4e78b43d245ad066f44db02282ee1e5d57368b0b94f2ee6e0e2ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "d2ceaa00-3ea8-4908-8dad-b1b111526af0", "comment": "Malware payload (Heodo)", "value": "2047bd570677d98bb92c04927d3956a8da9a59a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "8ff97d48-9e17-46ad-9e03-709a581ff3e9", "comment": "Malware payload (Heodo)", "value": "d4c3e7719bd6e7a88ed54969c18464c38f72e9534477396a68703214c091d83177e07e6ed8bb58492ee91e58e8341f6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "0bfbce33-c28c-4000-bfee-c7212bd39d90", "value": "T1A0E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "7476854f-a076-4898-a8e8-109811d60c3b", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "9c1f30e7-31a2-4f38-a2dd-9c81e809f589", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0X2sD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFW2a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697894, "uuid": "27f75f49-4839-44c8-9990-fd48c1c3d0f0", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697894, "uuid": "71ab5b6e-c5ce-4c82-bc34-9d2fced5428b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "35175c1b-d25a-4e4d-9507-48fb9cf327ae", "value": "emotet_exe_e5_1049c40279e4e78b43d245ad066f44db02282ee1e5d57368b0b94f2ee6e0e2ec_2022-02-24__101808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b2cbf5-9561-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645700610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700610, "uuid": "f830f116-4bb3-4928-96e2-20b120ffec21", "comment": "Malware payload (Heodo)", "value": "3e7cf3edfa03ecad26d517ea12fa3afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700610, "uuid": "147453c3-5e05-4a25-b1fd-ceaa6692df5f", "comment": "Malware payload (Heodo)", "value": "1143fc2b735f05f464b64ea255f2a8f34d4cb7339b6f325b3b1f6da0263b02fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700610, "uuid": "24c0ee20-a505-46dd-af25-7af80b23ab27", "comment": "Malware payload (Heodo)", "value": "17c1fe9c765cc8f142cb13e7d30947d24f464b38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700610, "uuid": "29ff2666-0647-44bd-a264-a2fd5f569eac", "comment": "Malware payload (Heodo)", "value": "3cb9bb8f62af608205bdf2716260063e8a9e91b6842f4115bfb49bc8c5d5aa8afd73b7bc25b23b2ecad059f7950056ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700610, "uuid": "a2d1359a-f20c-487b-8c51-36f23935e618", "value": "T138E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700610, "uuid": "173b37c0-3fd7-4494-8d9e-a30026bd3d51", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700610, "uuid": "3823f904-a5a9-40d3-9a3d-bf9e69bc1e37", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKie/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKiLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645700610, "uuid": "5bdff746-8ecb-4aaf-be93-c7aee6bf3212", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645700610, "uuid": "9cde6c16-abe6-4ce6-a503-3ddc27d04686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700610, "uuid": "00113f0e-014d-4cda-8333-e4c1181f78b0", "value": "3e7cf3edfa03ecad26d517ea12fa3afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74106d00-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1645688177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688177, "uuid": "933404f7-c49f-411d-aa9e-9201b099d901", "comment": "Malware payload (DanaBot)", "value": "d8660b485cafb9ac184e494b4c3029e6", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688177, "uuid": "d78bda9f-82da-49cf-a9e0-a8d218f0e9f1", "comment": "Malware payload (DanaBot)", "value": "117569e9ac20c685713419ce6c875bc4dae5c26f42ed9d75d231604e7f3b4be7", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688177, "uuid": "31225d74-1572-4ec3-80b4-b7d058aaa50b", "comment": "Malware payload (DanaBot)", "value": "595654b7808dc6bfbc85b45d29a81401e0e06eb1", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688177, "uuid": "0a61e819-05a4-4aec-b057-03edaacb66f8", "comment": "Malware payload (DanaBot)", "value": "515c836a54431b4b7ff5dbb4b102dd5f45f60da21f139f70324240d4a9223aeaa8767ffb5c5714ed181c56b1b5a87487", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688177, "uuid": "34e30253-9b4f-4930-9163-baa0dd36f92f", "value": "T1634523F12441867FC90B6234AC1BFEE184BEE842D9519E53B2B93E1D6B351D2627930F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688177, "uuid": "77680494-456b-4bc6-a89e-b5d6f08039b1", "value": "917b0dc587f632b60bbe39ab8c418265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688177, "uuid": "e79ae588-51db-4b05-a4da-79a0301b0f99", "value": "24576:wC70rEiqgk07cCgtbnGQU60IzuzrEHbyFi7X0tU1AlrwNLmJobH:/kXzk07cpD/UizuzrCbyQXKvlM8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688177, "uuid": "7dfc4174-3c27-491a-80df-7fe9fed1d413", "value": 1181184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688177, "uuid": "2bf0383e-3bdb-484c-a14b-18537aa8113c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688177, "uuid": "3cb28db7-e946-4dbc-b0c2-bd9327067253", "value": "d8660b485cafb9ac184e494b4c3029e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df486b6-950b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645663766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663766, "uuid": "8345d659-0f78-4af0-9088-bbf225b1ab6c", "comment": "Malware payload (Heodo)", "value": "57c9bb806004c3280a98fcb0869dad44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663766, "uuid": "1d0186fc-ec3d-4dd0-af85-63bee0c6ed9c", "comment": "Malware payload (Heodo)", "value": "11f2e83ad4c8e19781d58bb26a9f9aa9670e55386f88d469f1205b4b7da5ce7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663766, "uuid": "c04745aa-beb9-437a-842d-96539991bed3", "comment": "Malware payload (Heodo)", "value": "c08d9cc9ca6b084ac35c1589a81d500e979b5783", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663766, "uuid": "1e200cc9-5fff-4c8f-a88b-80df30bc001c", "comment": "Malware payload (Heodo)", "value": "98d0f1c49a2dc617e8d6dd9f14b4acdad89e6f735afd6e0feb56f91d19a34926f950b267a5f650b71c5a5bc5936d4675", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663766, "uuid": "2b59a97f-e397-4178-b2f0-7cb6f39f63a5", "value": "T15EE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663766, "uuid": "17b4868d-3a0d-480b-8896-5e8aed19e9f1", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663766, "uuid": "ec63b734-cd78-409b-b09d-9d8f79f36117", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0LhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNftPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645663766, "uuid": "de128d53-b6c3-47b5-9cab-890e996c7b7a", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645663766, "uuid": "2d9d2ad4-6be0-4933-af9e-ad1afc4edaef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663766, "uuid": "6b89c33e-7fbc-4fd1-93d6-650f79d99279", "value": "57c9bb806004c3280a98fcb0869dad44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8438e65e-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1645687775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687775, "uuid": "8e66ea6c-34dc-440e-933b-0e4cadef5dc7", "comment": "Malware payload (Socelars)", "value": "b5eb3da4631629ccce826c296ec1388b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687775, "uuid": "6df42ea7-be71-46bb-9e59-4219aa67ca12", "comment": "Malware payload (Socelars)", "value": "127248c1f6e95ee7b4153cc8c035c2841a8f8ed0f115bdf42e8bab12d88ae117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687775, "uuid": "566ab2ed-8a0d-46f9-812a-620a030b96e6", "comment": "Malware payload (Socelars)", "value": "65be243482762f364b00582ba2c842867975919f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687775, "uuid": "babd260b-503f-4fba-bb96-5fb363a20cf4", "comment": "Malware payload (Socelars)", "value": "461b3e5eb332c6bbb22c2c31da695033eb30c4b8623d0a12b2ab2a9c5866fcab643ff64433b9f41cea3fc2a4457edd4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687775, "uuid": "4af246db-5dc8-4347-a3e8-1180f8748498", "value": "T155659F11E6C2A036E8E3007386FF66FE8E6C7A23030C74D7D3C469695A715E27A36657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687775, "uuid": "2f96c2ff-4975-4579-81ee-5176dca4ef50", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687775, "uuid": "0c38dc63-e887-4a7f-94a1-752b2f80ded1", "value": "24576:Q9opFqoCv+VsqF7nZYll2QDUrygcC0JY3ZAwS8c95/d6skjR8OYu:dpH1sSDu6Auq5/dhkjeFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687775, "uuid": "b5cac186-db32-4f79-96b3-b38176b5e111", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687775, "uuid": "3cf187a0-9374-4804-a0d7-c9c795d4ad01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687775, "uuid": "30477118-c739-4583-8647-c688b8bb5067", "value": "tvstream8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b6f3b5-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645723310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723310, "uuid": "8232d5b2-715e-4e1e-9684-1d629610ed13", "comment": "Malware payload (AveMariaRAT)", "value": "5c5d64574b4353a8eceb18066eabd6b4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723310, "uuid": "093520cf-7b53-4ff8-9107-0c774251b52a", "comment": "Malware payload (AveMariaRAT)", "value": "12b02fbf707043343f4dce5604014f8e721b907a96137411afe0c1b9c4bdd870", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723310, "uuid": "2c03cb08-fc96-4189-b6ad-90b8d7e13c46", "comment": "Malware payload (AveMariaRAT)", "value": "78b4e0a0a08e771943c71d51c71363d5059e98b7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723310, "uuid": "c7f33090-8f48-4bc6-ba94-1de7a41fd0ad", "comment": "Malware payload (AveMariaRAT)", "value": "8e60c44ac00806325822377828da438137177709383b5b99a3fa9ebffc8b2f3a5ffedcf2ddeb631c15719f918f315dc3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723310, "uuid": "ae1c6684-39a6-4932-bde7-3d3a1f6ad46d", "value": "T10C141266A0E4D20DD6DE913D065E51286A437FF165445BA4B038F28B863FCC78E322F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723310, "uuid": "83977786-c214-457a-a4f1-cb020f56c3fe", "value": "3072:KAg6oLYaV0g8lpCovhMqFQ1vmOFQ+hbUBPkKu8Z2lMWLxTu2OFwjSsglSV+m:LK0Zl5v1FH+hbUKB8Z2lMW9C2OFSSpSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723310, "uuid": "328add5b-b339-4e40-bd5a-175ff701683d", "value": 190536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723310, "uuid": "15fdb756-f1e6-47f1-8087-03587d0f4aab", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723310, "uuid": "fb4e219b-6aa3-45f6-ad4c-db84467ab2b1", "value": "factura.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabd6b8c-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645688377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688377, "uuid": "e426c5c4-baa9-42cf-977c-91952161fb40", "comment": "Malware payload (Smoke Loader)", "value": "a558316c998572014232adc838b4dde9", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688377, "uuid": "f99dec10-e691-4bdf-b0e7-9c0273f3a4b1", "comment": "Malware payload (Smoke Loader)", "value": "12c4f90f7e157a6ae9fca571ef08cdb405e387a4e0ff25fc65336ec8e70b2f75", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688377, "uuid": "8560b8b9-a057-49db-9377-25aef6fbc630", "comment": "Malware payload (Smoke Loader)", "value": "41f451c1df9baba2225e574eb0eefdab0ab4bf8c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688377, "uuid": "8effb910-eca6-4bca-b778-0bbe76571e37", "comment": "Malware payload (Smoke Loader)", "value": "1ad2ad2ac496bd581c52b5c498bb6bf317c0ceda4f7b461638f17d773fc341909d804bd6aa6432ed854225f66db41448", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688377, "uuid": "cf952992-3576-41af-956f-baf8fa126414", "value": "T17E747C00A6A0C439F5B726F446BA9378A63E7AE05B2460CB53D51BFD57386E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688377, "uuid": "31d82d8e-ef9d-40da-904e-c9c485c2e91c", "value": "ecfb8ce0d70668868f462672b03acee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688377, "uuid": "06af76e3-dad3-423c-99b2-743e732d8162", "value": "6144:2WkWS00jZCtPSn0YIXbUv5nK7vQXOA0fnGOrvyQZOgOiKroSr:2pWSNnQrUv5K7vQXOpdragvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688377, "uuid": "d91fabe9-bd4b-4ccd-b7b4-fb3404c70227", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688377, "uuid": "28d7f091-e119-4dc8-a4cd-0f627728d0c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688377, "uuid": "b11a6497-9d66-4c50-a6a3-a4e071624546", "value": "a558316c998572014232adc838b4dde9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b408a9fb-9534-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645681413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681413, "uuid": "d2205e8e-d795-4a7e-8ab1-430765cac4b9", "comment": "Malware payload", "value": "9fcebc0d86396a14d34d2e88612d1306", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681413, "uuid": "94bcf236-83c0-46cd-b4cf-d5fa88c6092a", "comment": "Malware payload", "value": "130b7abb44330b081d87a33dc5eb2600a1bb220212c54a10cdc4d0523f3360a4", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681413, "uuid": "216b6f14-f6e9-4647-8dbf-e4762686bce3", "comment": "Malware payload", "value": "028d90b3d7a3962151e327bbaeaa1d0d782c1b46", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681413, "uuid": "a0d4412e-fb21-469f-85a9-bb95adeffa0a", "comment": "Malware payload", "value": "1577fab74e9fccc8a68263608815257b6a1f826da4a970bd8777ac03ce74ad770c221f66fc26d2f3734d0ba1680cca78", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681413, "uuid": "54712009-ac57-460d-bd0a-0a6a1089fa60", "value": "T15944D01AC2117C1EDF1F5ABB114BCBB6FA5291B83631D7091D6E8AC7DDA70A36D08360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681413, "uuid": "03826909-e385-4981-bb10-f807b887c04e", "value": "3072:EDUW+KShrLHe/Fnqms3FJ9hQZIiiUEinq7C/9ycZz3V/Pg5fwqqqqqqqqqqqqqqT:ST+Pyqz3/QKlj7C/9/t9g5aVQNJU2cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645681413, "uuid": "f16106dc-6cfe-432a-afa1-6e951948e4c7", "value": 271509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645681413, "uuid": "9b6b8bed-42f4-4ced-b7d1-7c587031602c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681413, "uuid": "4433e9a0-ed07-492e-81f8-2462f15f6d0b", "value": "404.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a17a16-957b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645711646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711646, "uuid": "46e51122-9f9e-47b8-b2e7-860cffa22f64", "comment": "Malware payload (Heodo)", "value": "7c6b3e9ac0e9d171068009ac196b6974", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711646, "uuid": "3bbd8257-766e-4149-b62b-3c6c61111f02", "comment": "Malware payload (Heodo)", "value": "133a63a05261497ed878372810d921a0af3d189cb9fe1c24ec1b749699bc94f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711646, "uuid": "386a4d6b-5024-4952-9db6-93f97fefbea2", "comment": "Malware payload (Heodo)", "value": "29b4a7be293e81f252d5b70732189dc83438c381", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711646, "uuid": "91ac61b8-95f7-4b84-9f66-d49203ae735a", "comment": "Malware payload (Heodo)", "value": "8d5fc7f6a7654744b6daf3548dbe07e2a835fb8061aecaa5097a4f0c4400e4e4f3f0b7bbb57182b82b996215c91a6eb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711646, "uuid": "564d2cc8-8ffb-4522-bb3c-b5a3288d1b01", "value": "T13BE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711646, "uuid": "2b4d1c13-5b5b-4d31-a48a-755399dad89e", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711646, "uuid": "5837aff2-c0c5-4c1d-9920-265058b258be", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XKsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWKa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711646, "uuid": "fa9f7964-92f1-448e-83c3-c9b4d95abc61", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711646, "uuid": "ef5c1cf8-ece9-4f61-ad55-9525d91cc011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711646, "uuid": "28b3318d-4ef2-431e-a0cf-f1418a198c64", "value": "7c6b3e9ac0e9d171068009ac196b6974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17833f95-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "dda5e76f-f7d7-42f6-8ce2-68bcb856adca", "comment": "Malware payload (Heodo)", "value": "fbed233ef8f4036f8916821dda10325d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "1798a831-c0b3-4705-aad1-c7a2359efeaf", "comment": "Malware payload (Heodo)", "value": "13ba862e4b0424071f7318b88cb7296060fc02e08ff6786274dd658da131cdb8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "8a7921d3-6ef4-4f31-bda5-020e75178e23", "comment": "Malware payload (Heodo)", "value": "413ef5055e54eda64895cb1f18f8a537ef153349", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "82b71bad-b05f-4227-84a2-2ab2bd1ebed6", "comment": "Malware payload (Heodo)", "value": "6f6cae940afc43ff2a28e28baea70ad4d0b4c49bfbe0c74749c36dd9f1ce985d6c7345933a59ec6d83f71beb49a2cda7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "f8776f63-f20e-457d-ad9b-c33efba6e98d", "value": "T173E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "3c9819c7-2c81-4eff-8159-457a7bd42c29", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "7c07679f-c2e2-4e41-9e57-939264567ad5", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0XhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf1PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660964, "uuid": "7b7125e0-9ab5-4706-9998-f436970ae85a", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660964, "uuid": "e69905eb-462f-4a00-9c06-d22b1769268d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "f47c2516-1bf6-4a72-97a4-cee1ce245218", "value": "emotet_exe_e5_13ba862e4b0424071f7318b88cb7296060fc02e08ff6786274dd658da131cdb8_2022-02-24__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e9c069-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696289, "uuid": "3154aa87-9a27-4484-a9ab-bb63dd6b99df", "comment": "Malware payload (Heodo)", "value": "1a45a1b80e310b61a0641501891ae8da", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696289, "uuid": "395bf130-8efb-46fe-acf1-dad3b902d374", "comment": "Malware payload (Heodo)", "value": "13c8222330a2594e3f3c7735cc0e0774e159b9a9d4cab42448bbbffdac6fadf3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696289, "uuid": "d6943d58-7d4b-4be9-8937-4c8b72818995", "comment": "Malware payload (Heodo)", "value": "9f4cced377ef9082d653ee235b531c52e2f50519", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696289, "uuid": "079c1b39-1e16-4b12-8e00-bee971d6e350", "comment": "Malware payload (Heodo)", "value": "b6835ca698b16765ef08a218acd5966546ebc964c97a7bbbfc96d0d4fb58a17712e527e38238ffedb5b98ad2e6d830b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696289, "uuid": "b2b5409a-0b98-416a-9bca-adcee5b3d68f", "value": "T143E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696289, "uuid": "f69c7c7b-fefb-47cf-a3a3-bf82f75553fd", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696289, "uuid": "151746da-70a1-4292-b0fb-1d2448141600", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0AhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfwPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696289, "uuid": "03429769-8f18-4e50-832b-e35639af7fef", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696289, "uuid": "33bae761-2186-448d-b401-98b54991f187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696289, "uuid": "37ca1f81-31b8-462e-87d6-5c8e9cc61e05", "value": "rxPLuDtDE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e7a44d-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "f8b2e7f1-b773-4c5a-909e-9e29bca2cf01", "comment": "Malware payload (Heodo)", "value": "7bcf71e48bd0150234cb59645f5f4598", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "9f920663-52eb-4fe6-8aea-f472eb82a5d3", "comment": "Malware payload (Heodo)", "value": "13facdce686659240333ecd00ed1ffac466db34188084e22118f4dff9b9d4197", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "c58a291d-9e62-4e03-bfdf-d37a68a688ac", "comment": "Malware payload (Heodo)", "value": "2b659afd21d57e3cff88444f5a1402bf8141a94b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "189ff345-7451-49bf-a24a-afc7b8c83473", "comment": "Malware payload (Heodo)", "value": "9149f9e3a32983b60b077bdfb753206b1e01e8791694f523eb78e56b6789b5311804e644e6e8f30b29da95d4b93c2dcb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "f418e8eb-0a98-407b-b92d-2c9eb7b3b7fd", "value": "T1F9E4BF4176C2C0B6C15E017A5982D35D22F9BDA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "63765b45-74a3-4e26-86c2-4331bb2cae0c", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "38cac0b2-145c-4a4e-bdd9-1df5665dcd75", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0fhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfVPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660963, "uuid": "ee567f0b-6e3f-4d1e-8360-5d7fa3280aa8", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660963, "uuid": "89835056-f171-44fe-b2a7-ee9c008284c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "d2f2ae70-c0a1-4307-9950-8024526f1b4a", "value": "emotet_exe_e5_13facdce686659240333ecd00ed1ffac466db34188084e22118f4dff9b9d4197_2022-02-24__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3931af-9556-11ec-9275-42010a9c0029", "comment": "Malware payload (DarkComet)", "timestamp": 1645695899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695899, "uuid": "554ce96d-41e3-473d-9763-0816b2b56139", "comment": "Malware payload (DarkComet)", "value": "ec5c5f22a7034fe6c0ce4f73a83878cd", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695899, "uuid": "0e0411df-3307-440c-ba07-3b87b462095e", "comment": "Malware payload (DarkComet)", "value": "14103cce9537a6abb5c71b9aa9acfa87f1ddb53f5a043b197d774fdbb858dd5c", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695899, "uuid": "b657c505-c75f-464d-8241-4578382940f9", "comment": "Malware payload (DarkComet)", "value": "32f8a966cb81fb044db049d8e368d29db08cbc22", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695899, "uuid": "e4feeed7-64c4-4cc3-9db4-32729f47a59e", "comment": "Malware payload (DarkComet)", "value": "83ed77b7964f07ce254bc7932306d835d691002c1d58925da28e8ce378b6d40bc5d2fa99e48cb6475866362ca00b1fce", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695899, "uuid": "f1dafba5-c3bd-4b0c-8052-97b82ac1255b", "value": "T17175F01534AB60DDF4779AFF8EC998F19D9AEC7B660C307A20863F460BB4941DD12632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695899, "uuid": "2decdf9b-7360-4ee8-a090-233c4fdd842c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695899, "uuid": "5d705303-d6f1-4124-99e5-48100876fc53", "value": "24576:WdqzZg7pzp7itKHI3W5WBJ7c2BqAZB1hb3+Bdvr4l/qGEoi0ypuNo+qldtLurd:/sjitKHIkW/7c2JnL3+BdEliLx00+4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645695899, "uuid": "37cc1a79-5a61-4bd1-9a88-584f16f1917d", "value": 1594880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645695899, "uuid": "47ac7732-da83-43ff-9b2e-38a3abcc18f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695899, "uuid": "c039a451-09ef-46fc-b160-87e16cb3bcc8", "value": "Halkbank_Ekstre_20222501_073653_270424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbc78af-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687197, "uuid": "b74462e1-ea0f-4330-9636-a66ea91ee2be", "comment": "Malware payload (Mirai)", "value": "bf13a909f30420f0273898e2e0eee3eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687197, "uuid": "a2930e50-a304-41a2-8225-9617205a8491", "comment": "Malware payload (Mirai)", "value": "14726d501dd489e8228af9580b4369819efb3101f6128df1a1ab0fcc8d96e797", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687197, "uuid": "55de8e8b-d0ba-42a5-8900-c896cf385b34", "comment": "Malware payload (Mirai)", "value": "23841236f84c03da2aa1da00aab9e5fbf4019217", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687197, "uuid": "d0ba6e5b-3c21-42b4-80bb-7fb6fb3d9ca1", "comment": "Malware payload (Mirai)", "value": "cfa47f84e69c697cdca4b125b19ddd2ad232ba1c503a00b6b65333fb4244877766c371211203abc79edbcb7630038c8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687197, "uuid": "a107e4cf-c9a9-425f-bc4f-db3827e97dc8", "value": "T1174302728759179AFB384DB2F8836685A13E2E3CE0FF427344519769C5C962248CBF92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687197, "uuid": "9e1123f1-ef6a-41d5-b678-00aaee6cf328", "value": "768:GbihbvCKZd6SQNz4nBvlMst/rIrZnwh7pSC+29j9q3UELgum9BnZRbZTDcZVJ3l:GOheKZd1BBBrIZwS729iLA9BnH1MJ3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687197, "uuid": "924ee9fb-0d77-4a7b-83aa-74dfecffab1b", "value": 57056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687197, "uuid": "25556013-e226-4979-9c98-c95ab0c443ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687197, "uuid": "286cc5ba-a775-47bb-aa6c-7c807ded9079", "value": "bf13a909f30420f0273898e2e0eee3eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb802a91-95ad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645733502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733502, "uuid": "e3435c63-9fd5-49a7-b179-35032483de73", "comment": "Malware payload", "value": "7a16d77b11b582f8f2f0369b8c2b76cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733502, "uuid": "6ce6be37-9489-4e66-a116-7066deb351e0", "comment": "Malware payload", "value": "14a20bb1af0f9b842a98eda064fd557f99f689ed9cc22638808de9ba772bf2be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733502, "uuid": "a27908c3-0220-4da2-a2d1-46d4675ac4f0", "comment": "Malware payload", "value": "15850dd6045e8330a547e3c86f635c4e2a8e2cae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733502, "uuid": "f243fc90-9603-4ab3-8274-46418b6d9b26", "comment": "Malware payload", "value": "d6d5a13a89c907fc75a7474a961282adad55756b9e6586217da32a5ca649eb8a617b3e4dc33717cde694db02ff51aaa3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733502, "uuid": "d198b0ea-70e3-4ef9-97d8-73c64cd5f110", "value": "T1C8E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733502, "uuid": "ac393500-0874-4728-a86d-6b7e8ffefc5b", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733502, "uuid": "d5d56239-1eee-4cfe-8235-b3b2a1ed5b0e", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0X8sD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFW8a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645733502, "uuid": "44a6ee22-fb27-4761-b2d6-a6ddc6f5926c", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645733502, "uuid": "4ff56a09-5bbf-4044-967b-d546b2df952d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733502, "uuid": "8cf063c4-f41b-490d-a7cb-10e29e0933f3", "value": "9KYvsUB7OrGj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a882c4-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "b31a938e-37d6-4185-aa51-eca1fa29b88b", "comment": "Malware payload (Heodo)", "value": "117cc40e621cba6cd5b39cb3c291d829", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "8a7c2f2a-5e69-4440-b55b-4da271541b58", "comment": "Malware payload (Heodo)", "value": "157646552d2734d7dd4709a1edabf4ceca3c7d6904a184127d584d85b5f5c55a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "2e2a7288-cf3c-45a1-a736-93413f9101f5", "comment": "Malware payload (Heodo)", "value": "73a8f8286d2d31f4f539b6f4293b25a178bb50c8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "292c86af-3ca0-4be7-b4cd-e3ccbd16a62d", "comment": "Malware payload (Heodo)", "value": "6b3ae345571d33b735f419208b4b8722132b7d482053723d1f732298cf6ec2fc06c4072372074311efa6a510614af776", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "fc65dbf4-8328-45c5-86dc-b5265c482663", "value": "T115E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "bef1eab4-c25e-4588-a99f-bf1cd1ca086c", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "e2165d20-7eb0-48fa-94eb-9e2f233f478d", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XvsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWva1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697896, "uuid": "edfab9b1-3eb4-45ef-a0e7-1213ffe59ce0", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697896, "uuid": "e32ced1b-13cc-4c39-9159-2ffbdd82654e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "cd4b64e1-1e2a-4538-8e17-4e575c9f242a", "value": "emotet_exe_e5_157646552d2734d7dd4709a1edabf4ceca3c7d6904a184127d584d85b5f5c55a_2022-02-24__101809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1425706-953e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645685757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685757, "uuid": "1796f568-d4ea-43ec-a483-e7ea043122da", "comment": "Malware payload (Mirai)", "value": "297daf0e5a69d82f521324007f353b76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685757, "uuid": "1950264d-db64-49bb-bd3c-1500c8c60ff4", "comment": "Malware payload (Mirai)", "value": "15e3a5f5cdefe043b6e8f0eae7f9d4bc6e1ba62016eafe837411a46fb6a5125c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685757, "uuid": "87e226a4-6ec0-4890-9b78-61dcb09d80c0", "comment": "Malware payload (Mirai)", "value": "e327f4c81f48403667634e7b29bdb2c1c435297a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685757, "uuid": "5d18d3dc-867d-426d-9bdd-ce5cfe762ede", "comment": "Malware payload (Mirai)", "value": "4bb1b0d0a7eeb903265228c74e20d6c56075c389970ad14009f9a346cca77372f22a500f57416883968a085cab52a5ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685757, "uuid": "14459bdc-cca1-47b2-a84f-fa812c89260e", "value": "T1F9E2F15BE4F04EBBC4A75676281FFD031844431A199246BFEE587AB648C1B1839207F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685757, "uuid": "46ee621a-4325-42e1-a050-92aae00f850e", "value": "768:ARUmd63EVH+msVykNGHCFCtqDh4R97CSO0D2GfnbcuyD7UHQRjc:AWmd63bm5kNGia+KOlGfnouy8HyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685757, "uuid": "1c4be85d-405b-4f53-b4a2-dcc47ad665c9", "value": 32836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685757, "uuid": "bc9a2636-8190-4bef-9a63-f6f9fd7dadd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685757, "uuid": "8d31c768-655a-4418-83c3-4a638d47b6e1", "value": "297daf0e5a69d82f521324007f353b76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d4b929-959c-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1645726134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726134, "uuid": "41835ca9-0072-4877-8b25-e1e26359c915", "comment": "Malware payload (CryptBot)", "value": "9f9b4a29bff765b3a6c79737f4471268", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726134, "uuid": "239dc204-c7cd-479a-a138-65d6532bbfb5", "comment": "Malware payload (CryptBot)", "value": "161ce807aa141a328eeb24bdc91264071ab2dddf6184c974dabf86ad91b0a77e", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726134, "uuid": "f432495a-5758-482c-a640-4c205e9d1325", "comment": "Malware payload (CryptBot)", "value": "ac6dd5c92e07bf2057dacf5b15cace59b2d0f88e", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726134, "uuid": "69a89e55-ffc3-4f1a-9239-67c121b06616", "comment": "Malware payload (CryptBot)", "value": "3c5a49e39972fe9752e73a53ffcc9f18cd7f7ed1a8233b749f0be7d4a6252aed7762ffe5eaf2b6213ae906d783871239", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726134, "uuid": "8563634d-735a-442d-b5ff-b56493075ee9", "value": "T1B7E423817509C259DC6016B99CBEDAC2DB563C492E029E4737DCBFAF3BB2072D45B209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726134, "uuid": "1bf8a072-8e58-4dd7-a6fc-bac2ccf46568", "value": "529db757e7e4b7a274b1fba45452e42e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726134, "uuid": "5486a4e8-1788-4fd8-adc6-c1b8b9a8607e", "value": "12288:UTKkGljvSO+MRH6f6Uf24vaJGWyLbVeUPkuR7WjFBK/lGRgOUqmq9kR6lhKX0B3C:UGkGlt++6ChWLbVPxoBK/cRgOnmq9g6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726134, "uuid": "af33af73-3fa1-4263-88b4-e48ba1813f2b", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726134, "uuid": "e19e21ea-44e8-4c08-b6cf-d283afa7c938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726134, "uuid": "a38452fd-45a2-4a95-8b03-da62e5d88ab6", "value": "9f9b4a29bff765b3a6c79737f4471268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ee88b9-951e-11ec-9275-42010a9c0029", "comment": "Malware payload (44CaliberStealer)", "timestamp": 1645671835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671835, "uuid": "bfd87490-bb49-46c3-9222-43280e1a03eb", "comment": "Malware payload (44CaliberStealer)", "value": "0fcf52fcc27114124fbb3c139d24f69d", "object_relation": "md5", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671835, "uuid": "3f38a042-140e-46df-8db4-09e1f1f166cf", "comment": "Malware payload (44CaliberStealer)", "value": "16821bc6b2d1d12709248bb605b04fe158a397717d0e6004511e70ef0f537610", "object_relation": "sha256", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671835, "uuid": "e8e2b76f-5ad0-4b45-96c8-576710b1589c", "comment": "Malware payload (44CaliberStealer)", "value": "090ab79922b78dd61173eddead0acdaffd0ba599", "object_relation": "sha1", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671835, "uuid": "a7b6eb76-ef60-4048-9755-9d85bc768b47", "comment": "Malware payload (44CaliberStealer)", "value": "aacad17b40a3a944eda1f78dd18cedd403a671f4f7b4b0190c70965003183dfda53e5eb08e2f5ceaeb0237656c6988c7", "object_relation": "sha3-384", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671835, "uuid": "341b4eee-73a5-471b-8dcc-24f67de790e7", "value": "T16B544B0027EC8B9AF2FE4BB8D4B01265C3B1B466B93EDB4E6D4461DD2923740D945BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671835, "uuid": "4af03a75-56c6-4d93-b80d-df19ca5356e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671835, "uuid": "b59cce7e-39fe-4c4a-9cf4-0a45117d80bd", "value": "6144:tf+BLtABPDOZJc9VjFe6UlwYONlYeJalA1D0/NW:kZqA6UlwYylYe91DwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645671835, "uuid": "cfac5d4c-59d9-47dc-9454-e0c44c5da9de", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645671835, "uuid": "0a832e32-b16c-4d5c-8c1e-ff02161e468e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671835, "uuid": "bab807ea-020e-4db4-8c54-ae2b01e0b12f", "value": "ey7UhSzk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc7a0db-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645723412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723412, "uuid": "b027ce0c-1b62-484d-871d-d2db89505429", "comment": "Malware payload (Formbook)", "value": "fdacc0bb23b7634fd888f0af9dfb2de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723412, "uuid": "62688795-4906-4048-b334-6830387d71d0", "comment": "Malware payload (Formbook)", "value": "16fa4566fb5c6b0b5b2a27a469e1482bf4edd934d8958d1b7ec02e99e7c4f3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723412, "uuid": "c8c52caa-bc31-4df7-aa77-bf8b7e68b062", "comment": "Malware payload (Formbook)", "value": "c8a88afb20ffe003f80443f79d11efb8843ecead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723412, "uuid": "2fd06b4d-e963-433d-a3e8-2f130f5a9094", "comment": "Malware payload (Formbook)", "value": "bd2539beed9eb0f7d2bde76187348882889238d3a2febe9d3b657721b94c5c823efcc7f1166ad6a7fef2c46d25eb8b1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723412, "uuid": "3afb0e87-e482-46a0-98fa-eafda4a73f18", "value": "T19DF4F6B6CEF0D199ECDD9B3964F20CB116577E7EAABC691C5949B12222730C39172C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723412, "uuid": "0cb01a50-e4b9-407d-9fc1-343d81d3db31", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723412, "uuid": "e5d78a91-e1aa-4740-a736-8ab3b7c9825e", "value": "12288:6KlrJEbOUcBDmD9xg3nC9SBUyG5GjhOpL4:pTEb7Mm9GCMayGEjS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723412, "uuid": "735c081e-b868-4fa1-b106-12f919d76059", "value": 776632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723412, "uuid": "6721e492-406f-4758-9c97-8dd5fa128369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723412, "uuid": "bb3cfa46-5e9e-4794-b34d-365c9af657ab", "value": "HSBC Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fc663f-957e-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1645713299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713299, "uuid": "8c788780-0b4c-40c3-ab58-f765b2df93ad", "comment": "Malware payload (CobaltStrike)", "value": "0585812902fd91a173e69dc9a22328b9", "object_relation": "md5", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713299, "uuid": "a9a06ba4-2b18-4221-bb94-37eec5d03b66", "comment": "Malware payload (CobaltStrike)", "value": "172e00e6d2cc17daa6bb8c9d688ec2839fdd39472a9f61b7ad5ca27ffed57f00", "object_relation": "sha256", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713299, "uuid": "6ee5d373-4f1d-4f97-ae5b-4132ee45dbca", "comment": "Malware payload (CobaltStrike)", "value": "828ecff65ae2bd6aaf66c1a066cae8cb2f11d81a", "object_relation": "sha1", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713299, "uuid": "8670a0a3-2196-4189-accc-26c15b07c5aa", "comment": "Malware payload (CobaltStrike)", "value": "bb8942d7f6488ed5eea7473b52cf97a2e7b47bbab0c8f696ef052917eda9a669d2f40795da3e52d9fef0d0197fdcacde", "object_relation": "sha3-384", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713299, "uuid": "dbd6daf1-a064-4c53-8b4a-461dbcbd2e99", "value": "T1BD53D65A77A670FBD4BAD17E8AC24225B7B0707013325BCB511909395F626E83E3E788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713299, "uuid": "d8a09524-1ac3-41ff-9282-915882e7e5c1", "value": "19be5142b90870e2bc89526a38a1e54e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713299, "uuid": "36a543dd-97bd-4eb3-9343-f2788d872b64", "value": "384:e38Mak0epbLjnxOx18eTW8gyG7Gaux12NIy+ea8iw0SpHVJNs4QfBVu1tCQA89XO:80k0eNhnyM1u7Lpw0iVzsJB+tCQA89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645713299, "uuid": "588f4bcd-284f-4245-9da8-351f8438b934", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645713299, "uuid": "c08700be-20fc-45e2-8bd9-a0e4d8152eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713299, "uuid": "43510e09-77db-4016-8740-a47921d33add", "value": "172e00e6d2cc17daa6bb8c9d688ec2839fdd39472a9f61b7ad5ca27ffed57f00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cb5bfb-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "7abd26a2-9d2b-49a7-ac3a-40d0f26048bd", "comment": "Malware payload (Heodo)", "value": "49444fd39145e629f5a0c0e42c13f120", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "ad6873c1-fce3-4149-af0d-e97c3a4b77ae", "comment": "Malware payload (Heodo)", "value": "1751295e73d5019fcd4e8291116d1fb8f7f1911de01a11514810190216d0a520", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "b6cf302b-2e2a-4915-83a3-bdf8e0bb5425", "comment": "Malware payload (Heodo)", "value": "e26d33a8a01d742f8419e4e426d65a4cfdddfc6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "72b71a97-2ebe-49eb-8820-f712587d62de", "comment": "Malware payload (Heodo)", "value": "69918aa3131ae4b30435cdc9c517337218bb68e76be05fa991c2080dc598cac96b8f818545c3544ac7ef1e2fd0b91a72", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "10334be5-31b7-45ba-9729-9226a2d5fcbf", "value": "T1A9E4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E781C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "d66f86a6-c6e3-4651-a411-29da335db748", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "59f4559a-173d-4525-bc55-9c1372cd4763", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuK0KDYjX3rUXY:ygHpbVy97r0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710539, "uuid": "cab9a183-6844-4a9b-a2ca-f348662960a4", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710539, "uuid": "d3651570-a446-43d7-83cc-dae3986d684a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "271ab133-aa4c-4d82-831d-f1e9e0a32594", "value": "emotet_exe_e4_1751295e73d5019fcd4e8291116d1fb8f7f1911de01a11514810190216d0a520_2022-02-24__134854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5cac09-9540-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645686363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686363, "uuid": "7a1af620-3c59-489b-907f-ccb04ae88e45", "comment": "Malware payload (Mirai)", "value": "d387ec451ada8a11452b96e62cc4cc96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686363, "uuid": "69d56d64-8a0e-43a9-bb1f-6f51183220f9", "comment": "Malware payload (Mirai)", "value": "175dccee0a6fee73a034579f406a485a4937818b348c02d96c6761ef02dce364", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686363, "uuid": "afc10421-8776-49be-94c2-27a5936bb015", "comment": "Malware payload (Mirai)", "value": "6d3be2e25bfb818f802d1a55121583f730a595e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686363, "uuid": "1cdd1858-815b-48f3-b7ae-923a24015ba5", "comment": "Malware payload (Mirai)", "value": "663112d8f9809f5365b1bdd9ae83af49a14960c81b2d10ade5c4cb28de3b8912e02f39d1f729a7dace42ecf5f19668a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686363, "uuid": "8234676a-be81-4683-ad07-cb7d505d352f", "value": "T179F2F161C75F948FD9314472CECD86519A885FF8E18EF20B0884439ECBC6B5D26B768A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686363, "uuid": "be66b534-16f9-4a50-9105-1a000a8c2cb9", "value": "768:FGTdm/4aXapqAwYHbw7x0MrCdjlZSU0cwAMa/SDuqqzAdueqt79q3UELWv:FS04mapqAVwt6djygMISKq2AmtaL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686363, "uuid": "f7fed78a-10b1-4ded-bd17-55b4888be796", "value": 37156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686363, "uuid": "31d8c133-5ce0-4727-a565-856dce2a792e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686363, "uuid": "226469d8-0761-4799-9f01-c57aeb07051e", "value": "d387ec451ada8a11452b96e62cc4cc96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc122048-951c-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1645671118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671118, "uuid": "003d2162-946b-4f0d-94a1-a24df7568989", "comment": "Malware payload (Pony)", "value": "1186336fbe23e1204501a85f8ab2f500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671118, "uuid": "0ec12af0-572c-46d8-bf4f-420befd0fafa", "comment": "Malware payload (Pony)", "value": "1806d28090fbacfecd7f998105128105b92830e971b79948697a3f0210ee30bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671118, "uuid": "ce372467-535c-43d0-927e-42cf5cbfb98c", "comment": "Malware payload (Pony)", "value": "8362a400ed36c695304080d52a18b087368440c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671118, "uuid": "018bf80c-be2d-47c7-a63d-e9bfbaa7e401", "comment": "Malware payload (Pony)", "value": "ed16719d69f807d95fc34e7ed827f79bec1b29490377da28c941e3b54ce6e28619488a671c7f998606e5457e8c453c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671118, "uuid": "50c3199f-6dfc-4a1b-8d2d-a3aa09a90a6b", "value": "T159931903F480E0F1D1A22AB177C11771EBF89F6978768D4EEF8D89856DB26977B12042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671118, "uuid": "db6b4204-d8df-4f62-af36-7815c483a682", "value": "728afd0aeb7539a2a721ececf5f36865", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671118, "uuid": "63ea9d7b-f675-4e10-9899-5e8abca2191b", "value": "1536:x3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEIWkzZ3:9dOy+ubiDBzv+1H4OgYEI53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645671118, "uuid": "585e3d9b-5a15-4b08-9745-5b8d33794bd6", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645671118, "uuid": "f454fed5-369f-4bfd-a071-010d1325ade4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671118, "uuid": "92a24c6a-f05a-45f2-85c8-79533b4ead53", "value": "1806D28090FBACFECD7F998105128105B92830E971B79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe4aa63-9549-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645690499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690499, "uuid": "57497e3b-45c1-4291-b15d-21ab8348db71", "comment": "Malware payload", "value": "60fcb97dd9e3c0ce787db9885350d049", "object_relation": "md5", "Tag": [ { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690499, "uuid": "8ebb3e9a-d7e3-4e04-84ef-0d6cc11f59d5", "comment": "Malware payload", "value": "180888bfe38fb7843583c469b893806ff0f9bb169c5e7be900779764742be229", "object_relation": "sha256", "Tag": [ { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690499, "uuid": "1de866b7-383d-4844-9afe-87060ccf3f42", "comment": "Malware payload", "value": "a115181ea8b31caf5187a3837847e07c334219f5", "object_relation": "sha1", "Tag": [ { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690499, "uuid": "631d4a8b-f450-4f07-afd8-7448a4fa02b4", "comment": "Malware payload", "value": "feb674333340caf9ac49910cca6e00b71c78ef6718d332d3c7d67f84922a4b0d52273d4693fe898a7cda78a414bcb94e", "object_relation": "sha3-384", "Tag": [ { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690499, "uuid": "5d0d33aa-1b69-4eb8-836d-abb878acdd2b", "value": "T11D1423E22521F2B51441DAB4ADECEDCB8164FA7103C1B9A33AA09C453C1FEA5DF2B543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690499, "uuid": "463573eb-9344-4137-a1e8-1309f895a581", "value": "6144:f3+O3Hpf4HsGDDXLxIlQY7yz5s99treUygn++XB:P+2HpAM1laz5Q9treUHnLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645690499, "uuid": "dc8d915e-b2cc-496a-92a7-f97d56b15db0", "value": 200742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645690499, "uuid": "44872ebd-a920-44e8-84d7-b7b0e212f0ac", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690499, "uuid": "d18f371b-49da-4f48-9b58-71271c6b991a", "value": "80.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475b5639-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645687243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687243, "uuid": "a8585807-d6c6-4141-8c9e-1c3186ec0130", "comment": "Malware payload (Heodo)", "value": "79dc62588889505b40c58eadd82001b7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687243, "uuid": "163d5080-b9d9-472d-85e0-0489d5ddeed3", "comment": "Malware payload (Heodo)", "value": "184735f6b40d2cdc282ff68a509f92e506011890b88f5c74e9d1548de46a0e24", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687243, "uuid": "7cefc885-8900-41e5-afb1-14e3b1ea7577", "comment": "Malware payload (Heodo)", "value": "b399cf9d2256d85108468b8abb07124877a9c0f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687243, "uuid": "aaa6b3b7-a1bc-493c-8aa4-b6d38a454cce", "comment": "Malware payload (Heodo)", "value": "dad734fe160f93ec0cd3993d7a54a4b5b70d75d1b74a9a27e60bdec6a38467bcb2c4ee146181ff31ceda4195a37826bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687243, "uuid": "ca572c0b-a3eb-4850-aa9e-90d6980b0382", "value": "T18E747D12A782D076C26230B086DBB3BA76BD8B316B386AC74BD11C355F745D2963D21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687243, "uuid": "86496ce7-f67a-475b-abc7-98ac75d9215d", "value": "6144:2bRgWUD7E4G8V5EqcACe/PMjQ29S0PmFLw5D1Y/O+TCJJUYdcjt0hDGH:agvTeqrCeX329Soy/O+TCJJU2QyD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687243, "uuid": "5a5ff68e-4ff8-4e07-8b04-bee8c7e9e18f", "value": 348373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687243, "uuid": "f6049b3a-5b67-4ac3-b067-6dbcf3dc1881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687243, "uuid": "b549317f-7917-4494-af39-b84dee3571ca", "value": "emotet_exe_e4_184735f6b40d2cdc282ff68a509f92e506011890b88f5c74e9d1548de46a0e24_2022-02-24__072039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4770df-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645693025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693025, "uuid": "8a3ef968-d1cd-4c21-85ee-b48fc5316033", "comment": "Malware payload", "value": "fce682b8310149159b86187d7155a30f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693025, "uuid": "da2ba0ec-7cce-4d0a-9d69-2c1a4b54d068", "comment": "Malware payload", "value": "18b84f5b722ab71d8ad1ccbf30cfed1e168c055fa1bf15fd922a2278a3375f75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693025, "uuid": "255165fc-a327-4d32-a196-dc66c96aa088", "comment": "Malware payload", "value": "a5ce08d99cf4f2d090eb5ef3c2111b1a385d8fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693025, "uuid": "23fd4a35-8bc5-42c4-8cee-7bca2de33a53", "comment": "Malware payload", "value": "d544dbe26749afa8953bd6661bcc741e37c7e6dd4188bdf37f7ef6a8387f49fd5199a3bf43b7ee90e366f025924f8312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693025, "uuid": "aaba1da6-2f50-4563-83d4-a0d503e6c632", "value": "T12C741320FB55C593C7F90130187A53FB8FB5BA7811A69B930360DE8D7D63B90A629F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693025, "uuid": "8783b48d-5bd3-4b0f-92cd-450cd8517bd0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693025, "uuid": "d21dae77-0280-4316-8b60-139904b315f6", "value": "6144:ibE/HUBEzZrtly4ZFpLH5Bo+H0G9ImcGr3mH3XepSbaik1nW:iblEFplTpLHvo09Impr3mH3laisW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693025, "uuid": "d8a029f0-e12e-48f5-9d59-140e64de6841", "value": 350123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693025, "uuid": "65482351-3268-4265-b8e8-413e28e9d4e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693025, "uuid": "a2cb23f1-6b31-4e9f-9b34-c4f58d5d7868", "value": "fce682b8310149159b86187d7155a30f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7019c712-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645682587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682587, "uuid": "357ead8e-19a0-418c-99f3-5edf2eb0955f", "comment": "Malware payload (Formbook)", "value": "dc7a471cac3017dd3d3d2d3d3d1adb31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682587, "uuid": "6793ce84-a2d0-42d4-84fa-0ef04aee5386", "comment": "Malware payload (Formbook)", "value": "1941b97a67653e19f2ece3de1f77ec8c0b2623fac3ef0ceedfbc58a8744c4cb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682587, "uuid": "14d3840b-9bdf-4d61-83d5-e5e50f427122", "comment": "Malware payload (Formbook)", "value": "950a3575f171076fb61ee3799135d9e767fc5bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682587, "uuid": "f962e10d-fa18-40e6-813a-941f371dbca8", "comment": "Malware payload (Formbook)", "value": "fdc551d2cc87369866de6fe2f056b2f0ef1dacb022d78290fd897fe0e4ab7aa0d165b070bfafcd755f141f86214b0aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682587, "uuid": "c5d3c353-7565-4152-893b-63a194aea071", "value": "T10264226673F1849BF68251304A33E32AD3FA62286E7005B787606FAF76735C5DE08653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682587, "uuid": "975879f0-acb5-4cd1-8ed0-209b8a6a7de9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682587, "uuid": "952eab0d-e35f-4f99-a446-2dbb6691af4b", "value": "6144:TxD4ZHJDm1RseKs5/k2qsj4zjUlykGO70z3zQ04qDAKFy1nN/p/IQE:oJDCseDqsMnUYs70rzQAAfDOQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682587, "uuid": "996a23b1-9505-4b8e-b74f-e119ed131215", "value": 325733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682587, "uuid": "47f407c0-44ec-4cec-a0ee-8ef6122a1ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682587, "uuid": "7c844248-7eed-492e-b43d-8e88e5f4e00d", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fa7795-9547-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645689449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689449, "uuid": "c9db9f4c-ea48-4bbb-b963-7795540c4704", "comment": "Malware payload (Formbook)", "value": "629c9cf489fcf9ba7d916ea54a6b7f25", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689449, "uuid": "7f501a81-de5a-4908-a8d2-cf5bd0038df4", "comment": "Malware payload (Formbook)", "value": "1a65737dfd0649616b5d3e994a82460032ae288f99e54a1c235f50947c9e924f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689449, "uuid": "e9772c15-a66c-4867-b91e-d17c4baff7ee", "comment": "Malware payload (Formbook)", "value": "437701fda20f07dd8dca04a2f43b85639f17cc70", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689449, "uuid": "9037d625-ad3c-4f55-b7fc-36dfa015928c", "comment": "Malware payload (Formbook)", "value": "a350f9a6b118f4689ffccf8c647d57fef5c0d51aaacdc1ab2ec7408236d7dcb91618cb2aec27d6e4e799609c7105f24a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689449, "uuid": "4df1f8b3-bf51-454c-9192-d00d614d1b86", "value": "T1DF51736D3613E49891373F61EC5F947C9CB8638A617888413A1CCBD20D3944CE7A289D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689449, "uuid": "050dc648-3b2d-4596-8493-6d66d120c029", "value": "48:SRjLVNmATqQMec2L1fIfjcAck5OE0prXGTL2vbJuUTKXkqq4b9:S9VNmAT/MHgfIbcAx/L2DJUXNqS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689449, "uuid": "07739318-f85f-4d2b-9a68-c35dd858e3f2", "value": 2593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689449, "uuid": "116010c0-8229-4f93-bbff-4429013f1c64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689449, "uuid": "3bf7c05d-b74f-4b5b-8f8a-35957f708c4b", "value": "Sewoong Ref No. MQ-3018 & MQ-3019.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86e0a70-959c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645726115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726115, "uuid": "f6e8c137-7faa-444e-8246-3190e3bafd22", "comment": "Malware payload (AgentTesla)", "value": "49b8da99ff0c25b544dd6b1d52eec3cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726115, "uuid": "a413b06d-7f98-4b71-a6d0-8bc3e5b8d6d2", "comment": "Malware payload (AgentTesla)", "value": "1ab08ff78c810840d30067ed8d90256d7074767daa4cfe798bd527b5f1953485", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726115, "uuid": "ad266ba8-a176-49f4-939b-68b53f7ba1ae", "comment": "Malware payload (AgentTesla)", "value": "17a79990721d0dbfef5231a07c9d89f68309197f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726115, "uuid": "22f6d6a9-4219-4649-80ba-da0f2e75f35e", "comment": "Malware payload (AgentTesla)", "value": "fb5fa0a4f3e60cbea53f52d68165b5aab1bb0aacc239abde7a22334ca78cc3b7622220d65ff382fbd5969db6f966ab8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726115, "uuid": "8bcfe6f1-7977-4eea-bb91-4eb34e732e6c", "value": "T1E105BE1035AF66CDF0768BFE1DD8A9B18EBAF43A3619F1B918814ED60751B41CD02A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726115, "uuid": "bee9cacd-c213-40a3-9d39-44dc73afe513", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726115, "uuid": "d1184130-7429-4981-b6ba-523518e39b37", "value": "12288:10UnEJgYYz0c9jsqJhNfyhX+W8TwO9yNcrBdLGaw+yXACtkEgl6X+/kTcqMuHgFF:V9FnvFyNcrBdLGat5IZX+/yxp0JxLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726115, "uuid": "b553fd6b-16c9-42ef-9b00-5391bf97f725", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726115, "uuid": "d82adfac-52ac-4ee9-a949-1912965877a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726115, "uuid": "905625ee-7e7d-4431-9e8a-d48e242bc147", "value": "49b8da99ff0c25b544dd6b1d52eec3cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6eda5e-95ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "49490842-4e43-4720-9a48-c7e63929d4dd", "comment": "Malware payload", "value": "aa92dcee74eb71b2a28dda8a9ce3307c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "73816a2b-0b7f-494f-99b0-32551ddf5905", "comment": "Malware payload", "value": "1b27a3244acd87f0f20e03ef3ad169841a4e9327d4782bdf35dfdf5bfc8444f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "f55abbd1-e179-4033-808d-e86e95ff5554", "comment": "Malware payload", "value": "cff199f9206ac1aae0597e77f49e2d98e100ce0d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "2449e200-cc44-4a5b-9a4e-41ee11d76d94", "comment": "Malware payload", "value": "55395cfedae024bc9c307898df353ddc91f21128ddae05ab9a9cf93b7ad33743575cf7e04421d062dfcdace6db2df0ed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "60548f0c-7308-42df-9782-2f1141491505", "value": "T1D6E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "f4ecb6bd-6d00-42ff-89a8-e8d3845a4fc4", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "b120dab9-c7a0-4b57-a66c-501f70f11155", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XAsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWAa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732487, "uuid": "cf59d708-145e-4699-94bb-8f790de5fdc7", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732487, "uuid": "b9129c87-5b16-423a-ae0b-9ebb8c98cd5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "9d4c2d9a-899a-4d22-aa1b-0c4c677853d1", "value": "emotet_exe_e4_1b27a3244acd87f0f20e03ef3ad169841a4e9327d4782bdf35dfdf5bfc8444f7_2022-02-24__195440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ab0e36-9547-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645689578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689578, "uuid": "1cebd453-0b14-405d-802b-85d601bb21e2", "comment": "Malware payload (Formbook)", "value": "971b40eb47466e6d14c907d9b816139a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689578, "uuid": "503f69fd-4c13-463f-817d-f21542439dd5", "comment": "Malware payload (Formbook)", "value": "1b311af2373360df6c77db22a4b16dd66f7790b7bf3cf304ebf8587925d97528", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689578, "uuid": "e421ab07-6bbc-46f5-ab83-1efe9b6c9463", "comment": "Malware payload (Formbook)", "value": "3dc69269c1f24202231d59187c81802cf3b22ed5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689578, "uuid": "4c70e635-6cdf-4a47-a503-34c1debf3290", "comment": "Malware payload (Formbook)", "value": "e15430c1ef2103b68927ea13886968f80cd1eb3350aefe8c119228b643bc6fa56d6df37d08817b35079c05f1715dbb90", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689578, "uuid": "2989dc45-ee32-4548-8c78-5c8d23c87ead", "value": "T1A651735E3883B514A017AFB2DD0B986D6DB4724F233D4462BE0C93C82C3D15DE7994AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689578, "uuid": "78bc124d-7b68-405b-a016-e1cc65420e9e", "value": "48:AsoqDj09rNmsa5DImbjoRS2IxLPA/MFOMD2A0L2vHIK6+qqzDw:Gd9rNm3I8jmI9PAEFxYL2PB6nqXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689578, "uuid": "39a75a21-7879-4051-a0ef-c8c2db6ec2e7", "value": 2584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689578, "uuid": "035ba0bf-8798-411a-a06e-25ec4e5fd683", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689578, "uuid": "95ee8489-a385-4e38-8fa2-26e17a656309", "value": "Sewoong Ref No. MQ-3017 & MQ-3019.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6291b0c0-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694161, "uuid": "a7125681-a919-4a3d-9216-70b007161fca", "comment": "Malware payload (Heodo)", "value": "59ea96353e4252afc04b65566607f1d3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694161, "uuid": "9410a127-bf64-4fb5-9b3d-d8dbff68c56f", "comment": "Malware payload (Heodo)", "value": "1b782f08912be966fc0474fefd9cfb17d00bcfe8a5df33bb270ae88f9c740476", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694161, "uuid": "da08d394-5a78-4830-90b8-eb0e3d7a28c7", "comment": "Malware payload (Heodo)", "value": "5050dac7b535c8464a1411b4d5bb0db20638f69c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694161, "uuid": "bed57315-3921-48b4-8db7-a1c2261b1924", "comment": "Malware payload (Heodo)", "value": "afcfcffcb82bb5d5af17c454bc310ba366b9c32d996ebd68cabbedab719566896452858a890aac1125fcd35052114242", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694161, "uuid": "3cdc5e35-fceb-4f52-985f-261bbbbcf4ff", "value": "T18893022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694161, "uuid": "57c8ccf9-4c31-4061-9ea1-7aa19cf7cd12", "value": "1536:PQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:mDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694161, "uuid": "6d6c9c6a-65bb-4652-81a5-653b70529273", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694161, "uuid": "3abd3dd1-f5c3-452e-a2b0-5c7e4ace5b24", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694161, "uuid": "993a79e8-ce62-49f5-84b8-8a381da852a1", "value": "Opast International.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eb6102-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645693044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693044, "uuid": "d37fab4b-e75f-45bd-a6cd-aa72e3f7cc6a", "comment": "Malware payload (RedLineStealer)", "value": "a05f482ae5f5433b3c935ee175e25294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693044, "uuid": "23eb244c-0ca5-4f1d-aedd-24513c5c9292", "comment": "Malware payload (RedLineStealer)", "value": "1b7d731ee5d7978c10f0e320ac3616e4fe275568906b2ff354d9b1f5c0144d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693044, "uuid": "a74410e3-fa8a-4edc-8b28-199faf39c627", "comment": "Malware payload (RedLineStealer)", "value": "a66ebaee90323d5b4ffe3a9ff549c2b6dd0ece52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693044, "uuid": "1533fb8c-af86-443b-985e-122970722aee", "comment": "Malware payload (RedLineStealer)", "value": "4b74736e68054bd6274878c990ea378bf5057fc210a7bca66424c0c4dfbad1235e2e38610e0e0e67dd71808e5f9bd8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693044, "uuid": "8f5530a3-36b1-4eea-9557-f3202ae3f0dd", "value": "T131E4F150BBA0C034F1B752F889BAD3A9753F7AA2672190CB53D156EA07356E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693044, "uuid": "88d38ec3-755b-4e9b-9d78-9f9410db51e6", "value": "4c888f60a1dc578dd3e689d327372255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693044, "uuid": "0464fe6b-7723-4ff3-ad47-59ba0c0cccdd", "value": "12288:BmGxIB2J9JeUqVE67tpBeR1sljvBX3JEhXxyf1O8RJO2V0VVUjbnv16hvmwAK:DIAH6VE67j4RgjvpmhXxyf1O8RJxVshd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693044, "uuid": "1dc958eb-06c6-47d0-930e-00c2b68cc5ab", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693044, "uuid": "71c60c57-1176-405e-a1c9-305d4bf521f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693044, "uuid": "35d974d3-63d5-489c-abfa-dd588a87c490", "value": "a05f482ae5f5433b3c935ee175e25294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826e0367-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645688631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688631, "uuid": "56c955cb-1f68-42ec-aecb-cf9aa279e3bf", "comment": "Malware payload (RemcosRAT)", "value": "f640d15afe0c55ddeffd46017fd74715", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688631, "uuid": "97c5df9d-2998-4cd5-a2c5-564e58ab97e5", "comment": "Malware payload (RemcosRAT)", "value": "1c57df0e18b660f575c6ec7c9a5958a573a49c3a5b4849ac35abcd84c57fb282", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688631, "uuid": "92f4d68a-3c5d-4c63-81cd-2481e481bab9", "comment": "Malware payload (RemcosRAT)", "value": "9103f75e75d07c65fa58b4cda03211ce7aaf0c30", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688631, "uuid": "1670573b-73db-4538-8b52-2da5364bcc6e", "comment": "Malware payload (RemcosRAT)", "value": "3ee3799fa7450900229b8e499a205a01e69b09e1416f3d107880eb370e12ecd2b6264fadb8e2ca617166ec5020b21eaa", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688631, "uuid": "f509c746-6ca8-4a43-8433-6c2ba1b581e3", "value": "T16314121B3F3224EEC207C23A29CCB8D708DCDDA6E3AC874555F0359E68B14E0996D6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688631, "uuid": "0ea19516-375c-4a86-bfce-3253ef844226", "value": "3072:+MiArIuk8Vfr67o89slGBAJkLI6g0S1fZDGZIAerqlXSzVN1+gk2w64h:viAUt8VsBL7PqwSzb1+gk/64h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688631, "uuid": "dfc4bf78-6bfb-4e1d-8250-e1f36f966b93", "value": 190616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688631, "uuid": "09ec8924-eff7-46f6-a195-273750150551", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688631, "uuid": "9bff37cf-bd83-42b6-a65a-0a9c70e942c7", "value": "RFQ CAPEL VINO LIMITED PO24019 ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6b6a3b-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645693132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693132, "uuid": "393f3d1e-4326-4208-b31d-0c7aea28badf", "comment": "Malware payload (Loki)", "value": "cea0d3fa12e0e9f5f2e73d615f336797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693132, "uuid": "bcf9efec-83b9-4ce8-90ad-9e1fb271f4c9", "comment": "Malware payload (Loki)", "value": "1c720f7dec587712b269958afd0471173746d64f2eae406c8371b2fc2551c735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693132, "uuid": "17d8c52b-1f64-4a18-bc4c-fd6518bdf194", "comment": "Malware payload (Loki)", "value": "dd0cfdc29f7adb00a41bb55548f04ab2e0107361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693132, "uuid": "c395fdb4-2244-41b9-a43f-a98a90502422", "comment": "Malware payload (Loki)", "value": "daee63da0b20b2bb5087dafd446879d404747e33bb16bd3feca2334737c0f269a8bd43b6358806b1d72b9aad57c88543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693132, "uuid": "13b2b732-6f0b-4c0e-a222-60ebfc6f698f", "value": "T1C664228C39C4043FD45963394CFF1729E77FA746112222274B669F693D163838B2AEA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693132, "uuid": "f7fcefc3-7440-4afe-8443-2b0d71d64968", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693132, "uuid": "e1d18f25-f456-41ee-a59a-741b5d045667", "value": "6144:TxD3GLDFdcW2SGFuON5EhDALAx7AIhMzv1qWN4euZ5J4FNZRuWH:oldD2TuXF2UMzv1qWNn64FNZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693132, "uuid": "d8cf7c8c-2472-4c54-95e2-9c800322af85", "value": 317282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693132, "uuid": "2ec75d5f-de6e-4e0c-b520-f03c895bb93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693132, "uuid": "433c66f4-a695-4455-ae81-a8490e003ea3", "value": "cea0d3fa12e0e9f5f2e73d615f336797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa17167b-9584-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645715890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715890, "uuid": "ef75acfc-cd95-4112-8fdc-b0f30113f791", "comment": "Malware payload (Quakbot)", "value": "90a6e1ce293fc4639c1d458aff26096d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715890, "uuid": "07ed34ca-b428-48c7-915c-e67683f2ca5e", "comment": "Malware payload (Quakbot)", "value": "1c7829f0316c7aeb94e0887bedf93e3667ab1283659bb1e3d5bcb2860d609ec1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715890, "uuid": "2ed688f3-1788-433a-b32f-a4c058a7390c", "comment": "Malware payload (Quakbot)", "value": "a079d51bcd3a2fde3e374a65532c6e7484804d04", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715890, "uuid": "ab85d4fc-b7df-4731-bf80-d626bc07a7b8", "comment": "Malware payload (Quakbot)", "value": "0fc763707dbd07d35bd9016b072764797e8de1e4aea542336e59f171178f2f1f05c0f06d94fe38a250ef052969a4d532", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715890, "uuid": "346e900e-544f-4f23-8433-2db0433c1489", "value": "T1E744021DA15CBB8EC75D203AD3085EF5ED0E12CD6A40F52B46C0BB9847FA5C34B8DA99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715890, "uuid": "02c9010d-04ca-4ac6-9f76-36cb3beb3b53", "value": "6144:sxafQTxwGF4p24e6RoPmj6M7R6SFENKq4Wnev:CacxGgF62PFNJnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645715890, "uuid": "a8a12d27-f22d-4b7f-9863-94f50e83aaf4", "value": 272601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645715890, "uuid": "8b9fb2bf-9b4e-44b0-aacd-92435a2c679c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715890, "uuid": "6fb679e9-62e5-435e-bc99-18656da0ebb9", "value": "Payment-445609294-Feb-24.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c898878-9565-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1645702392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702392, "uuid": "718ad2ff-0737-447e-8b4e-aa226679ab51", "comment": "Malware payload (STRRAT)", "value": "1b01cec3551142b050e6aed82018db21", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702392, "uuid": "9884cc9e-714e-4ad3-ac0e-cccc20f26b11", "comment": "Malware payload (STRRAT)", "value": "1d3219b6ccc538b8cbecb13eb9c23ce00a6ed315a2a7fecb9b791e9cd1888bd8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702392, "uuid": "0cf1f802-1ceb-41c5-a5b2-0361654ac027", "comment": "Malware payload (STRRAT)", "value": "0283c9ac0db969702fca3a24ec352359888c00c1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702392, "uuid": "19e091dd-1f74-4a7c-a74f-25487968296f", "comment": "Malware payload (STRRAT)", "value": "e0a1eed6c9c84c96e7e0ab3894f75d7deaea7ad61e0ac84fd85b45f4709b0b0a502d5e4165247029e4451fb6fcd05ad7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702392, "uuid": "9867243f-069d-4fbf-9299-c0b2078bff26", "value": "T13CB3D03A7F9A94B9F057483304548A63395D699DE689D12F78FC282B1C30D6D0B81EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702392, "uuid": "e55b2fd5-2ec3-4dca-9eb9-d62dad91f204", "value": "3072:k0ET+jFYpHSNTURRjSgLEJgzuCCB3RDWr:kFyjFYK3gLEJgzNsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645702392, "uuid": "cb02c706-960f-401b-af51-d80dd34ec03a", "value": 109970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645702392, "uuid": "174f76e8-d27f-48bd-b90f-7dd6017376c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702392, "uuid": "40af6fb3-a30b-42e3-b8d2-69fa5cbc0d8e", "value": "PO24022022DXB.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7d5372-957b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645711649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711649, "uuid": "3a47150d-fef4-428d-b983-2617d6aa5105", "comment": "Malware payload (Heodo)", "value": "07bc66f3b6a8ec32c79e2012fb65fcb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711649, "uuid": "72e57cac-dcc9-4d47-89fe-7d5e5c5f22fc", "comment": "Malware payload (Heodo)", "value": "1d913eb75984f42853d75b8e7016b4b6eda365fab24b8171ec9b4548913e02a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711649, "uuid": "d2110d5b-b95a-456e-949f-8f02aeaf6f1b", "comment": "Malware payload (Heodo)", "value": "f92ea456c79c2fb2e65fbaebbb34fd7945924b91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711649, "uuid": "47d57c79-d097-44c8-8a68-7b0b41065b81", "comment": "Malware payload (Heodo)", "value": "2e4058c8ac15e1743c16a0a710b0622627faed373b1ba76a623a5ea98dca802bcaa7ea0547bf6ab526053ab51f036ee7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711649, "uuid": "3e66a08e-9a38-4b6a-88cd-cebc1e06509f", "value": "T1C5E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711649, "uuid": "b82540c6-ea70-492f-a986-4da9b5a0b3e3", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711649, "uuid": "dd4f296d-14cb-4654-8ae0-950f29c8cd5f", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XMsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWMa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711649, "uuid": "8b932b05-c541-48ab-a18e-f2708dc02287", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711649, "uuid": "acd977b0-19f1-485a-b71b-2f070adb2c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711649, "uuid": "4e4db69c-ad49-4969-91df-571295d1e857", "value": "07bc66f3b6a8ec32c79e2012fb65fcb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be60874-9596-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645723275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723275, "uuid": "62c2147a-ffe8-4684-acbf-fe5967ae0176", "comment": "Malware payload", "value": "6deac17a35151e33f1dc687a2dd913cf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723275, "uuid": "ce6c6618-9772-4cdb-a030-d133222e7540", "comment": "Malware payload", "value": "1dbdb3669a860127febb17f4e1c8d931119d98569f8c227102d086a812eb5bcb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723275, "uuid": "8e28901b-6e43-4c75-978a-64360b3aae09", "comment": "Malware payload", "value": "7faadabdc7e46e525df1554f31fe858141de2bbe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723275, "uuid": "79530882-eacb-4462-82fb-3b432bf60372", "comment": "Malware payload", "value": "487f1f6424c3743cef69bc3dc115c9d9b359310d0d070d14de0f8356e0cd8eaad77ff13d7295f45e32d492cb707f158e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723275, "uuid": "203355b4-fc54-4a54-9b65-2cd7ea73b410", "value": "T1A05445A0682F0972E748AE1E50E1704A1DF6FEEAB0C19731639FA564DFD46F18EC0857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723275, "uuid": "55e2a144-4f49-4d8f-9f9f-3da74e836e81", "value": "3072:iVe9uXcR06QRQe9uXcR06QRQe9uXcR06QRQe9uXcRhlnJwdzFtr5RDAw5wfQ:madzFt1RDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723275, "uuid": "d9ae42d8-c57f-4458-8839-6d64da757503", "value": 290138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723275, "uuid": "17afdbac-e7a8-4219-9160-7b0f1756bd22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723275, "uuid": "ab41b58f-e812-441e-a61e-fe139fcb2131", "value": "JOB-in.line e.K. - Purchase Order - Request forQuotation 57780887.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37c75b8-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645698189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645698189, "uuid": "330c7be4-cdbd-4c19-9e77-5bd36c7db954", "comment": "Malware payload (AgentTesla)", "value": "89eb124f690124926f14f8f35fa5b011", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645698189, "uuid": "4e41e4f4-f439-4f6e-83da-b85bb0e01844", "comment": "Malware payload (AgentTesla)", "value": "1e0d55597a70a2d001ebefb4d6f5bbe655eca5b8e144711f0bedc71d4f068117", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645698189, "uuid": "075ad8be-2d1e-46ae-b632-5f7d0aae7fa9", "comment": "Malware payload (AgentTesla)", "value": "67f0fdb70a0185f35d8aeb71c5649e9804ed4eb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645698189, "uuid": "58429fca-eb7f-4378-8be8-c687519ad13f", "comment": "Malware payload (AgentTesla)", "value": "ed8da10dd90d16b821d8b62d96307207da29ed9c4cae4ce4a310b0ff17f0e0f92cbd61bfa39f7c06bb2999dd4c01ae20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645698189, "uuid": "c76e4643-7201-4547-ac08-9a2eba34502f", "value": "T184F4026831682D73CA3C44FE485A7A4313F95932A492E3E45DCB60EB25E7BC91D12ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645698189, "uuid": "0b9bc43b-9619-432e-89f3-cc9dd40ce2e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645698189, "uuid": "96c68260-7ce3-494b-b545-de46a69b7cfc", "value": "12288:ucgmynz6ANYK5tVeXIcWqt1U4EHKmKSfPM31km1SskU7D5duJ4gLmMLf/w8+QXde:Dynz6ANYCtUXwqt1U4EHKxFkm1Ssh5dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645698189, "uuid": "ef1ddbff-6543-491b-be30-5a7adeb72d7d", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645698189, "uuid": "c8b2f2cf-d184-4e02-879a-f08c5fe97578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645698189, "uuid": "21af3e30-f77d-43d0-adc4-b62670c4305c", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d2cbd6-9549-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645690350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690350, "uuid": "421a57b1-29da-4efd-9305-54def0a05264", "comment": "Malware payload (Formbook)", "value": "25f1df6572dcab2d531a3ed056fc2091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690350, "uuid": "d9f0feae-67f2-4aaa-ae64-31a8720cd141", "comment": "Malware payload (Formbook)", "value": "1e8c3bd4971e0110de6f8e3cbd73d60ff5bfa574319f4c15067b92f00d013bb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690350, "uuid": "1d65c063-2021-4960-9f86-dc14270aaf61", "comment": "Malware payload (Formbook)", "value": "9498b591d269e01da00a06c39045d3fb260d0daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690350, "uuid": "2870cfb6-04d7-424b-8e1b-59bb0b56b68c", "comment": "Malware payload (Formbook)", "value": "5cbd7bc51c4d9df47d39955bfe5bbb160ad701edf06b54a74a68b3d2dbf7f9d07844185fdc61666f52028758b53180f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690350, "uuid": "cb867b16-f145-418a-8648-7e621fb76980", "value": "T16694DFD9A1F7413AD9F896FCF421460F2F79BE2C9206F27A088863584483F997697533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690350, "uuid": "4147cbc6-ce15-4f0b-b5a5-90cf70ab916c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690350, "uuid": "5d776aae-2535-4a67-91b6-303f19a12a68", "value": "12288:yh04Tbt/zGeZeoz9+g7DlYjrQSEu7jS2n:v4pGBozAuRYsb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645690350, "uuid": "bac7079c-a755-4383-9c04-c6fff1c51793", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645690350, "uuid": "4e66681b-4e60-4188-8dbd-7ca6d67451ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690350, "uuid": "70d42c6e-65c4-4cd2-9ebd-11262aaf8c97", "value": "Euro Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912817d1-955a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697675, "uuid": "6e54f6b6-343d-4cdb-b1dd-7fb400633a33", "comment": "Malware payload (Heodo)", "value": "d47af21fba6c2d22bc6e32ed6615b25c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697675, "uuid": "413e9d1c-e76c-43af-a47f-91094cc2e748", "comment": "Malware payload (Heodo)", "value": "1ea09fac5a67e3a41a7d983952c841a6f23cab5c777152adc52712ac3ea7a79d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697675, "uuid": "9578244e-e578-47d7-bf12-14bfb0206923", "comment": "Malware payload (Heodo)", "value": "65ad03af65272a124be25885caf5d16e1e4b7677", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697675, "uuid": "b6393dc2-f40d-41a6-a6a0-b8db1fea159e", "comment": "Malware payload (Heodo)", "value": "f98582be9d0208073688523ef44f05b401d1a9ebd66546e4d2323426f39ae21895df1ce61a05f7b4849933d49345e47d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697675, "uuid": "06e1e109-d7fe-4f79-a83b-d2cae67c8bcc", "value": "T146E4BF4176C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697675, "uuid": "6d81e3a1-c06b-4801-9112-f58576f79b54", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697675, "uuid": "cc5058a4-24c3-4247-905d-b98a62ac7c4a", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0rhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNftPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697675, "uuid": "d8837896-0fe9-4a72-9483-69c9bcbe46eb", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697675, "uuid": "0a929017-253d-4ce6-b93a-365337622fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697675, "uuid": "efe5d855-d43c-4838-a1c0-522b7f069164", "value": "d47af21fba6c2d22bc6e32ed6615b25c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ac11ab-9571-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645707566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707566, "uuid": "8e19ecbc-99b6-4e90-abf3-e44078bcc01c", "comment": "Malware payload", "value": "d76c9a9757b0e7dc8b9181a435e1367c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707566, "uuid": "a867836b-457f-446e-b492-cb2b8e70deeb", "comment": "Malware payload", "value": "1ef83421f258453fa5ea179ebac5195d5041d98c83c2376765b477f538e642c6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707566, "uuid": "8c50b9ce-275c-43c3-aa84-4654b723b2b2", "comment": "Malware payload", "value": "8415bac738a45250781092d369a0200f92b7d18d", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707566, "uuid": "91e99522-f860-4569-9092-5250d551f937", "comment": "Malware payload", "value": "cf04fce07e94223d1524f109b4e0519a6dffd1b26273984d3aa50737e609616a08198b811f35a3f449fd7fba22828ce8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707566, "uuid": "26111a78-4e8d-4785-b8e9-587542bc0f23", "value": "T1E3312C2C3B048579DCA7D0F6E27FA49D7F145095070B0D6ACB1E74192311B50E4BDB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707566, "uuid": "6e5afca2-c093-4ea9-aed5-178b48f00c6c", "value": "48:XR0X5CUhNnyaoA6zGEj+s3eMVd1LmDaO39DLSY4:E5Cw4aoAJEjVlU3R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645707566, "uuid": "1a16d61e-77a5-426f-89be-4516aa4bf147", "value": 1585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645707566, "uuid": "b3db50a3-f92a-46e8-8ce4-a2343d127f46", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707566, "uuid": "54d4c6c7-f7ca-4415-9140-9bc2b59b7c17", "value": "image017.wmz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602c3425-9539-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645683420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683420, "uuid": "1647797a-559f-4f3e-a7fc-b5db8c012e67", "comment": "Malware payload", "value": "af9e99a26ffeacac8691158666949469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683420, "uuid": "a36111dc-d143-4337-9ca8-ac589f5de404", "comment": "Malware payload", "value": "1f17845b5bfad5cc3cea73daeb11fe69ce8ec38d924a8660eed83059a423f739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683420, "uuid": "2c248e58-eadb-4c74-a222-af0094c8948d", "comment": "Malware payload", "value": "50e881e2bed73706484e42a9589316e86cfb9d4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683420, "uuid": "6b62b925-77c2-44a3-9e0e-a47efa2ab46c", "comment": "Malware payload", "value": "da04565cd26e2dba9eafb5c567bc6a66f605ff088fd3cdcef3f8777c4ebb952f43c74c2f3b2f6bec80ee7fec4ba57e7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mikey", "colour": "#B4B08E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683420, "uuid": "d01bbda6-b158-43ad-85d0-e628b3d6e1a3", "value": "T145C53304F790985DDC19513036EB971E3B2DCF86AAD986BB2A0CF9BE8E5C31461BD4D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683420, "uuid": "12cfcd38-6a29-41a2-98a0-a6ed7cf76854", "value": "97ff28f32f3ebff9a908a65f4487a2e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683420, "uuid": "f8737a15-f658-4af1-9eea-35e7d9deb664", "value": "49152:K4yTz9s1q+FyMq2MYSsV1U32v73Jy1nCtRCNfD5+/oJOcnty8aosDp/AFF4AZI5C:K4+sIMq2GJ32D3Jy1ERCBMoJJntyosDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645683420, "uuid": "1d9c4d06-c0da-46b4-88d7-19f778b25315", "value": 2715320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645683420, "uuid": "e715d4f9-21c5-405f-a540-9b25a7506253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683420, "uuid": "4c43362e-f995-4dfe-9103-e9062393b7bb", "value": "Main__Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3778cab-95b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738079, "uuid": "9dad7b2f-e4db-462d-b474-5ee6893fc151", "comment": "Malware payload", "value": "2b7430729a6f8cb52731d51b30afeb25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738079, "uuid": "ba23862c-d7f1-47cf-942d-17b9904e5ae8", "comment": "Malware payload", "value": "1f3ceb1495a34de8a8c52e9e333028b50da280d70f6953f95ac3b4dd3a665e0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738079, "uuid": "aa25b35a-e4be-4beb-99de-88e4db92e55b", "comment": "Malware payload", "value": "57555eb33271a8f2552031bb702b5294105bd1b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738079, "uuid": "cbf30cb9-8bbf-4d61-9e4a-b5a3ca8b556a", "comment": "Malware payload", "value": "09b096adf12317e56f5c0ce538146386fe8f663542c87a5184949842d0406ac2ce9c583e185e7b6fa8b28e82a7fbf436", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738079, "uuid": "3c5d3028-4264-4aef-a608-010e87c5b82c", "value": "T1DEE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738079, "uuid": "1cbb04f7-9b91-49e3-bced-36e9ddf70191", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738079, "uuid": "103ef526-a5fa-45be-8922-7cccb68ea4d8", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0X5sD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFW5a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738079, "uuid": "c9194a18-85bf-461a-852c-bb7ca2ee5bdc", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738079, "uuid": "b37e26f3-dac4-42a7-820c-f494c648af94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738079, "uuid": "5b85a51f-ba78-4f71-8d22-65e4fe494f65", "value": "2b7430729a6f8cb52731d51b30afeb25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5968c250-951d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645671382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671382, "uuid": "0fd6059c-fb31-48e8-98df-d08bfd08d527", "comment": "Malware payload", "value": "6b8b605bd7ed5e4bb0d1bde809065b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671382, "uuid": "bad1e221-97fa-448b-8e44-a6be532ad021", "comment": "Malware payload", "value": "1f73a9da45f9d484c31eb11b2fc4c2c0c4c8265e1ec511ea855fab7f3a9cbd52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671382, "uuid": "7efe5a55-087f-4047-aba1-ef0738852edb", "comment": "Malware payload", "value": "d092859a57e8a90ac8a0dc794ce1b6c55570feea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671382, "uuid": "dd4f9a6b-8600-439d-91e6-a5852b1195d2", "comment": "Malware payload", "value": "ecb4c50691abf7f191f79274ea4ee3d948a2c5425d21f7034495c8b66261ac31586ae8d6b0e4b76330f215af5d93390f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671382, "uuid": "8035bde2-be02-46d9-b7eb-24f2d0c1674f", "value": "T126F41213B3C30031F4614A358C668044AD6779B919F550A62FFDEB4E4FBA7C69C7AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671382, "uuid": "7a08e083-03be-4871-b343-2cf466f3bced", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671382, "uuid": "b4f0b468-8eaa-4bef-bbba-80645d535110", "value": "12288:uaHc64b888888888888W88888888888UjscV7TdjL47zdU5imIrvx33rD+zG/oBA:F869IW7uvmQvTtezG/aYFkJR30F6rp8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645671382, "uuid": "72713c11-e923-41dd-9db1-51c9ae942473", "value": 765139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645671382, "uuid": "fb260ef4-f128-4f76-a9e2-203650573995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671382, "uuid": "84e2f379-04cf-4426-b0ca-e1b43a4df2e2", "value": "VbsEdit 9.08.68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38241dff-95a4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645729309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729309, "uuid": "514e88d8-244b-43f4-ba1d-deea96181fc8", "comment": "Malware payload (AgentTesla)", "value": "83a34a9d155fceeb0e1e6d37ad009dbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729309, "uuid": "4087c081-6457-4761-afe7-2aff94dcfa15", "comment": "Malware payload (AgentTesla)", "value": "1fbdf84e52f5b72641e9e6b0db578bd9bbecae592d1bedc5c520d646e315fc8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729309, "uuid": "fe439e2b-d09e-4007-a598-6404f32b3ba7", "comment": "Malware payload (AgentTesla)", "value": "7c08d5c5c93a686371c762751328dbafe34d239a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729309, "uuid": "5eeff492-191f-4528-9221-47c9ce37a1e1", "comment": "Malware payload (AgentTesla)", "value": "dfe512432cd1a8dc2c8149842b69d81d6b80283a3551e18914add11667614d6e155eec7b679ec6dc0ccac6b5622a9d3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729309, "uuid": "9c84e7a8-f7b8-4890-878b-14daf0097c95", "value": "T122D2F805FA1C8610DF648AFED4B3FA4A23E0DE525D12E50A6987334B1F33F85CAE4659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729309, "uuid": "0b9594d9-81a3-41e4-ba12-54f84bc0484b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729309, "uuid": "c1d8166b-246e-494a-9620-ccea8f47017a", "value": "768:8982rNmoK3i7w5ZZTbFAQt82fcCcKpKvSoWo:682rNS2w9bFAS1kCcXvSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729309, "uuid": "4757b412-cd50-438b-bf76-543732b2c20e", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729309, "uuid": "e9471afc-b5ac-4eed-b4ad-cc64ffc544fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729309, "uuid": "a9a84bbb-632c-4af9-999d-61f0a4a39855", "value": "Cqszs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a954564-9535-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645681773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681773, "uuid": "79e9bd03-6e9f-4eaf-8708-1bb706cfbedb", "comment": "Malware payload (AgentTesla)", "value": "bb3e26584bac0737e127627494c3cce8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681773, "uuid": "b5d9f238-baa5-46cc-985e-acdf1536d06e", "comment": "Malware payload (AgentTesla)", "value": "201eb208de8a08f78849811268d78fec313ddd67a735d4f8cc04d15a008852cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681773, "uuid": "587bb033-d3ec-4899-bb36-57ff5ff9ae29", "comment": "Malware payload (AgentTesla)", "value": "82e557cad74574aacdf3e63dc87cf90ba972efb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681773, "uuid": "f9a8be1a-7c0b-438b-89fd-a7bcfcc98438", "comment": "Malware payload (AgentTesla)", "value": "e4d568dfa9947739265fdbb3718c49fd50a7c93c7b3a244eb37f6d4255ecaf7775d470f71c1a24d4b1eb6273e4529b56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681773, "uuid": "4f1e3ae5-922c-4040-acd6-3b4f09c397d6", "value": "T16184BED991F7427AD9F886FCF461564F6F79BE2D9106F23A088423090493F993A87633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681773, "uuid": "bda89d08-16d2-43d5-935a-13c0952bafd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681773, "uuid": "77f49e8b-6472-49c6-a976-c2f481cdf487", "value": "6144:Etu04/HbpSGIEm2Y1E/Ro22cZKLpR4t4wy9duS0WU6K5sbj:EM04ToOHR15cLsOwyH7U6KKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645681773, "uuid": "f21f5fdb-8257-4ca8-b1f1-d33e008f9b39", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645681773, "uuid": "c8f1e0a0-f7e5-4e02-8999-d2ac6bbce648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681773, "uuid": "6445d03e-6ea9-43a8-abbb-afe4ab8792b7", "value": "PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a29dd63-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694174, "uuid": "d1a5ceb1-4cdc-4a72-a658-38952cd15241", "comment": "Malware payload (Heodo)", "value": "383e1d373fd22e15b02966aa45a610ef", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694174, "uuid": "e55fb2ea-6952-4ad0-96d8-ea9d3e2ed8b0", "comment": "Malware payload (Heodo)", "value": "20d8d7dbe50450c0b255fff56ee78de1bb86318027f1e2c1056422ad352d3e84", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694174, "uuid": "dca7ec9e-6a5b-4853-9eb5-bb9ebe2f9231", "comment": "Malware payload (Heodo)", "value": "26690fceb3b085db660113d02653142f89cd1cc3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694174, "uuid": "30c475d3-e85a-4bb6-a69d-206efa313904", "comment": "Malware payload (Heodo)", "value": "30b1f8f194f2870523fd70e38dc115b3806292955212270967015692d4211007ce55c3a7ce029f96c5a1a8e0f948a694", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694174, "uuid": "a8dedb26-5c13-46b4-bbce-979cd45a1764", "value": "T1F093022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694174, "uuid": "12fd009d-c57d-40aa-91b9-846538fdacf7", "value": "1536:jQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:KDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694174, "uuid": "f8a9a09d-d03c-4316-9588-81bd19555d22", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694174, "uuid": "b697cddb-fd80-4dd0-835a-5d3f0580cf48", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694174, "uuid": "8c833dc6-bed9-4d45-80b0-2526fe9f6349", "value": "Opast Publishing Group_6.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57056e13-9555-11ec-9275-42010a9c0029", "comment": "Malware payload (LimeRAT)", "timestamp": 1645695430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695430, "uuid": "2b097ac1-4989-4202-8c0f-1b4b89dba031", "comment": "Malware payload (LimeRAT)", "value": "a2576134f7212c1acd02253cd34262ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695430, "uuid": "f2985064-7ef7-488b-9171-28aaf097cec9", "comment": "Malware payload (LimeRAT)", "value": "21518429cbe8df95c93001c3d827db3c9a3ac32c7667a79356f30a0eccc66dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695430, "uuid": "fe78fa5a-22af-4630-835d-71dad8bd5c8c", "comment": "Malware payload (LimeRAT)", "value": "c083892d4ea792f3dffe4dff9275f762d7424a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695430, "uuid": "d7e825f6-b075-460d-b666-019d783d9877", "comment": "Malware payload (LimeRAT)", "value": "13950961aa95a7f1b57be2f98d8369a57b02f2096e93a55458e84226fc44c2bf003f956ff5fe6f6e4355451474032e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695430, "uuid": "a4829cc8-9390-477a-82fa-3070e1b34994", "value": "T12CD41816BA558E01D0D94B33C1E7941087F2D98A6677E70E7EC912960F037EEC98F6CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695430, "uuid": "1f59dfae-419a-4694-97c0-95d218aa3b60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695430, "uuid": "b4c6b692-8846-496d-aa83-b486856a67f4", "value": "12288:539WWX4Vcevv6YF6zIaSA5/oBFLCf+CXQtQAJP12iNIzTjg:5aTz68Ey2+CA3JN1iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645695430, "uuid": "64687eae-fe22-4dae-8ac9-e4610c443c76", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645695430, "uuid": "68ca0143-ed29-434e-8583-dcfbda456309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695430, "uuid": "dd9aee06-c096-41f6-a808-566db07874f8", "value": "a2576134f7212c1acd02253cd34262ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00231678-957f-11ec-9275-42010a9c0029", "comment": "Malware payload (Metasploit)", "timestamp": 1645713323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713323, "uuid": "bf30f831-1d11-4b10-9e13-4e1ec4f36608", "comment": "Malware payload (Metasploit)", "value": "def2bba7fbd7ae0855c72010243dd554", "object_relation": "md5", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713323, "uuid": "665b309d-a828-4539-a5d5-40cd320e293e", "comment": "Malware payload (Metasploit)", "value": "221cbe544b658980ee58b78e771dcefddc4bc7aaffcaf7798596aad23423c31b", "object_relation": "sha256", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713323, "uuid": "c792eb66-f34c-41e5-9f5f-0f6d3e645505", "comment": "Malware payload (Metasploit)", "value": "28ccfcd2357d7043d70c3666d066bf3ce9ad37fa", "object_relation": "sha1", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713323, "uuid": "6e96cde1-c5d7-468a-b3ed-77b7977e0394", "comment": "Malware payload (Metasploit)", "value": "ef17690123237408614ffaa8ace2c583140d598d2a6254e48549f79fc996e4ea24e3b55c2634e77052a23bbf42eaf8de", "object_relation": "sha3-384", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713323, "uuid": "c1be8887-f1ab-487d-ba9f-e83ac04b948b", "value": "T1A4A39E1175D2C032E57619351860D6B05E3EFD302F61AFAF2394123A9F316D2E62AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713323, "uuid": "207c4233-f36e-4c55-ab7b-0a0c2eb66092", "value": "e106c72572e79d7bbd7cdc2ee16329f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713323, "uuid": "c93a2778-fede-49da-9b92-1e1d4545bbf0", "value": "3072:X4A3tWJ7OBj6fwupHjaOjHbT5e/++ywPTu6KRf1NYB:vMI+ege/1TIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645713323, "uuid": "985d6999-ad87-4f56-9cfa-959b3270456d", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645713323, "uuid": "49b6f682-0f6c-40f0-a613-6a988c477398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713323, "uuid": "21e91682-534a-4833-8130-2c8f7310e432", "value": "221cbe544b658980ee58b78e771dcefddc4bc7aaffcaf7798596aad23423c31b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529e16e6-9571-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645707449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707449, "uuid": "e4e075da-8f05-4e4e-b5d6-b12016e1e2ef", "comment": "Malware payload (AgentTesla)", "value": "f309f5fa277ba800a2fc18646bc0885e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707449, "uuid": "957ae8ef-3818-447f-b464-d9eaca3372ef", "comment": "Malware payload (AgentTesla)", "value": "221d063d5e97ee5ea5a8f0721bc3c83344b0e90c441cb8e04b1b122035819ded", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707449, "uuid": "e6b0f6c5-42fa-4559-bede-3df9a03f74da", "comment": "Malware payload (AgentTesla)", "value": "2db984fa556b91416ba0d6ec183c0ae8d67cafb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707449, "uuid": "886dbfcf-852e-4145-9bbe-411ca0e3f485", "comment": "Malware payload (AgentTesla)", "value": "caedc479d25f769174b08a7bfa18e3e4421c5da2cdfe55b9d13bbe3b69c53f2e2d5fc85808f6c1ef6b5664243ef1c510", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707449, "uuid": "d6f764e0-4e19-43df-aeaa-d87889d5e69c", "value": "T17D842364B395A2CCB5A7C22723983D504BE56CA57233E8B677C437A4850BE43CAE1897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707449, "uuid": "d2318383-ac40-4f65-a64d-4a1e78dbe235", "value": "6144:hewY7EnntOSqWOpBUzgFJJ4ZK1nyTknoEWVedoGQujDgcLnZsNR/+/MCG86GYXsE:htVqtrUzaJ4ZK1nyTTVedBfgcGW5BtzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645707449, "uuid": "1cc49d0b-8cbd-4aef-8884-e6efbc4600da", "value": 383148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645707449, "uuid": "fd82516f-9d35-42a7-a9eb-35044e9f75b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707449, "uuid": "10eac378-6781-415d-bb39-4ef04d2fa00f", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb85b077-953f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645686257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686257, "uuid": "7720571a-eb05-461d-8bdf-73541f00a561", "comment": "Malware payload (RedLineStealer)", "value": "8c8d47afe7991197772f3cfd4b1d2018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686257, "uuid": "f84b428a-1653-426b-a94c-75c023fb5a19", "comment": "Malware payload (RedLineStealer)", "value": "225c95e3a8aeecea3e461ba3412047f6f456fc2dcf62a0b4bd5b52447817cc0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686257, "uuid": "fcf9880f-43d1-483f-b7d1-031cb7f9534f", "comment": "Malware payload (RedLineStealer)", "value": "0166e3aabf7444f3b13f720a70ccb45782197f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686257, "uuid": "b08b4d33-3b11-44b7-992f-a9fe2981ef8d", "comment": "Malware payload (RedLineStealer)", "value": "75428a40f9d824cc42ebc9ae2bd6d5ab46446f7d370d53a66672a921b5168c22136b98caafc33bea937cafe16f4a5c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686257, "uuid": "9ed6b2ae-dd5d-4901-bee1-af01c3d7e5e2", "value": "T1D2658E0122F9A07AF5F31A39512B4218CF27B85651B6840F3F3CBD7C1B76E45893AB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686257, "uuid": "8520ba80-dbf0-4aab-b401-79d7380f90c2", "value": "99a8602e294cfea24c2cd85a5270289e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686257, "uuid": "c839d52e-dc34-469c-bddd-aea31a09799d", "value": "24576:i422iZKBn/Tliakcs1WxQSxiLupi/5Tz7saH8CaSG/lpk:i422/Llxk4t4bavtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686257, "uuid": "5fd968b0-b263-4e15-9ea9-ef6d9ad9d1c2", "value": 1504576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686257, "uuid": "f807f49e-6ed3-4389-98a1-2385882350a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686257, "uuid": "6f96c6b5-49eb-4ed6-9b43-d60a4cbaa2d6", "value": "data64_4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7405dc-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "60d63060-f41f-46ef-b87e-c1516fff69e7", "comment": "Malware payload (Heodo)", "value": "b035a3e987ba378092c6c23db1eb6555", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "a10b11c2-03c8-429c-b50b-4b0b11b6a8cf", "comment": "Malware payload (Heodo)", "value": "239639282338b5a106a4475f8d873b4a637746d84dc4509c2e9a8784dccd17c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "c923ad33-40a1-4828-9eb2-885fefee68d7", "comment": "Malware payload (Heodo)", "value": "f6636d25940ec5ec484b8253ae3cb3156d84faa1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "65c9a50f-5e4f-4f93-8804-8ec81c881a98", "comment": "Malware payload (Heodo)", "value": "a2e2822a3a0e579f518ce080342e0300a277bc4d7d5fdb34635137043ce8065f67459a17da10788c7deef272331dd951", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "fd7ee7de-302e-474c-9613-ccd788b1f82b", "value": "T159E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "759d74ab-90ba-4dcf-ad5e-06c0ede570e7", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "21514018-d0f6-4733-bd41-6ef43e51accb", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKKe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKKLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660942, "uuid": "2b6e37c4-fc71-4e3c-9724-bf928746b1f3", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660942, "uuid": "84316632-a66d-40c3-a800-85c32d027d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "f76009db-2f1a-454f-a80a-89f7c32fc43f", "value": "emotet_exe_e4_239639282338b5a106a4475f8d873b4a637746d84dc4509c2e9a8784dccd17c2_2022-02-24__000215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be88825c-9546-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645689161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689161, "uuid": "05eedcef-e8d6-422d-b9ff-79461938085c", "comment": "Malware payload", "value": "fe146b94b73f83153af7c06fb8e91717", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689161, "uuid": "ccfc851d-13f3-4f8c-a7cd-0be6c579b8f7", "comment": "Malware payload", "value": "24194cf69700efa9eff9dd4ec4774ed814d8e1c9037f7185d1e5ac90b9f3e716", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689161, "uuid": "d8748800-c9ff-48d4-b532-70881a350eff", "comment": "Malware payload", "value": "d6780e7f37bed3d4f28d2c3bf8adcb4f87526ec0", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689161, "uuid": "255c5101-44f6-48a7-be21-75415443d893", "comment": "Malware payload", "value": "8bce556657f13573947f6ed2ee0867fde15928537060966ce02194195c3793d505dacfd1acf3adb3d717c3d28aed4cb3", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689161, "uuid": "1221c14b-369a-43d8-99de-7a2b32ef9d81", "value": "T16F13BF18C101210AC2736A3EC83CD4E91DA7DC57A22A449FE5E9794B1B64EDF274EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689161, "uuid": "4f0bbab3-289c-4c01-b1fb-75aba92ad6a2", "value": "768:Z+ntRD4S0JS00SneSnjS0yS03S0IMS0bS02SxD/PoVK5Z1lDVn3QFTy1xqwVwxyh:Z+njp75eAGAvb1/K8NytsRA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689161, "uuid": "92688fc8-b0d2-42a9-ab12-97dc17de2843", "value": 42644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689161, "uuid": "b52f017c-c2e4-410a-af8a-705abb3db7f4", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689161, "uuid": "3e6783c0-ea17-4821-ba11-c91f5f143bf5", "value": "PO.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ce0295-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "5438a475-fe0e-4d32-be66-2f8eefb3ba42", "comment": "Malware payload (Heodo)", "value": "1dba84f94328789e9ca6d07cb14ca80a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "b6a319c8-32fa-435d-8c8d-ec7dd1fb8a31", "comment": "Malware payload (Heodo)", "value": "24c96b02bab41f4ba790bc2e2d396d349f165ffdf852ae722817205899fb0876", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "e91fdfa1-0acb-4b29-a60f-2d67e01138a9", "comment": "Malware payload (Heodo)", "value": "813de00ec230857490cbd852298dd892b5fcc4e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "9a6e0917-4245-4354-a2fb-bf08911b704a", "comment": "Malware payload (Heodo)", "value": "e27ef06fdc603d56f9698f91d54b878eca31fb8df5093a68dada0cb95697adc1c0f4658ead15f925cdeb6fc2a05d8a03", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "30016ce4-04d1-4e04-b52f-7057f6379461", "value": "T1E0E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "d67c6a02-21c4-4d76-99c6-b99ea1c1f26f", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "74954e74-e5b7-4d63-adc5-5051b0ead251", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKpe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKpLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660941, "uuid": "d8ccfdaf-385b-469d-9076-7f3f41fd8696", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660941, "uuid": "4f3c1021-90db-454c-9fab-dcc4992b4f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "94ba41d6-ef1e-4466-afc0-c44ed969c706", "value": "emotet_exe_e4_24c96b02bab41f4ba790bc2e2d396d349f165ffdf852ae722817205899fb0876_2022-02-24__000215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97931298-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645723456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723456, "uuid": "eefaa08f-987f-47b2-95b1-6b562d349c40", "comment": "Malware payload (NanoCore)", "value": "81b439d015e99a1665d6687b1b18436f", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723456, "uuid": "b293b6a3-f5b2-4214-b788-659198296d35", "comment": "Malware payload (NanoCore)", "value": "24f1080061307e78c9630ca5e35ef1daddd224035163a72f6678098507fcd8b0", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723456, "uuid": "fe7eeb10-649b-42d9-ab12-f8b68b31aeec", "comment": "Malware payload (NanoCore)", "value": "a5fc08c68eda26d375858d775fb770ec3b4109f7", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723456, "uuid": "70f7a5e4-2d0d-448b-96c2-5460c63b6031", "comment": "Malware payload (NanoCore)", "value": "1e09ef3cd1b27a225fda7b3548df1199d969b4fac55c6e4ded10d4532ae43adb74a031734ccced60565f3cc2a365aabc", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723456, "uuid": "588d6570-9a46-4204-827f-5d713df8169f", "value": "T1E651616EB133A424A5137FB1DC4F08AC6CB4638672B984407F18C3D95C2E4ACABD1D5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723456, "uuid": "9b28cc59-49df-4e7c-afc1-35b71e517abb", "value": "48:89dPjBWtNmAdSF+0KIYkLfQovbTAQjOD4j5/L2vD1S4KFxyqqLyJ8:GlWtNmAUSIlfQy/A8DRL2rsRFdqWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723456, "uuid": "aaa6cd8b-6f7a-4ede-8619-a6643fdc9506", "value": 2551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723456, "uuid": "86781d09-5dcf-4ede-a2d6-6206ae542196", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723456, "uuid": "874b2e5b-e6fb-470f-acbb-2820364f66a8", "value": "Payment 456363728 document.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd47d3a9-957e-11ec-9275-42010a9c0029", "comment": "Malware payload (Metasploit)", "timestamp": 1645713318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713318, "uuid": "09c423a4-dedd-4b2c-92a3-d2667f5b4a2f", "comment": "Malware payload (Metasploit)", "value": "4207b6815a8c399be846254552aeead9", "object_relation": "md5", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713318, "uuid": "20ed6d31-cd23-444d-8dcc-b9659b0fdce4", "comment": "Malware payload (Metasploit)", "value": "258df67fd269f05585a07191ae67e4bd8378606d46a9aa10bd3473604bae5d85", "object_relation": "sha256", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713318, "uuid": "c4ee23bb-6f00-4286-88e1-845547a1f255", "comment": "Malware payload (Metasploit)", "value": "28881550c6d2895d03ed8ffdeb1ef166f15b34c8", "object_relation": "sha1", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713318, "uuid": "22b55602-209f-4ddf-9265-1db753cdde27", "comment": "Malware payload (Metasploit)", "value": "c5de3ea6b977e7f0d44202f4b86420144f4f4c2699ffda456e016f7f320810b9bc7c769c99a606e29a1dbf3cfdca7835", "object_relation": "sha3-384", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713318, "uuid": "fe8b74ac-2dff-4dcd-a180-b0343646f009", "value": "T1B6A39E0175C1D032E57629351860DAB05A3EFD302F61AFAF3394623A9F316D1E62AD7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713318, "uuid": "f910913b-4174-47a9-90aa-0b50071e6a6d", "value": "3f6bcdf0bf3723a476b01b3f010095c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713318, "uuid": "cc8b4f05-b798-4141-8d5a-029aa2e008b0", "value": "3072:hLnBtWJuOhjvfMvpWYS+/fDpktQCOmf4wOOY8x/N43:CpkhcWbrCOQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645713318, "uuid": "2eaefe36-6bb1-44a5-894c-4fce86c27780", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645713318, "uuid": "bb7c80b3-4cbb-43ee-8734-d2bcad8fdcc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713318, "uuid": "77a9ef8c-005c-4441-8a8c-c41f3092d077", "value": "258df67fd269f05585a07191ae67e4bd8378606d46a9aa10bd3473604bae5d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115e49f3-9575-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645709057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709057, "uuid": "62b15e44-338e-4bbc-a9ea-6b9951fafa6a", "comment": "Malware payload (Mirai)", "value": "4180f2951c2ec3021b432a453fcd966c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709057, "uuid": "982795d5-a841-492b-928a-c0408be88814", "comment": "Malware payload (Mirai)", "value": "2610bc542f98c437b80821fed13c6d5e9a49df2378c6caea56b062195383d0da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709057, "uuid": "67a96f6a-92ac-4686-9415-aef494c2473d", "comment": "Malware payload (Mirai)", "value": "fe49ef5d8a9fcc9399e528ada3685640760f30af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709057, "uuid": "26bf6bfb-84ee-4b47-9568-0d3d1f3e6d68", "comment": "Malware payload (Mirai)", "value": "05dbd1a076c90584a7021e91d92b17d400d3f8a2d1aae4c9260f33d9be187189ed8cf6b9f76de45388370bf1360fb661", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709057, "uuid": "56f7527a-c0c8-4613-9346-75dd186f7ea7", "value": "T193439E72C92B6E64C0588670B5A49E340F63F414A6572FF14D4BC662940BFACF2AD3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709057, "uuid": "ed75e23f-be67-404d-8634-1d2db52542e8", "value": "768:YaBWEVeRqmemeZepe+5MxWvntTxa68dOsSHCRf64oQPpqMTCRuCW1:YaBdVA3rIQjMWp0FSHEiQ8MTCRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645709057, "uuid": "320b997f-48bd-4bb5-8d5f-5c059609cc53", "value": 58860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645709057, "uuid": "fe6ff745-c955-4df2-9b2b-d0fd2c94f23a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709057, "uuid": "4f7e103a-f75c-49ef-b037-51af4f97489d", "value": "4180f2951c2ec3021b432a453fcd966c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c727a3-9553-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694791, "uuid": "cbe708d0-5dbb-4f12-923c-18311fcf0e96", "comment": "Malware payload (Heodo)", "value": "ddb8d2fcf8bbffdd8d29870131e42275", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694791, "uuid": "5c6204ad-2f92-48aa-b477-8d55e9869f19", "comment": "Malware payload (Heodo)", "value": "261ef3df05cfc741641d380e305922f67d4415fa99990d46f7a6478ad09905d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694791, "uuid": "4829e20d-4b67-463c-801e-1fdbeae7e8b2", "comment": "Malware payload (Heodo)", "value": "584abbb498ada0d0c8b02a3aca075cd106407f35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694791, "uuid": "5781c2e6-9625-487d-874e-79a777ccd167", "comment": "Malware payload (Heodo)", "value": "be52038b159f244ef95895569baed9c6dd66bd13b97a456158837af90819d97d6908b66016f55d0b93b4622e3130b01c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694791, "uuid": "7e60753c-c945-42d7-94e5-2e86dd452097", "value": "T18FE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694791, "uuid": "7622d1c7-227c-42e8-b331-3efb159be8cf", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694791, "uuid": "ebb2cec6-ed9c-45ce-bce7-1a5d4416a4f0", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0mhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfuPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694791, "uuid": "44fd88bc-6fa1-432d-b121-109105228711", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694791, "uuid": "11e1a652-309c-4357-a7d6-64c62e153a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694791, "uuid": "46bf8631-ef2a-4b34-aa92-6b5224aed205", "value": "ddb8d2fcf8bbffdd8d29870131e42275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd89df3-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645682828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682828, "uuid": "859ce638-6c14-44a5-bf28-82bc17dcb2dd", "comment": "Malware payload (AgentTesla)", "value": "b436d1ca51a0348a48df555db231efa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682828, "uuid": "56764a47-de22-4823-9e31-0c68251cea56", "comment": "Malware payload (AgentTesla)", "value": "267cc56109262aba14729e6705590c3583540d2a5f3c4631a5bd7f49432c0a4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682828, "uuid": "c311ad8e-c33f-4eb9-8947-8d21d76a3e33", "comment": "Malware payload (AgentTesla)", "value": "008a1b7b2344349172e6549163c2bc6347b67c54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682828, "uuid": "e157e464-041e-422d-98df-ac7079e0dd41", "comment": "Malware payload (AgentTesla)", "value": "ea8a338a9679801d46dc859338e9b314433f8829fcca596a8fb00c9896b7079ee8199edd743e9b95f00faf34d6e022f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682828, "uuid": "2d1f3702-6dd3-4821-8558-db6d0780fd93", "value": "T17015CF4839AB5F3DF1B18BB21DC4ECB4BA59FB231C08B3BD78516246C6A1B409943677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682828, "uuid": "8c055f15-22ee-46aa-ae29-6fd7221bfe42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682828, "uuid": "ff333451-cde4-4080-a56f-c671f50262c5", "value": "24576:3K777777777777LfvoYC7ljYBEFiCZPZrXCxPiOlMZTbak9KKi:a777777777777zvoYC5sGFiCZPdiiOlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682828, "uuid": "d38a8b5c-388d-477d-bab0-57996006c777", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682828, "uuid": "3097d237-f8a9-4632-a8f9-816860cd12fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682828, "uuid": "cf8d700c-4db4-4371-898c-e9338a6827f9", "value": "PO-23022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6f4ee2-955a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697696, "uuid": "b74be0a2-dd1a-4096-bb41-f9fab140b58f", "comment": "Malware payload (Heodo)", "value": "38d23a90d660cfc58b7a8f189ff60c98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697696, "uuid": "ba87641d-ff93-46a5-b553-4b3231a2ff5d", "comment": "Malware payload (Heodo)", "value": "272716d028a0b1f02657822f0ae07100f42acfdc2153e26c1283a7ef4eccc8f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697696, "uuid": "bb4e4958-00b9-427e-893a-cf878f4e7929", "comment": "Malware payload (Heodo)", "value": "98670b24d29a72b44bcafe0928096082ad1d9567", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697696, "uuid": "778adeb1-e43e-485d-86e4-f8dfd6910583", "comment": "Malware payload (Heodo)", "value": "792b5665a70d36d2e83170ff4ac3bda4d90122a50c59cf10e9f6d4ce61fbeae0d3586110c6a6ee36603a3a977f92150d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697696, "uuid": "0b3ca94b-6459-47b0-9d69-8b62a7eeaa83", "value": "T187E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697696, "uuid": "b33f8547-84e1-4a29-8439-2e488eaf3bde", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697696, "uuid": "80b0cc50-21ee-4290-84a5-7882d4b23c6e", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK+e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK+LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697696, "uuid": "278eecf8-88f4-4640-94ea-d7a5d1c3cfc9", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697696, "uuid": "b443b46a-c3bf-495d-b354-e7540ba57fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697696, "uuid": "7759a54e-c8b6-4012-858b-344b3c407ba4", "value": "38d23a90d660cfc58b7a8f189ff60c98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfa7468-9541-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687093, "uuid": "3fc15f7e-84b6-4c50-9a0d-7e01689e1b06", "comment": "Malware payload (Mirai)", "value": "8e2236b72828f07e07acf25854528b7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687093, "uuid": "d429569f-521a-498e-af64-b3b3e96bf440", "comment": "Malware payload (Mirai)", "value": "2773808d5e9ac16e785ef3be3dea3b48b7c2adaf896e038e4c4718d98610e8c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687093, "uuid": "ecb547af-4391-4d90-8b71-b0cd4d78542f", "comment": "Malware payload (Mirai)", "value": "a6a7e0fb9f80b0f368d80625d6693a6a44d3601e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687093, "uuid": "e22f13ea-488c-4eb6-a217-ad2080722db9", "comment": "Malware payload (Mirai)", "value": "57063598d4ec608341a9af6d1cbb3139866125d99068f0bd5a6fd2c47c8e24452b3ed6d689531394960df6712c2a3888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687093, "uuid": "8c6d534a-e62a-4d1c-bdd1-e3509d7aa4ed", "value": "T1AD13E155F9622021CFEE5CB741EC28B8FE91EA44239C474537881D8DBF22B27F55C4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687093, "uuid": "3395807e-9aa3-4607-98fd-e8a96a97ffe0", "value": "768:1y7mIgMLfaMpYm9BD52ahCpbbzJVhgkPKqm77qAN5OqJTB+tWo:1Qm2pYm9Bl3cbzJbgqKqE1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687093, "uuid": "98bed1b8-ea08-45b1-bb51-70742352ce42", "value": 42420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687093, "uuid": "30fcd26e-9bd0-4279-a18a-cc4a209a37b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687093, "uuid": "de3ce41c-ea3d-435c-b1c6-df30c4f102e3", "value": "8e2236b72828f07e07acf25854528b7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6c6d4f-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729128, "uuid": "7e4c76b2-84c2-417d-b14b-2d4416fadd26", "comment": "Malware payload", "value": "782b2ef7aa273ea278ccf78d0e20335f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729128, "uuid": "3f47060d-947e-4c3c-b89c-5058ea94cd46", "comment": "Malware payload", "value": "27aa2080724ac97ad4930977c439f74c00c54d4d76b2559883af524752ea6ec1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729128, "uuid": "e7790445-efb0-4ab2-8a13-43bc88a4760b", "comment": "Malware payload", "value": "bb2f0e8db4d2419b07fa6fb7ddc24b69fe23ddc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729128, "uuid": "72cf18b7-ac82-4ac5-aafa-c6c1e3d3d53e", "comment": "Malware payload", "value": "28a60b1986d3fae828832ad040064c442e885d6226ed86ba015f315af1d1ad77f764954b7c3a68bbf0e54adcc21a8764", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729128, "uuid": "ac460971-efe5-4570-8d6a-040d2e478d1a", "value": "T13345DF0024BF66CEF0768BFD5DD4B9B08BBAF53A3519F6BA18811E860751B40CD52A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729128, "uuid": "817d2757-8a1b-4932-bdd1-4465b78eb0fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729128, "uuid": "f2b6795d-a09d-454e-8f06-8bd871346183", "value": "24576:c9C5l7oqmetTIB9+r80gA/23Oa/5ZSX8gwaCy+hcqHnmwD4z:uS7oiC+r8sO3O25Yp+33/D4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729128, "uuid": "f25be302-7525-44a6-b466-7dcce55f6b62", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729128, "uuid": "d6d56fb7-336a-4d2b-a0bf-d25904163fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729128, "uuid": "59d32616-35b6-4d83-a89e-07fa541a2bd8", "value": "782b2ef7aa273ea278ccf78d0e20335f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b440757-9587-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645716993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716993, "uuid": "bca1837b-be66-483d-a22d-5eba3bc24069", "comment": "Malware payload (Heodo)", "value": "068212e9753fb0c1a07d9a172122b5cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716993, "uuid": "4a2d9f08-cdd4-4154-bdd7-3789ee7b5340", "comment": "Malware payload (Heodo)", "value": "27ab9b9e132746dcd98148d9f94218525dec492332e8622942dbe3e7ad260573", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716993, "uuid": "633c3638-0b1f-47fe-8daf-8d5033f66451", "comment": "Malware payload (Heodo)", "value": "796687ef98f494a41fc1c9cf8cf5cc5d4341dce7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716993, "uuid": "290b8b80-f6e6-4d48-a4b1-90b35fd4fd61", "comment": "Malware payload (Heodo)", "value": "aa132609a959fa540e224516048d1687e1c4e342e58af5e1263ffcb1a8992eecaed68c652c90ff160b498fc29debc734", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716993, "uuid": "aee6f6a1-7fc3-406a-bfd7-1082e80b946d", "value": "T1F9E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716993, "uuid": "dd95e166-6e51-4818-b394-7e8e1ceea0f4", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716993, "uuid": "bba67286-b6d9-4469-a5fa-24e350874ab1", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XqsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWqa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645716993, "uuid": "4ad606d5-54d1-4326-94af-913630fc3823", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645716993, "uuid": "c0717a12-ac78-466d-a2ea-612d3fd27cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716993, "uuid": "19a0b75d-210e-4159-904d-35814ac13c99", "value": "068212e9753fb0c1a07d9a172122b5cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baecf3c4-950b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645663815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663815, "uuid": "caf5888b-46a0-4dae-bdf2-122c3e0cd07b", "comment": "Malware payload (Heodo)", "value": "e52deac3587fe645735bce547964a24d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663815, "uuid": "8b622fb6-e806-4796-a8f1-bcde6d3b44b1", "comment": "Malware payload (Heodo)", "value": "283fbcc4d0cfe39badfaad9eb5f6880a0dbcf99271835af695cba0ce88d680ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663815, "uuid": "ff9780d9-9d7e-475a-9911-e63ab62489bd", "comment": "Malware payload (Heodo)", "value": "eb7f605d711649e8929d578db295e06284ed56f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663815, "uuid": "647fc70a-6fab-43e6-8862-81fcd2efea12", "comment": "Malware payload (Heodo)", "value": "02ceb43e23254d00684f88aa67d1f316499587fe370555ac9e6f0e59804c8551679038488cce6c5c16952cb24e753358", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663815, "uuid": "bb7bc616-de5f-4041-aeb6-7166cfd51c3a", "value": "T17EE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663815, "uuid": "8c0ac553-a6c1-499a-953a-d9dad1f769a9", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663815, "uuid": "ee21a3e5-bc59-436b-8b2b-ed708e2b7d29", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKke/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKkLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645663815, "uuid": "c1023667-336e-4bf7-8908-562ac26b0616", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645663815, "uuid": "8dbdab97-1243-4c60-aeb8-65e1172735c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663815, "uuid": "37944477-fb59-4ce1-a193-6418459bfbfc", "value": "e52deac3587fe645735bce547964a24d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5696e8d-9585-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645716231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716231, "uuid": "84294863-8ea8-482f-9a8e-524f1ecf5c2b", "comment": "Malware payload (Quakbot)", "value": "f348da9ce0ea0883dc540614150badbf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716231, "uuid": "965e266f-9575-4350-b74b-e482a503f138", "comment": "Malware payload (Quakbot)", "value": "283fed02e9434975e43435a8748ab01451199a061da32e94e39128fd7745db24", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716231, "uuid": "57978ae8-19ef-4eee-b83f-6372d15c39ec", "comment": "Malware payload (Quakbot)", "value": "ea485f0c12822dfc16f4c939c92e5940a86183a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716231, "uuid": "12fabd4f-daeb-4fa8-afc1-608633e4fde5", "comment": "Malware payload (Quakbot)", "value": "2433456570f1300c70fcba4e9fe0d508b7494177598240ad944ffb2bafc1e934057e00906fde25f493d02719e7db2f63", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716231, "uuid": "dec0f4f0-3cde-4731-b665-f7f65d43b5af", "value": "T1CD05AE1253724835DB3B4F38ED4B12A89C15FDF2F86898F5AED4A8687B386512C5B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716231, "uuid": "0f5ccaf1-8b66-41d7-a125-5590bc18ae56", "value": "c1121acfcf8b9aeea983fd06a6c0a74e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716231, "uuid": "7cedc864-f2c2-4731-b28e-5e28a1181fc0", "value": "12288:l9hhPVn6mBXIlb5oC7QMFkbWlV4AuBmzKT5NQMvNHgTJfnoHu:/XometXnF+WHTWT59O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645716231, "uuid": "21e0d91a-befb-4b66-b757-9fb04797255f", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645716231, "uuid": "be63228c-4e47-4e0d-a9d2-ae4dd4af40f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716231, "uuid": "a6920223-ba5c-4526-b4c2-4ee77d517cfb", "value": "44616.6383127315.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1cf9ab-9571-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645707627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707627, "uuid": "c95710bc-7d7a-46e0-b8a1-3f7b9f72f4bb", "comment": "Malware payload (Loki)", "value": "6c27a7cfacd62ecff0d1ea9b8f694b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707627, "uuid": "46fc7466-0d3c-426a-b2c7-79e50e4bf0e5", "comment": "Malware payload (Loki)", "value": "28af2770b14a9d1e77c6b8904e96401fc849872d8ee6983f7184d1489958e0ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707627, "uuid": "8cca657e-7360-4576-a713-1aac0a0394c4", "comment": "Malware payload (Loki)", "value": "fa67e15dda207f232510d5eadaf935a482f8847b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707627, "uuid": "a7195640-ddbc-4dc4-931c-2ff54d0ae4b1", "comment": "Malware payload (Loki)", "value": "22365602509ac7826b5f3fc0f413a585352ff9c8ec693491b658035efb9b301e2fa759dba75d5be110e082df8a3c32d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707627, "uuid": "5a7e5e9b-ceaf-4a32-bf6d-8bdec974e1e4", "value": "T118F4AD1034AF6ACDF1768BFE5DD8A5B08BBAE53A3518F1BA1C814ED60B41B41DD11A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707627, "uuid": "ff7712f0-5f22-4d3f-a670-baa4a83fe180", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707627, "uuid": "45b29ada-ab2c-4f5c-b676-5d1525553b18", "value": "12288:cx8SEJgYYz0Ujzo/7v/KmKo9KydBMKe3yCrhLo9DRWQSX1C7rY3uZSV2Ft2:O9vC7vCUMvgRHO1qs5V2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645707627, "uuid": "c94c9f04-155a-469e-b216-40b98a53e2d8", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645707627, "uuid": "a3ee93e0-52bd-4533-9050-af301475b7da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707627, "uuid": "0d7c35a1-5556-4562-a134-a28e2ab43129", "value": "Comprobante- $178.000 USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "116be0bc-95b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645734398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734398, "uuid": "4f3a39fb-6804-4471-9f65-e6d3f7315a23", "comment": "Malware payload", "value": "6b7fc3811746a58dd285452c14e66cd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734398, "uuid": "ff34b186-b09f-48df-9b89-7bdfe8e8e438", "comment": "Malware payload", "value": "28b792e7ea9e3a4a7e511f0710628321157604ab34d445c22c3f485a24052b9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734398, "uuid": "d5ef36f2-40be-4519-8f42-cff87d2cc170", "comment": "Malware payload", "value": "49780d33aaec6bf213fb6cd33564e5dc974a6e10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734398, "uuid": "096d63b6-846d-4dba-a171-8f15f25da003", "comment": "Malware payload", "value": "02e9a61019ebaefe26119a3b6e31860f574ffd0b5919b2db45222a1835bea13f4ddfbf2b54986b9491f8d73e5a6fb008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734398, "uuid": "d2c30e39-d444-420d-94c6-66c57f3f75fe", "value": "T100D5D0027A44DD62D0691633CAFF895447BCBD412A62DB1A7EAF376C25123A39D0D2CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734398, "uuid": "185e6e1e-86a7-4425-b4b7-84e3c744a782", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734398, "uuid": "9dd97895-cf23-4619-bbb5-16dc17ca2d52", "value": "49152:/bA3TCKSI+nTaUA9t26SdA3CFn+NYMe4CeobjKsa7S2guCv/PTLEo5eFsWzUbmu4:/bb7I+uCQ+d4XYB6S/7PHEo0FF1J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645734398, "uuid": "6ee8a6a0-137e-4380-8b0d-790bcb7433d6", "value": 2908917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645734398, "uuid": "dab93dd7-a14d-4cce-808b-c720bb8d8d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734398, "uuid": "542ec7f3-4fa3-4409-8c30-bd9a0872d214", "value": "6b7fc3811746a58dd285452c14e66cd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66912ac-9583-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645715401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715401, "uuid": "a2b99a2f-20f5-45b1-9cc5-786b24d96955", "comment": "Malware payload (Formbook)", "value": "265e12d9de5e962b90ab8d8dd39e3a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715401, "uuid": "b27ec91a-d005-4efd-aa00-45b38574bd61", "comment": "Malware payload (Formbook)", "value": "28c28db28e96276f72ce38a60d04f0711388d3f93ecb34d4721dc94fc2bf9f07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715401, "uuid": "d1bb4ee7-a746-45e8-b52f-4efe0e92c34d", "comment": "Malware payload (Formbook)", "value": "2799490cd1831593b1c2694978c1dbec849bf96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715401, "uuid": "53335c48-107e-4679-843c-22928ebba7e6", "comment": "Malware payload (Formbook)", "value": "5ac08ac4598f1f3a4afe4b9136e4825e98a91377c4124e57a95e8e14c108512b5b6625651c91168e016a34ad5840b20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715401, "uuid": "bd807510-d606-4804-9775-171c71f1c9ac", "value": "T13505BD1028AF66CEF1768BFE5DD8A9B18BBAF43A3519F1B91C815EC60741B00DD11A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715401, "uuid": "46cb57f4-e456-417b-9e61-0b502cb0d299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715401, "uuid": "c4c2309d-5062-4f6f-b0f3-14c1e61c8d51", "value": "12288:WkgFEJgYYz0wnHZHEQRmYIso2huSWCL9xLEmSAQ31nPq2oK9PO/Z:q9jRdlIsvuSN5p2q2oKg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645715401, "uuid": "e060e8c9-d328-4729-958b-85286afd9d2d", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645715401, "uuid": "383dc7da-4c5c-4c64-abbf-d74add2d24ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715401, "uuid": "e0e17b6b-ba97-45a2-a790-8e7f90903cab", "value": "Petrogulf 108-22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca44df0-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645694178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694178, "uuid": "8fdb4f75-bec9-4b20-a2ac-afd36ea39f7c", "comment": "Malware payload (Formbook)", "value": "c5415a264543582dbe02dddefe099636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694178, "uuid": "650e005a-1534-4a99-94b6-2627dbb068b3", "comment": "Malware payload (Formbook)", "value": "29a5f9fd724757b3aa01833c68f87efdb8e191e363032391ec895a1d87dcb178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694178, "uuid": "40775444-fae8-4429-9de0-7cfc9a9603c3", "comment": "Malware payload (Formbook)", "value": "2ce9180ab6ea128c370d0e0a019d68a0bc9db0bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694178, "uuid": "708ac03b-0628-4706-9f08-d4b6f60deb44", "comment": "Malware payload (Formbook)", "value": "f28e60b0dce216b02464d1506d551f1fd0db9c67348f766dc23f1d0df7621ea2846fc700cc1faacb16808a304ac8b0b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694178, "uuid": "491eead1-749c-41ed-995f-dd1a4d56596c", "value": "T12564124A66D8C03BFB4A477A1F773FF6E7B59116813A12DF47841F2E0A661C229C424B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694178, "uuid": "40b8b1ba-6970-458c-a05b-bafd8612696d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694178, "uuid": "de150677-9b82-4ecc-a4b1-3000b6871a70", "value": "6144:TxDtuBCR5ZRw2mB2lLNbtEl6dNFZv7I/Jk6ZcpMNj3AODMucQH3b0M05SP18l:CORpWcZvAJk6ZzjdM5YbB1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694178, "uuid": "bfeae4e7-ef9d-46e6-92fa-87d77e07bba0", "value": 321327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694178, "uuid": "70f90aba-91ac-4c19-b105-dddb3a4647d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694178, "uuid": "6ebbcc34-9d98-4ee5-974b-2d23ad4e94a8", "value": "rro4665321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eca2592-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645688061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688061, "uuid": "fae54549-addf-4fc4-a5c5-a751c62f97cd", "comment": "Malware payload (SnakeKeylogger)", "value": "82121a480eeb23c901f0cdce75e759d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688061, "uuid": "e5feaaa3-4f01-462e-89ef-c8567772d6cc", "comment": "Malware payload (SnakeKeylogger)", "value": "29cb6a3346919a05541fc29269b1d5f8a2f0a3d62d9ab99898f825a9c2507d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688061, "uuid": "30ac107b-ddf8-45cb-8b50-2187de3b6af5", "comment": "Malware payload (SnakeKeylogger)", "value": "bc15aa08f296f3926e26298a1848e6fd9f6e4832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688061, "uuid": "0afbc189-dda4-45de-ae08-c94f522860ef", "comment": "Malware payload (SnakeKeylogger)", "value": "47a4541e46cb3bfcaa02c3f9c791a75375619ceb64271859c3eeeeb4488e995bd1c5143ac063a3785345fccbc8f7134b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688061, "uuid": "82aae0ad-e882-4c5e-b356-df250c618453", "value": "T12D05AD1334AF22CDE0628AFE7DF8A9B08959EF37260935BA70C69F1E475584D9E011F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688061, "uuid": "d045e36d-04f8-499d-9c9d-bc9867f1e9fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688061, "uuid": "27932aa7-0c11-4c04-9869-188e94e9238b", "value": "12288:6DBxuOUm7bYjZbCld1TqVD4gCsuvgHWLBEtLHcY4MmEJg2bYz3:OCm7bYjdCjLqaTT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688061, "uuid": "7c57d21e-1f3f-4c70-bacf-92f8af136498", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688061, "uuid": "929de244-6d85-42af-91ce-7caba012eed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688061, "uuid": "f4a9831d-37f6-48a4-8a66-b9bfaa94b1aa", "value": "SHIPPING DOC..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab372979-953f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645686122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686122, "uuid": "db3143e5-63f5-4286-9606-fe8f065f9cb3", "comment": "Malware payload (RedLineStealer)", "value": "922618d6998eec86a20ae222efeb45c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686122, "uuid": "56508a6a-e671-492a-b374-02c6d3c5bd53", "comment": "Malware payload (RedLineStealer)", "value": "29d5b170ae7a8a657deb22f3dc8dab0ea9e901aa6a99033d9b338aba99b983f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686122, "uuid": "4214a2f8-731b-4928-9400-694a2afb251d", "comment": "Malware payload (RedLineStealer)", "value": "efe066f7cbb27e2de6f5d991e3599e4068528854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686122, "uuid": "3e715775-0d0a-4b04-849b-c6fa666953a8", "comment": "Malware payload (RedLineStealer)", "value": "d5919dfd9b8ec63beae3fb0d77607003552719c6834c09098c3faf72764237b83969b11363ea19a7a7a961fcb10d8e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686122, "uuid": "6f9b7f2d-6e80-432b-b88a-593e07e8bb0a", "value": "T13B556B4123F9616AF5F26E3D76378118DF22781D15B5B50BDFE3EB2C04789049A3AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686122, "uuid": "5d6964df-2ca1-4dd8-8cc7-42bdb6cb40b5", "value": "46bc14dc1303c3f129f7d70d25c5a4e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686122, "uuid": "9750c868-1682-4136-a503-c9e77ae90601", "value": "24576:QVZKBn/TliaWQ8s1Gxwbq42qXFRBOZe0eBl:QILlx/YrAgZexj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686122, "uuid": "1683ae8f-fb75-4d5a-a10e-ed596ef79aaa", "value": 1300960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686122, "uuid": "2841cd8c-137b-4f12-a77f-1c0a56064520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686122, "uuid": "87d9083b-fb27-4b25-bc93-edaccd1e92a2", "value": "data64_3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5294d48c-951d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645671371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671371, "uuid": "cfa09d08-fa6c-4ae9-b675-566ab9de7c5e", "comment": "Malware payload (Heodo)", "value": "31a289bf8bab4d53a28442198fba320f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671371, "uuid": "f7dfe599-bebb-4d3a-ba1b-b8f26be61eea", "comment": "Malware payload (Heodo)", "value": "29d63500299b90a7043e904da1c695ede2a6875fb0a8221e241fc180faeea2a0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671371, "uuid": "ff760c65-3c46-4e5f-80ff-bd8547a4bd9d", "comment": "Malware payload (Heodo)", "value": "46533a1e019a04ce509d13796e6bbb8629e311d1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671371, "uuid": "7380095d-e7c7-48f1-a5d4-e11b28d49ff9", "comment": "Malware payload (Heodo)", "value": "96f20d1f599ce6d2625a6c3b28bbc5233874721b9f545cc33f2540afc992d3d57cb279788689f3d23b3ca5f2adc4657b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671371, "uuid": "888c4e7b-b347-4057-924e-1ac4fe87ac76", "value": "T18F93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671371, "uuid": "65ef9d34-d880-40aa-a20c-4822aaedb000", "value": "1536:fQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:2DpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645671371, "uuid": "e1ecb52c-d436-4cc8-9aec-e175478247ee", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645671371, "uuid": "1188b98b-5b96-4462-861c-0310c29040dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671371, "uuid": "29ab8235-bb8d-47f2-bd4d-f7c4bec5d7b9", "value": "2022-02-24_1000.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c922ca8-95c3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645742711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742711, "uuid": "df88e708-c8fb-4c93-b4c1-cd112f6cb822", "comment": "Malware payload", "value": "33efc0598f354c1488107b1b79d2e05b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742711, "uuid": "ab0fef61-8476-40d5-b7ab-7be3530e9375", "comment": "Malware payload", "value": "2a44fd4c42fa33c3213d9c7867888fca985dcf1964fda2d2132be59ac8d8d7cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742711, "uuid": "388980e2-d5b9-4d79-9eb0-ce5c5f567c29", "comment": "Malware payload", "value": "dd0391ba9fea4a5fe9ad9669791f6f6271734d10", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742711, "uuid": "6e2a664e-7448-41f3-856f-22d16f82984d", "comment": "Malware payload", "value": "9be0829806e5d90fa91b2f42fdb60dfc999b6e4b32c8a8545182854287595dfdcd40a832e1faecd4842627544f86f737", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742711, "uuid": "6439ebc8-f734-48e5-b9ac-971c62163ab0", "value": "T17AE4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742711, "uuid": "b4cec8db-fb23-4b41-877f-dc6960c2bb5a", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742711, "uuid": "1cc6dcb5-881d-4909-af2d-d7c4bee84d9b", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKuKDYjX3rUXY:ygHpbVy97x0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645742711, "uuid": "8672df9d-75bf-4da4-bb2c-6fc171a519e7", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645742711, "uuid": "0a5ff548-e260-4ac0-a4f0-5b7d5a08a095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742711, "uuid": "a0784fae-f899-49ec-aa21-d7946c0cf8ab", "value": "g0qSvLG0JG7NefZUSfLzxFkbJB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffab5b6c-9536-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645682399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682399, "uuid": "c14a686b-03e0-448d-9147-1550af990c0a", "comment": "Malware payload (AgentTesla)", "value": "ce6fb812a2755102a8e212cf10e26a35", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682399, "uuid": "d484887d-5432-41e0-94b3-5bd1858eef6e", "comment": "Malware payload (AgentTesla)", "value": "2ab40f52b6ff9733dabc2c17c4351dc4100f576574d912a9385a0d39d3bb421b", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682399, "uuid": "67255f44-d576-42c7-a541-76ad168838f2", "comment": "Malware payload (AgentTesla)", "value": "02bc9fffbd036756755256330d64553479a9dc5f", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682399, "uuid": "2ca93a16-e4e2-4cd5-8797-61ca965c653c", "comment": "Malware payload (AgentTesla)", "value": "50c2579459aa2aec0eaf7072b309a2d851a27063e12bf5aee0c4b5151312c6628fd440d3b631e10d1e246594e5a917b0", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682399, "uuid": "5e5ed401-c4db-4481-8a8f-c5ffffe1c076", "value": "T127F4330BC0FE340BC282EB90D4665E625AD94B1B372A53DA86238A17F7ED8F455CFD05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682399, "uuid": "2d3dfa34-6a22-4435-a36a-2767fcd5af99", "value": "12288:jXdNV+i1xM2uTl+qdjcmmFzTTijmjf/fK0NdxnTb77mqTaVFGd5rjN5GdE+7QvRN:zzKbQudmFzw8dFP7mvF05XNQtcJ1Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682399, "uuid": "2ace0acc-3a3a-4d33-b4c2-fbbd8d77c3a4", "value": 734633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682399, "uuid": "fa5d3bb1-e01d-4067-894e-ca1a4776c958", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682399, "uuid": "9b0b37e1-f458-42cc-b304-2eb9577d8e10", "value": "R.F.Q_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ab2680-956f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645706672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706672, "uuid": "ef5c3e56-8b54-4ea9-8bf2-05f69e2dc7a1", "comment": "Malware payload", "value": "3054afb6c01e7607e29b7262005f6135", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706672, "uuid": "fcc5903a-91d4-4e3c-a8ae-f6036187106b", "comment": "Malware payload", "value": "2b09b0a7bd043e5606643a6cbd4e0d15272d1a2b0a48d26baf733ffb88f76d86", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706672, "uuid": "42912ba6-5bf4-4346-95f5-b13a5914ea28", "comment": "Malware payload", "value": "2bdaf4976b32c95edf4f2f5f54ee79ec7e00af6c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706672, "uuid": "48bc3c15-3730-4f40-93c9-d281e618ccd6", "comment": "Malware payload", "value": "42ab5f0f82b280e94312312519a135254738dd256eea01206c89ae3a26a925b263c1c9b6bd670a5e9de70f8610005300", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706672, "uuid": "2b2b60a3-f31f-40ea-aaa3-b1113c3f8088", "value": "T1F666F187FF98D89AC4F65673C977423331535E6803435AB62A88F23824B79C15F85BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706672, "uuid": "8252f1a9-6ef2-4b87-ad61-e19eb65a7473", "value": "196608:yQ4ADl0UmzPknMMqE6TEh5RdhwrMlZsgx1rVHNrYpCW:Xl0UmzMMMqsh5RbwwlPHho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645706672, "uuid": "a247f2f9-8d2e-4336-ad76-50be22202d3b", "value": 6662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645706672, "uuid": "512b61cd-c48b-48b4-9712-77e445378ae2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706672, "uuid": "64fa70cd-097e-4f78-b531-43e4dbe4c4df", "value": "Home Message.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676a8f0f-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645692881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692881, "uuid": "71ced716-6661-4c85-bd14-3b349df4295d", "comment": "Malware payload", "value": "970df4a3d1a63d8baac79e4e35a9c67c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692881, "uuid": "d1606e0f-1074-4a75-b9bd-1dd3a1272906", "comment": "Malware payload", "value": "2b23296e8e8f825fe9a7e446c9826f41d98078678ddd7656823949b9fc5168f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692881, "uuid": "d47f7180-c38d-4660-9f72-2e2c231b331c", "comment": "Malware payload", "value": "63b52b224446c6fbdfe7147fb9d0ae598827d292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692881, "uuid": "f9f0845e-633e-440b-8c9d-c3b75dd416ba", "comment": "Malware payload", "value": "7e11dce53c6cb567eed197fc2d192a1c13f4879de8103a20ccf3d0ee24cace3e9d8f134b15887728198e57171cae8b2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692881, "uuid": "5f6081e3-2fed-4149-966f-69b01d090ca4", "value": "T18406338AF6F64537CB268EFC6466009DA17E0F204B33C53E45D3149F6CC56BCA31A6A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692881, "uuid": "0dede4ba-e82f-4291-9703-d21be9aaccb9", "value": "98304:J0deaIj6VibW3TxhLZXmWO9/idyp3+++XN8paVT5aPe:J0dHIj6Qb6hLFOgGp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692881, "uuid": "d1534c67-0bcc-4421-a09e-abc852ef9bfb", "value": 3733409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692881, "uuid": "d1bb680c-eaf0-44f5-9c77-bf2c3af3dcf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692881, "uuid": "5203f4ca-f68c-4182-be43-370478049aee", "value": "970df4a3d1a63d8baac79e4e35a9c67c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee5350f-95b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738071, "uuid": "44e6e36f-8e8e-4e16-a7ec-62515c7c8ce7", "comment": "Malware payload", "value": "b7a4a45fb466a270cd9ebf4e867c534f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738071, "uuid": "ef20c76f-87ca-48b9-a515-07481436eb80", "comment": "Malware payload", "value": "2b3defa879ad432fdb993b78b3564068c88a50b438b6b553f9e14166aba44116", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738071, "uuid": "12bb491e-c700-4dd9-ae0e-71a2d5d6a3c2", "comment": "Malware payload", "value": "bb3d9d4141cefabad6ed2e3d53c8017284d75d61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738071, "uuid": "85c3d51f-1be7-4863-81b2-7c751c55218d", "comment": "Malware payload", "value": "b054a8e26ff10d4233bd0182a7c5fb5a73d93e00b5a54eee486149dc5dbf8345a309f50a924bd34cb271b4c2174f8400", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738071, "uuid": "d92fbec1-f97e-4aff-9f2c-c7fdbfce4a25", "value": "T1FAE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738071, "uuid": "7cdff4c6-31c8-4781-80a7-a0cb54145cf2", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738071, "uuid": "7a5bd4db-fbf0-4bfa-a45b-23b3719d18f4", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XYsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWYa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738071, "uuid": "18669a94-466e-47f7-b21c-e7cd3c42f9f5", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738071, "uuid": "b21ecb05-5e14-42f2-9341-3eeac57eb39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738071, "uuid": "b478fc69-57c8-40c8-8f1e-53260069eade", "value": "b7a4a45fb466a270cd9ebf4e867c534f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc90a583-9547-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645689695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689695, "uuid": "7db4d306-f017-4f45-b732-e7f5fd680720", "comment": "Malware payload", "value": "97b4975d09e0923730a9dcf94e9c6705", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689695, "uuid": "0e81aaab-807c-4a94-b183-d790f5ff8bfb", "comment": "Malware payload", "value": "2b3ee191f72d0133734ef46a4beb825ecf214eabdeaf7bd5fdcf088e40a14afb", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689695, "uuid": "808529be-1136-4ba5-a857-3b9a99fb46e2", "comment": "Malware payload", "value": "9dd044c298f79603ed0eed835b0ba8e23aa1ce4f", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689695, "uuid": "f1d7582e-aa9f-441b-b350-ec01172a314c", "comment": "Malware payload", "value": "c847a8c6553349ead47256ae8c3289cedce575eda9b8ae60647944b2e93cec42dafdf1ce70eb9709c552f13be6b6d7da", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689695, "uuid": "4a60690d-1df5-4cc3-a427-d649aeb1180f", "value": "T17313BF18C041250AC2B36A3EC83898E51D97DC17A116558FE4EA7A4B1B64DDB3B4EFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689695, "uuid": "c73fc0c1-b446-43c6-a3b0-c8966a4a34db", "value": "768:b+MRD4S0JS00SneSnjS0yS03S0IMS0bS02SxD/PoVK5Z1lDVn3QFTy1xqwVwxydK:b+2p75eAGAG1/K8NytsRAub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689695, "uuid": "cbece5e2-bd72-4dfd-a6b3-eb136a5da923", "value": 42625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689695, "uuid": "3f982bf2-ab04-402a-aaef-ab13e70ea0d5", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689695, "uuid": "a97901c2-4776-4335-85b8-0661dd5b5e34", "value": "19.pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a0b12d-9546-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645688989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688989, "uuid": "e5be3812-11ba-421b-b2f2-3d23e45b1d9f", "comment": "Malware payload", "value": "a6dd7169fe83db0664e451ab6b1c802f", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688989, "uuid": "b7666ab6-eeeb-46ce-af02-7a11fc1180fb", "comment": "Malware payload", "value": "2b4aba14cec52f897ef4322af8d7a98705ad3a4b53de097a0d6f57f2720929ae", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688989, "uuid": "fa9b2fc7-398e-4166-a4a9-29b19167a5a6", "comment": "Malware payload", "value": "13c3a724210a6dfa9c9884a239909de26de82f6c", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688989, "uuid": "cb8a0615-7240-46e6-a821-a952d1dd7689", "comment": "Malware payload", "value": "55fb0d04d7fada22b10a5f527d34e56418872ae023922abdf17a30f07c80899e3c3b2b00016e7ff8ae6bddde6a8d8bdb", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688989, "uuid": "9adc13ed-eeed-4bf8-9073-4afee3f23680", "value": "T17C13BF18C012110AC1736A3EC83898E61D97DC67A11645DFE1EABA4B1FA4DDB374DFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688989, "uuid": "757c987f-5db2-4e1e-b4ae-db593d6dcb1e", "value": "768:v+ZcRD4S0JS00SneSnjS0yS03S0IMS0bS02SxD/PoVK5Z1lDVn3QFTy1xqwVwxyI:v+Zmp75eAGA7Hls1/K8NytsR1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688989, "uuid": "868692c7-474b-4574-a024-501afa07a3ab", "value": 42650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688989, "uuid": "37c1c078-cd34-4c43-8deb-8676813e19b1", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688989, "uuid": "4e5d7d62-0485-4eea-869c-82a898a690e8", "value": "SWIFT 800437 Overdue.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bc440b-951e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645672014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672014, "uuid": "f2bd04cd-b633-4f16-98db-615b853b3e02", "comment": "Malware payload (Mirai)", "value": "b2457e296896f3b9de646ab2e746d24a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672014, "uuid": "8f5bf0ea-25e0-48b2-ac1f-505e4ad5b2a0", "comment": "Malware payload (Mirai)", "value": "2bab4f97412a27d9d2f8b42efe049bbbbc2821c0a105591b3fb2f6b1da95bcc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672014, "uuid": "9acf37f7-beff-4061-b762-10069adf14ee", "comment": "Malware payload (Mirai)", "value": "0fb6e04afa3e1a1697ee86e251428cdae7e88dd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672014, "uuid": "d0a8bc3c-ecf5-45f6-9a62-ffaa5ec638c5", "comment": "Malware payload (Mirai)", "value": "99f7bf614497e15cc0bb5c89e3740fa63e0fe89d3d79aa4fcaddde69a5eb85c44c3e8bd17f46c0f0af5db698c5e615ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672014, "uuid": "4746bb78-49ef-44d2-94c7-acc1b38946b5", "value": "T112F34D46FA408A13C4D61776BAAF414A3322D795D3EB73068D286FF43F87A9E0E17905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672014, "uuid": "c570c1f2-ddf1-4e39-8169-258c7e030c9d", "value": "3072:HpbWfJdItjrRGWiHhMEUq71tL/C0EX380AMqnGxM/98klsG2:JbEItjcoHqvL/C0EH8kqn0M/98UsG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645672014, "uuid": "7ce43557-db14-40cb-b0a7-aed46d0d6821", "value": 160723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645672014, "uuid": "c76f9721-cbb3-4377-ba14-cb239c44adae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672014, "uuid": "625a4a62-8ca5-485e-a99f-4346e1f995c6", "value": "b2457e296896f3b9de646ab2e746d24a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff287036-95b9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "94ad13bb-49c8-45b9-bdb5-6017e4f32f58", "comment": "Malware payload", "value": "f3a872ef461d74eb5d669ef0e11b9ff6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "1f19a137-5355-4bd6-9f25-69dba291890e", "comment": "Malware payload", "value": "2bad7866d503b80773c90c849d339ca1fd3f5a2e922ce25a7df9673562a615b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "97d061df-4331-4d26-9935-cffa90eb1784", "comment": "Malware payload", "value": "73000dc41380dcd699b5f595c0e4063dfc2a2b97", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "b0e83363-c14d-4b54-ab2d-909ea6ae5914", "comment": "Malware payload", "value": "2eb4e192560d3734f5c27775d24f341c06e82523ad5272d5da03957718d315e2def4ae5baf2120439fe8c8d840a5bade", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "042f60d7-44a3-401e-92ad-a0f92d464834", "value": "T10C35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "501f2e37-4557-407c-9819-9e582a1f43a7", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "b2ea27f0-7d15-4073-ad95-42ba39b90b37", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+u4VOe528JO6PC:6iRGcUY0UvDYNFtuM5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738662, "uuid": "4fc8da0a-fa6d-4507-9962-b671c91babe0", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738662, "uuid": "b94b3145-423a-4009-af73-1d904e07235a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "1fb3d567-6740-46dd-83e2-07fed1ab4634", "value": "emotet_exe_e4_2bad7866d503b80773c90c849d339ca1fd3f5a2e922ce25a7df9673562a615b2_2022-02-24__213733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b44d4c9-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694149, "uuid": "7ae75454-236b-47aa-89d1-6fe32253ac5b", "comment": "Malware payload (Heodo)", "value": "1ee191e7e540d903e6d4feb43d3886d2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694149, "uuid": "067af0d1-87e7-4873-a4de-e7a42acafb37", "comment": "Malware payload (Heodo)", "value": "2bb265ea3bbe95ac573faf61f9c2a7abe9d7e8bcb4a0265bffcc8ebcfa2925a0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694149, "uuid": "86c0e725-0c94-4588-990d-d71b42376b1e", "comment": "Malware payload (Heodo)", "value": "aa2b66edf57c7d2cc773319c9503fd440fbc6740", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694149, "uuid": "92feed19-2211-4318-97af-5e2a3215adf1", "comment": "Malware payload (Heodo)", "value": "352e0c6dedbbab228bf98129452ec6f7a0a24a47896ed09aa1f5c135ebfbf2e0263daa006640e7c2671d768e6b161ca3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694149, "uuid": "39e06b60-88a6-41ab-8153-f38ac64640d3", "value": "T1FF93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694149, "uuid": "705e14c9-a2ac-4f78-9053-ff9e6ea8f4cd", "value": "1536:zQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:aDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694149, "uuid": "1a5d3fa6-f9b4-4311-ace1-16beed111b52", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694149, "uuid": "a64e3571-bba0-4675-a53e-18cb401e4523", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694149, "uuid": "a2dc0d79-1034-4b29-a828-84d4de4aec8e", "value": "medwinpublishers.org_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970428fa-95b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645735051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645735051, "uuid": "b63fe869-d05a-4aaf-b4ba-965b1fb41371", "comment": "Malware payload", "value": "382fc1a3c5225fceb672eea13f572a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hermetica Digital Ltd", "colour": "#ED37D0", "exportable": true, "hide_tag": false }, { "name": "HermeticWiper", "colour": "#05DE04", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645735051, "uuid": "1852f93a-7bf2-4097-87f9-aa748157ebb2", "comment": "Malware payload", "value": "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hermetica Digital Ltd", "colour": "#ED37D0", "exportable": true, "hide_tag": false }, { "name": "HermeticWiper", "colour": "#05DE04", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645735051, "uuid": "6d7d2d3c-1c7d-4621-8e76-58bed0be0658", "comment": "Malware payload", "value": "d9a3596af0463797df4ff25b7999184946e3bfa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hermetica Digital Ltd", "colour": "#ED37D0", "exportable": true, "hide_tag": false }, { "name": "HermeticWiper", "colour": "#05DE04", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645735051, "uuid": "5bb02213-a9ce-480a-bd3c-b9ca0246b255", "comment": "Malware payload", "value": "f76a352a8631e2271b07adb88199c2d875e977632b6e65e58af0ea273f3030161acd765868afccb8148cdde280143729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hermetica Digital Ltd", "colour": "#ED37D0", "exportable": true, "hide_tag": false }, { "name": "HermeticWiper", "colour": "#05DE04", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645735051, "uuid": "1f63727f-9131-4ec4-b939-332ab268c422", "value": "T12FB325539AEC3CC6D47913B137BFA3E5D32EECA46A90C09E96D01182D57C5933A227E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645735051, "uuid": "bbeb6fef-89c0-471d-b095-6cd5121098a2", "value": "4233d97404e1fecedef6a46e0f7c09b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645735051, "uuid": "533fa5fa-aee0-4858-918e-5b1463789ea9", "value": "1536:bV3+WmNcWDurilmw9BgjKu1sPPxaS4jqY:bV3+WmjDxlPwV16PkS4jqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645735051, "uuid": "597ae29a-fb0a-44bb-9230-83e42e880b72", "value": 117000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645735051, "uuid": "6ed0133d-7d2b-4398-bb92-509b129873a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645735051, "uuid": "d8a897ba-02e2-49cb-8411-9df9c2056abc", "value": "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba5fd29-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687143, "uuid": "606e6253-f91a-4e48-b870-aa67e2e15985", "comment": "Malware payload (Mirai)", "value": "6578eff57b616b418c45c7a8f8e61326", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687143, "uuid": "0ea710c7-33c8-446e-80dd-d526806690f5", "comment": "Malware payload (Mirai)", "value": "2c15e869c57d1e635d704120e2cc17e2be03ce98c285bf08a16bca16714b5042", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687143, "uuid": "8b2d5275-97a3-432c-86ab-bd398a417386", "comment": "Malware payload (Mirai)", "value": "14de2ef7532be0ac5e74e00e69bc5c223466e1da", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687143, "uuid": "06ec8987-b09f-4151-89ba-fb3a46082104", "comment": "Malware payload (Mirai)", "value": "e265013e482a9a87079ad4041acce725d6bfed562be3a8bee8c0a4b719958a765ba48f7aee5d1f60883c8181df9e9728", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687143, "uuid": "69a24300-dc14-4b7b-924e-5acfcbe90bb2", "value": "T12A935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687143, "uuid": "1bbe3200-94ae-4a90-9fc6-f84f7a9a00db", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3jyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKzifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687143, "uuid": "e1fd2828-6ff5-4d80-a949-4e9923532374", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687143, "uuid": "a0d62579-f5d7-4161-85d7-5d51cd4dca80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687143, "uuid": "a7ec5e14-c278-41db-9fc1-152059f9f944", "value": "6578eff57b616b418c45c7a8f8e61326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "847fb2a4-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "1cab39d4-5a3e-4419-93fd-9a01f8a1bd65", "comment": "Malware payload (Heodo)", "value": "ac9af67a380b4482dea1a75d47549453", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "7dcb5b39-08f4-4261-8b42-ca8ce2aad4e0", "comment": "Malware payload (Heodo)", "value": "2c233e8a16a359071f9b53b00b4488f331b4a048df7263bba3bb6a3c03f1ebf2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "7d2ac0d9-50f8-4788-9672-6c1a87edad67", "comment": "Malware payload (Heodo)", "value": "cfaeb46984b02e28e6c2933dce6bdae698a417d3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "fc97b4af-3d69-40e9-9143-d32be99c103e", "comment": "Malware payload (Heodo)", "value": "bf5c434e83a090467479312f968763a858aafb39c2b62361d42552cc2a999957aec50f7d2d90c8207e85f7094c5e39d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "f2f798f7-5e37-43c6-a6f6-0c2a011ba376", "value": "T140E4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "a96e42e8-d7ab-4a2b-97e2-a913509cc0c8", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "6b1eb221-3121-42d4-9d44-120f063d759d", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKdKDYjX3rUXY:ygHpbVy97G0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710539, "uuid": "c8adffd4-0960-49c3-951b-60928e4273b1", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710539, "uuid": "5a576b15-fe3c-4bc1-8651-86dcf8f4d163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "a1b5b81c-eac1-4670-acdf-b11482b1748f", "value": "emotet_exe_e4_2c233e8a16a359071f9b53b00b4488f331b4a048df7263bba3bb6a3c03f1ebf2_2022-02-24__134852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04493d0e-951c-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645670810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645670810, "uuid": "f7569bd4-7c21-4bf9-a568-e4c444c9efa5", "comment": "Malware payload (njrat)", "value": "4fe3cecb0627425f48b4832768beda71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645670810, "uuid": "bb227465-71a7-4938-a078-bcae8d0d6e44", "comment": "Malware payload (njrat)", "value": "2c3cdb3cd330732b2dc485aee38d30b07ac006765b861adccc76b62aa29d2dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645670810, "uuid": "cb046995-3333-4a5c-9e6e-94dc45b61da1", "comment": "Malware payload (njrat)", "value": "956c71fa6ccc7c7d3dd7b79d624117d580a7c7fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645670810, "uuid": "02e7edbe-0aec-44e7-892e-b1b978c9c274", "comment": "Malware payload (njrat)", "value": "f18ced41714205a5f8306c2bc7533dbaecfe2b639bcaf1b3cc60e2c2be909353ae769e11d58f49709637e2c2531e62c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645670810, "uuid": "4bee4d1e-7e0d-403a-b3e3-a4e7739aefe6", "value": "T1DEA3E682B74A0715E85914B9C0EF193507F29FC76A33D68A7F0D778D1E423A3AE81B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645670810, "uuid": "acb18c87-69e3-4265-b524-d70ebbd89036", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645670810, "uuid": "a5685e0f-9785-4d46-9486-c0b5d4f10b40", "value": "3072:VnhEcMdsX1mmMyQojG6+VzcACO4Y3zdvs:VnhE/deKaG6+9DzZzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645670810, "uuid": "6cc51ea5-2c36-4d5f-af16-abdbbd24b86d", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645670810, "uuid": "561c98c5-6238-44f5-afff-4b5546dc6e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645670810, "uuid": "0bd5a399-7c8c-4cfa-b0b2-ce1ad05d4610", "value": "4fe3cecb0627425f48b4832768beda71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e563e44-950f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645665458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645665458, "uuid": "4051298f-502e-4930-93ae-29187c1001de", "comment": "Malware payload (Heodo)", "value": "e38495db8db0dd514bd73b08bf52fc34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645665458, "uuid": "2e6b9679-6b4c-4252-9e45-4623c6579fdb", "comment": "Malware payload (Heodo)", "value": "2cd00e4e64a6013a43e07716fe3a5c91f8fd9ee014fac7a5130a97151b335030", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645665458, "uuid": "71ccc04a-2d11-4fe4-a39b-4df38dc64d15", "comment": "Malware payload (Heodo)", "value": "4aaae39f088730a339966f874d6e150aea1b3c4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645665458, "uuid": "92473fa2-caab-4b0d-990f-7462f5e36873", "comment": "Malware payload (Heodo)", "value": "39347026f10ce527b7abc5e48ed23e23ffba4ba89f0048ba35254c06054e8eb89f490f681c76b2dde724d5c747562ab6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645665458, "uuid": "7c6db14f-5d76-4612-a1e9-c5da3d568fb5", "value": "T150E4CF2173D2C077C5AE02792912A75967FEBE10DEF48247AFD03F8E5E321818A29757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645665458, "uuid": "53f6d5a1-2866-4014-86ca-2e2cc8f910a2", "value": "1e6c964d8ff7538cc0a7091b2fbe639b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645665458, "uuid": "df31f6a3-d945-4bd3-aa66-9f5df8bd72b3", "value": "12288:CZ01lbelr11DkMcA1B2iVjF+NHQ7KLU7IEP49fe/kJhXx5y:U9lr1Vk5A13VjF+lkKv8kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645665458, "uuid": "447c6b60-8fcd-41d6-bdb0-aa030905b3e3", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645665458, "uuid": "8ee2b893-5939-48bc-b225-f9d2dd71a823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645665458, "uuid": "6d9e4e96-171f-4232-b46f-06aedd044234", "value": "emotet_exe_e4_a9eb7700280b3c08e6f0f1610ce08c93b9824fe0696598cc74725709e5fb5164_2022-02-24__011733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c5d3d1-9563-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645701471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701471, "uuid": "2bc02149-430e-4d98-952f-b6a374e15885", "comment": "Malware payload (AgentTesla)", "value": "9b4fd4d89ae6bbdf720d20b9f5178249", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701471, "uuid": "62e2cdc2-18b1-48e6-bd05-5c4c5b9823ec", "comment": "Malware payload (AgentTesla)", "value": "2e1e9dc01c05b755778e10b0e6243051b3fd5265d82e1bc2017b0eca568e36bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701471, "uuid": "01914a47-9603-41ce-b41f-c3edf3b0a17c", "comment": "Malware payload (AgentTesla)", "value": "d5a27027da8bfc8f9ee10557ad303b93a58c1239", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701471, "uuid": "9e2aa806-7f2b-46d1-8bf3-9bc412e0c166", "comment": "Malware payload (AgentTesla)", "value": "a4f4015ccc5ee5fd0e1c90fca6bb5d7479daae2d6ef48d3b27c24fb5ef4655cb0d11a0e65c69f56e16d37081ffedd95d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701471, "uuid": "0575f54e-7f72-416c-9307-e36b92ca0901", "value": "T1C6F4121432586E73CA3C04FC919325A443F611BA74A3E3C4AEEBF1EA66D2BD51C50E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701471, "uuid": "97ad5d5d-3f07-4d7a-ae7e-0f5041b73fe3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701471, "uuid": "786898d7-636c-4012-b648-e3aa2280bf0b", "value": "12288:UPsmemPyRm4PPa+FpSDi0B3dYediNxVBVzqY+H4HaQBILt:MvP89oSediNxhk464yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645701471, "uuid": "5f808c81-bfdf-4529-ac42-3dadb3b9e8ef", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645701471, "uuid": "1102a415-583b-417f-a5c7-1ac243281b79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701471, "uuid": "a06c45c7-7d8d-4560-a0ff-f89c43bf9e1f", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.10764.14549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb6112d-9584-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645715841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715841, "uuid": "ebc71b94-45b5-436a-9901-968f7ad03b51", "comment": "Malware payload (Heodo)", "value": "fc46051a0113d6c40e8249fc9ec14940", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715841, "uuid": "d7b5a45c-b440-4589-b586-abad3795ec70", "comment": "Malware payload (Heodo)", "value": "2e543f9f82d4a0a6aa96b929d12fde7f241419ef8c2ae0c62c9f65567084b097", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715841, "uuid": "7296def2-06db-4cd2-9226-acdbf78d60bd", "comment": "Malware payload (Heodo)", "value": "d671f5896fa6df7a2141cae21e1a927b2346db12", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645715841, "uuid": "0e8fc201-01a8-48fd-a5da-f063d32c65ab", "comment": "Malware payload (Heodo)", "value": "6427c551c94b5db36bf2aedc86aa0e69b96bb2d146bd1f4b1a9b1b3e52ee7945974b8da170c9713bc5cb06ef9b3f59d4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715841, "uuid": "8aaa062d-e4f2-41b5-bdf0-03701ce8f5ae", "value": "T13393026ED32E44BACAF58434F108D4EB690E5D071409EA490890F69B5F7AAC58F7DCEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715841, "uuid": "42e5b919-68aa-4810-a927-95d97fb05e0a", "value": "1536:wyx1gX2hnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xX0Hi:wyDm2hyVEoBo6hKb4llGsQjbxoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645715841, "uuid": "180f5218-8369-46ac-9917-cf1af4c09856", "value": 93363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645715841, "uuid": "b82c2d43-0557-4fea-a6be-601e6ccbf122", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645715841, "uuid": "f91bb54e-8eb7-4540-99c3-22e50520ea75", "value": "33YUU -BACS Transfer Sent 24-02.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c727de-95c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645743320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743320, "uuid": "4fb048b6-c374-40a4-99a9-664f9eca76df", "comment": "Malware payload", "value": "c7808afa0448e8ca4e0f365bb7953b43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743320, "uuid": "4359ff63-93e1-4a3c-9d9f-007eca2d6e5e", "comment": "Malware payload", "value": "2e5ff3d038894e872823d68b53b0a1a64eea8066cd3adc49d61097994f0375a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743320, "uuid": "5c6bf61f-77e3-49a6-bd1d-87761ef3087e", "comment": "Malware payload", "value": "103ce85099aa7bbf383a117b6cd39728a2e87146", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743320, "uuid": "02d133e9-0c1c-4f49-8290-9dbcc804388c", "comment": "Malware payload", "value": "03794dba80bca2279bbd5a01759a87f719c51db9259d2190a5fe1af494567d963381de3c4e732075f78ccb0a0a145ed2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743320, "uuid": "dbd7023d-7028-4d12-b032-db9192afa62f", "value": "T1D135BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743320, "uuid": "40b22ca8-f1d5-4c6f-a8af-657a18e21015", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743320, "uuid": "7ab8d7c3-9d3d-481c-b8af-6fa9844942bb", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+umVOe528JO6PC:6iRGcUY0UvDYNFtum5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645743320, "uuid": "a775cdd2-29bd-47ac-9ce5-77d4d8c4ed22", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645743320, "uuid": "78e10bae-b475-477c-9559-a4f5b70fceda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743320, "uuid": "4df067b9-2e7d-4015-a80a-e0ed050fc99b", "value": "c7808afa0448e8ca4e0f365bb7953b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845427c0-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "f29bab36-45e8-4d94-98d3-f88960c7447b", "comment": "Malware payload (Heodo)", "value": "ad1b84dc344a81cec595d8bf569862cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "997816e7-36f8-4d30-ae5c-eeeefaf060e4", "comment": "Malware payload (Heodo)", "value": "2e945f127cbc13133f37707365c324e71081c2538b3277c3975c297d2ec02bff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "641702aa-7b62-4671-bbd3-7f95d877e26a", "comment": "Malware payload (Heodo)", "value": "0920d34c760a9e09e5b350cba47053227f564c16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "b1ea8af3-5cd6-4565-a2cf-26daa65107f6", "comment": "Malware payload (Heodo)", "value": "bb9bf8164f5d16d6cbaa77278b21047a6bae8808eae894194c3be8fbb88460825ae1ae95ddbad2817a77d8d95eda3060", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "a60e4964-0a46-4b91-b5a8-f93e822d22ca", "value": "T1DEE4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "de798685-8929-4720-8d94-097f15994c61", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "75f91c3e-a819-4470-9617-4060df29baef", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuK7KDYjX3rUXY:ygHpbVy97E0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710539, "uuid": "5f7700eb-6704-48cc-b157-f32feb85e80b", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710539, "uuid": "127b9802-da15-45a0-bf6f-be39ce359734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "8b2cdd76-c8fa-470a-851e-cb3db70d7ddb", "value": "emotet_exe_e4_2e945f127cbc13133f37707365c324e71081c2538b3277c3975c297d2ec02bff_2022-02-24__134852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc64ae86-953e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645685749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685749, "uuid": "e5dc09c7-22fa-44f1-86c0-f99903c7183e", "comment": "Malware payload (Mirai)", "value": "9ef4191a8b36bbb0c77afd04ae2ae0bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685749, "uuid": "25889fc7-d498-439f-be55-0917d5985a99", "comment": "Malware payload (Mirai)", "value": "2e9ea0f70deaab93c3548f649be73ffc36a91c2ceb2003897109ef4b53f4139f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685749, "uuid": "e3c92ef0-53f6-49fc-a586-6fa15a595076", "comment": "Malware payload (Mirai)", "value": "8dd2fb171d0a5febda9046bc145667ba2ea9fbb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685749, "uuid": "33782ea2-a790-403b-ba52-d0a8a895228b", "comment": "Malware payload (Mirai)", "value": "3e8c54785d0bb1cbf4e7ea4fdca8b13d31edfc69d8ab46ecca052c95d52410251e1419862ffc1ee4b161938a99c9a9dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685749, "uuid": "87446742-bb2c-492a-839a-5d7d16bbc77e", "value": "T1C4935B97F800DDBDF849D73A411B4A06B231A2A54E921B33B7636C27FC721E45937E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685749, "uuid": "bff9b085-99d1-47ef-b6c9-bcf0c791df24", "value": "1536:zwEHRAAeT1mrOTnfJHuFgFMRrgePsMM3eX8t592kcZbyzQH1hquVwHLzVaTnuBJp:zD5rGnxHsgSlxMu89XOyzQH/quKeAJ35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685749, "uuid": "5b16c77b-8aaf-4d23-9185-1144a235aa62", "value": 97648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685749, "uuid": "b9e18714-39fc-47ac-b8e1-2ac4fe407990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685749, "uuid": "3088c995-c123-4cc4-bf58-7907fbc1f577", "value": "9ef4191a8b36bbb0c77afd04ae2ae0bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d98b458-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645688623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688623, "uuid": "73d64dc4-a11a-469b-ab31-77295beb4d0f", "comment": "Malware payload (Loki)", "value": "41b02746265354e7bd593827f545837b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688623, "uuid": "5cd3382d-cbc8-4840-bca7-e012b52e32c4", "comment": "Malware payload (Loki)", "value": "2ea5c2d96e46750652060f3b2d0441314ed64328fe780b4a4780b41cebe75b8f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688623, "uuid": "8c2b865f-1e21-426a-90e8-c6ffa7b78c64", "comment": "Malware payload (Loki)", "value": "519a5666908e5395517bdb4f99f2dc84aa6b7822", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688623, "uuid": "8e71fe8a-0bd8-4340-934c-2ffd9d78c03b", "comment": "Malware payload (Loki)", "value": "122afc8c9cc7d1597f915046336674b189f550146695e8c53316305c75b9f7d144848f380ad3159901ce415bd19a3b93", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688623, "uuid": "f79501f1-06af-4e4f-86dc-4fd77dc769d3", "value": "T113141238B7265E15FA8678BCDFF8C5941763CE00FEA0565E7848754E9037ACDCA88853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688623, "uuid": "f0d2c547-41fa-42bf-872c-1f06934cb8dd", "value": "3072:USMBqoBPgfyN5EAtjNXDdpsfpyYjgs4Eanw0M27vm1jGiD+rnmkNs8LiNFUxvM:ZA/PgqNrZNxpu/4Eow8uxGliz5TUxvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688623, "uuid": "7ddaf876-a290-4c33-8ed9-cb6a057d971f", "value": 190616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688623, "uuid": "b724fa90-aaf3-4785-8b5b-0aa2cb6ad2fe", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688623, "uuid": "16c06ae6-66e0-4422-8439-0218bc624898", "value": "Annex1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0f8e3d-957a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645711197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711197, "uuid": "1798851c-3b4e-4d15-9469-613902e62995", "comment": "Malware payload (Formbook)", "value": "2f1d7b3302abe28bc10bbc3eb915a3d0", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711197, "uuid": "9c813488-9315-407e-90c9-1259cfe9e1d9", "comment": "Malware payload (Formbook)", "value": "2ed24902c47e8e820e27130862561de3f4f9e46087f821aaeadcf13a22e75132", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711197, "uuid": "85b63eab-e778-4ccc-ba39-07b3ad3d29cc", "comment": "Malware payload (Formbook)", "value": "e0967c14d644d218931c7b64a02e0a53a4216156", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711197, "uuid": "e1649e48-e735-4efd-8fcb-43a941d4d4d0", "comment": "Malware payload (Formbook)", "value": "4c6d88d747dcbf96aa8f033270c90c8cb296c79d827bc20a48215573580e2075e063c64c191727af441f43014b4476ab", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711197, "uuid": "1c0409a6-97ac-417e-b36e-1b35788b99de", "value": "T1CDE43307A7C0969FC64AB8224D3174642D371B92A16DEBF029019B0EB9C79DFF1D07E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711197, "uuid": "d645085c-63e9-4470-961b-a44cd394e33a", "value": "12288:MqJDtRCcdp/nYCCv7XlFezWKsmfIiGn1x3KL3uIoodveA5y9y62DXwE6kfDeWQDV:MKD/Ccdln3Czl46hmfcn1x6LeINvecAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711197, "uuid": "04c27426-642f-4c84-9164-33e66f9c5791", "value": 682224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711197, "uuid": "6e256f74-96e4-4c6b-b882-b0165ed37c06", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711197, "uuid": "457a5509-b291-43b5-baed-6651eb2b7fbe", "value": "New Order Sample.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d6e152-95ca-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645745761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745761, "uuid": "23a45438-5ed6-4c47-9826-63add25f5500", "comment": "Malware payload", "value": "4f6b2ac972299b3485dc863155da4852", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745761, "uuid": "2d9d1be5-a5a2-4eae-bc0f-ed4962f71950", "comment": "Malware payload", "value": "2fd68d6a32a197572f80809ef335afa20a64d6ec26891bde6796dddbaadeeb3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745761, "uuid": "d4d1161a-d963-4693-bdab-2426f03e0785", "comment": "Malware payload", "value": "133c00972fad3bdec31250e76d0c8538f803d0cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745761, "uuid": "d8ec8136-7839-40f4-b4b0-f23cbe528146", "comment": "Malware payload", "value": "6c2d1ed688d80cdf79262770ffb97ed33822f6f49063726ab9ea9121f5cf0464d31750e0f30c25e9cd8dfe8d55ea8b86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745761, "uuid": "239625cf-9499-4c83-a96f-41b13d45aa46", "value": "T1BB35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745761, "uuid": "2d0966bd-182c-49cf-9fe0-8aec5ff0f8d0", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745761, "uuid": "eb4652ea-1f3b-481b-ad40-69c54c9c1d16", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uKVOe528JO6PC:6iRGcUY0UvDYNFtu65Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645745761, "uuid": "80be5b94-bd75-4d6a-a07d-46abca903d3e", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645745761, "uuid": "31c36427-bd48-4921-be86-450a7efd37bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745761, "uuid": "ffaa2eaf-19b9-4102-b1d4-0c1c66c8cf2e", "value": "4f6b2ac972299b3485dc863155da4852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca04068d-95b9-11ec-9275-42010a9c0029", "comment": "Malware payload (N-W0rm)", "timestamp": 1645738573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738573, "uuid": "976b2bfe-d865-4e4e-9411-e04ec0666f9e", "comment": "Malware payload (N-W0rm)", "value": "a8af2b86769b4c8a14096b9701a3f407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738573, "uuid": "c2925392-98c4-4d2d-b0d2-f55e6af6b442", "comment": "Malware payload (N-W0rm)", "value": "302ad40d44d3d35aa760a0628e6e4c1205053a343a09da085c818587c8397edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738573, "uuid": "8133f60a-b1ae-46db-9c2a-01b39ec62bab", "comment": "Malware payload (N-W0rm)", "value": "6d02faf21a6512c64d66fffd6772fe956cc5e8cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738573, "uuid": "a40be8ca-1e2d-4b99-8477-df311e71a108", "comment": "Malware payload (N-W0rm)", "value": "c0a4cc8dfb89554a64dfa7e5e44fc87d85f9e77bee98890ed4259ee0c730129d9883408a6a4ad169e1205f566de290f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738573, "uuid": "7167a1c1-df7c-43b7-ad96-2411c6e31c39", "value": "T18916337AA187EDEEC62E0DF5A714B0F1E6783E5C32C9270DB3521B4B15745ABCA03864", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738573, "uuid": "a14922a8-891f-4dde-a542-f1ce5ba96bb3", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738573, "uuid": "b39716c4-eabd-4d76-b2ff-b1b64f444926", "value": "98304:xB0JWylt099/JaO1ySFJEZSG/DOrRyd1wSPFxstgb:XYWXRdp0OrRydCSPLggb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738573, "uuid": "88b0d83c-e181-49fd-949e-0bbf55777afe", "value": 4136088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738573, "uuid": "10c62ff1-b6e5-4845-af77-5c42879f9d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738573, "uuid": "b79be9de-571e-4f18-a1a3-e7b3551c976f", "value": "a8af2b86769b4c8a14096b9701a3f407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3096bd6e-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645723283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723283, "uuid": "b7c78947-bada-483e-a8be-4e7d657a5a9d", "comment": "Malware payload (AsyncRAT)", "value": "c13fb5c2889ecf291ba719fa5e598a8d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723283, "uuid": "97ac1775-ebef-4dac-aea0-99fe338338b1", "comment": "Malware payload (AsyncRAT)", "value": "30fb07f3d0ff5583e496de2b238d75ef42ced2f66d9f9459e3f26ee87c5d85ce", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723283, "uuid": "98857e91-3f3c-4cf9-a3fc-b96bbae61613", "comment": "Malware payload (AsyncRAT)", "value": "df34705ab05381172150afa03f04ca090427f7f5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723283, "uuid": "8cbacfe4-7c36-411c-8979-e7bf2e034c6f", "comment": "Malware payload (AsyncRAT)", "value": "aa5b7d0cfd2a36cbd3b7aae2c6af8bc291eae1c987dcd16e7fd31be780ed2727779865127dc12b2e0fbf9ce40fcb7fbc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723283, "uuid": "ea3c9c79-1c89-41ba-a4f6-7b7eea47a251", "value": "T11C326CB19BF82883DE59F9A9E074FD1817EBF08001EB1AC9B56DF8300B417685D5388D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723283, "uuid": "83e99c51-ab57-49e9-94ba-fd01c714bd9a", "value": "192:B5lTE17B40fVz2a4eV1v1STSGoZybH1iS3QkBjYEphTqZZiUVczeF35fyp7AS:Jq7B40f1Xb14SDZCtT6fVczE5Kp7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723283, "uuid": "a5e25e81-98d9-48f6-b022-a78ea41309b5", "value": 11830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723283, "uuid": "fdb814a5-923d-4174-89c9-4d91081f84d2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723283, "uuid": "210079e3-dcef-4ad3-be35-d0fe758c9e3e", "value": "Pratka Econt 5300133634052.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1025c0b-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645739068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645739068, "uuid": "db5f99c7-2325-4f6b-85fd-faef93a29e47", "comment": "Malware payload", "value": "074f203ca66d1566b8d110aba0d564ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645739068, "uuid": "dbf047d7-b2e7-49d0-aec3-bfddc8e73f1d", "comment": "Malware payload", "value": "31b5a4d5a9f477d088c38859a13ff7854a0d048e60d79c11a85badd1b02cedac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645739068, "uuid": "77b0049c-bf01-4911-ad5e-5eaaaf619e4e", "comment": "Malware payload", "value": "16b3b2ec43aceb4f08c8666b98c86ca543e6c9ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645739068, "uuid": "875bacbe-7cd3-4f7a-9862-0e5a9117a8a6", "comment": "Malware payload", "value": "368c4b440214e6b8e1492c837e688d4e980dce2be87435c53d66327546596a207b1017488fcefaec1f9bb44eec1c821c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645739068, "uuid": "4cc43f8b-4875-4ede-a88f-d3d42e773ce9", "value": "T197059E0636DAC076C3AE17314E19EB6E63F9E9604F718AC3B6850F1D6D31AC29336359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645739068, "uuid": "83bd0f0b-0826-47bd-a9f0-c951b7d1118e", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645739068, "uuid": "55b48b15-d0c8-4d58-ae38-64df9b409005", "value": "12288:6iIiv+ctKlbqJmk09n2WkgFrIqCY8Mqa+us+aUHuz4Vrg7dL:6iIiGcU0Jmk092WkcEYNFs+u4VOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645739068, "uuid": "67e74825-ebe2-49c6-aa5f-45718d621f26", "value": 856894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645739068, "uuid": "050a0797-ada6-4bcf-8abf-bf34c30aa3c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645739068, "uuid": "1d82da14-5f82-4e5e-90dd-6a420aaa2fbc", "value": "emotet_exe_e5_31b5a4d5a9f477d088c38859a13ff7854a0d048e60d79c11a85badd1b02cedac_2022-02-24__214420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d1a84e-95a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729979, "uuid": "71932f9e-5cb9-4840-933b-b4ae9b80dc8a", "comment": "Malware payload", "value": "7768fbccea2f44cf7a3af5b13aefe02c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729979, "uuid": "a57cc269-9faa-4c4d-9e97-0343ea7fee2e", "comment": "Malware payload", "value": "327f63a8d2a1efd6535d114a0dbaea98a613487e5d25a03266ace9185f1a8698", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729979, "uuid": "e4a2176a-49b6-4b48-8930-146aafa79f0d", "comment": "Malware payload", "value": "233d0db701ff71005c4dfd8215a4bba1fd65fcfa", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729979, "uuid": "420653ca-3e04-46e1-b7c4-95f8a3bf0bba", "comment": "Malware payload", "value": "a18ab5823d66d3ee9e5b8a7e207ffba9953cd4df00a8673f480dffde278e50cfe575fe723eb825f87426143fcc38b6b0", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729979, "uuid": "8231a987-a085-4dc4-84cb-6e053ce89a1a", "value": "T18BE45C7AA6A605E4D0729434D9521607DEF17CA113B0A3E7A3A5374A0F3ABE0673FF05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729979, "uuid": "75b7e04a-dd6f-4785-bffa-ac3a0f2a4b8f", "value": "12288:Tl3Ioz1txxQIx/4o8F/JgnY5N/zLjV0mA6G:TlYo/xxQIafFRgno/rV0z6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729979, "uuid": "2ad7e58d-3061-415c-b22b-a1ca58c93cdd", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729979, "uuid": "199cec4d-d4d9-4d7a-b710-f75107dd375d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729979, "uuid": "f19d1b45-1154-4966-aed3-ae0e83c7cb20", "value": "invoice_131.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0feba03d-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687150, "uuid": "51df70fd-ee2a-4f8d-afa5-b66cb9131755", "comment": "Malware payload (Mirai)", "value": "f265afff8c113842c918e0b72bed6f5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687150, "uuid": "542ac722-f7c3-4e23-8d32-b3d1780171fd", "comment": "Malware payload (Mirai)", "value": "3292dbf544e4945dca33292e96f590c1bb55ba96c7754264e3c2a7753061a18c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687150, "uuid": "b9f7e14c-0303-4611-b2b5-080a906d50b4", "comment": "Malware payload (Mirai)", "value": "ec2bc0a4e16d83f6d77dcebc5769fa8ff852fa0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687150, "uuid": "75d59526-dbf0-4bc5-b3a3-fe06a309e8cc", "comment": "Malware payload (Mirai)", "value": "6540ec3c0407723f9bf1ee7fe99a8c8eb696da792bc60b4c144dfad09ff73c72ae984e7770c6260a29e828c9a98bb877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687150, "uuid": "222b679c-23d3-43eb-b495-c877524881bc", "value": "T138833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687150, "uuid": "5ac334a5-750d-4936-b7cc-5aa053e6bb16", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC5dojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J2BQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687150, "uuid": "552c5a78-a59c-4dea-bde7-1e14c6c55f21", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687150, "uuid": "af9f343e-7371-4930-9433-3c6e01ca560b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687150, "uuid": "e55f83ab-880c-43c0-9f64-30419cc745fa", "value": "f265afff8c113842c918e0b72bed6f5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fbfe30-9568-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645703663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645703663, "uuid": "c9870fde-f5e8-4427-92df-087321849e5b", "comment": "Malware payload (Loki)", "value": "6e31ee3338101df6fbb530570e1b1b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645703663, "uuid": "d360b6a9-ef12-4c87-909e-f56cb819ac37", "comment": "Malware payload (Loki)", "value": "3381ae6ef4cdfb5441ed65e9d61340d33b0edfc4b88d4ed4f902ee80d8de0864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645703663, "uuid": "2e690cd7-f4e0-4a62-a080-b93eab1456c3", "comment": "Malware payload (Loki)", "value": "9dce4f072834e3e5b7d18876fe838da5b243ce7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645703663, "uuid": "62638fde-7718-41b9-9ea2-e3ca35f7a185", "comment": "Malware payload (Loki)", "value": "03e53ea5f440248238d37c7fd298bdfafdf37f67ece058c44f96c5067fd7c0b8b3609c4c7e00f60c16be3fd7a060ad0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645703663, "uuid": "747ec85e-94cc-4d7e-934e-7b561c84dccc", "value": "T108A4273191F26AC9F896CEB29E21E61AFFE70D419A41421FD27439F61233B84D6051FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645703663, "uuid": "b85e7d94-b349-4794-9421-9ef5ef752a7e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645703663, "uuid": "bd319bdf-3abe-4214-b26f-cf81d5676c29", "value": "6144:oxDba+WZSqCAwZm9MaJBBetcraML9IL+fDn3938s50++48HMgBlhS3cJ:cuZSqCTgPZJay9IL+7tl4rAMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645703663, "uuid": "b78e1f6f-a087-4773-a168-aada456bfc41", "value": 490573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645703663, "uuid": "e98e7e70-14c9-43d0-a867-2c454fd9bfe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645703663, "uuid": "23f6a19e-4f81-41f0-b1cb-db846b47727a", "value": "BL \ucd08\uc548_pdf______.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7ebaf8-957a-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645711436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711436, "uuid": "089c5e3e-d9a8-42ac-be25-8ecc212ee891", "comment": "Malware payload (AveMariaRAT)", "value": "7c0a432cdbf636b8553f8d7c5e525a02", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711436, "uuid": "c2d458a3-a138-4919-89cc-7a36a644d4d3", "comment": "Malware payload (AveMariaRAT)", "value": "34393676a0517ab30b0032c14396655e8139844c415fc1a0136b6a8f2cf4fd73", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711436, "uuid": "f8d8ca81-28b9-403b-afa7-7a1700fc64d9", "comment": "Malware payload (AveMariaRAT)", "value": "20ba6faaff2eea86c9fa7ee7be8a98a238fcddcd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711436, "uuid": "a50f9692-fd7e-42cb-ba87-9514fffcfc62", "comment": "Malware payload (AveMariaRAT)", "value": "c77e6eea0d64b815e05819587cddaeff0923d906854064366a5444eb4bb99ed629304951d092b9e4d9126fad17a2a620", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711436, "uuid": "662427f5-0ee8-4f38-8da1-efefaa7d3be3", "value": "T1F5F4AD1024AF66CEF1769BFE1DC8A5B18BB9F53A3518F2B918811ED70B41B41DE01A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711436, "uuid": "62133ef9-f5fa-4316-9108-8806dc3afaf2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711436, "uuid": "1805f1b8-c687-4105-8df1-a2dc31509e17", "value": "12288:FBAvEJgYYz0sPy7xFo4fSJshxo1LBYmOnSKmVW3xImbUEB:g97c27sURB9vVEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711436, "uuid": "e30c124e-7948-4a74-8c92-bba5ce8692f9", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711436, "uuid": "50d997a7-1595-4e48-a678-6381708a65fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711436, "uuid": "e57ccfac-3739-4ab6-9130-77225e364787", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12b5ce5-95a9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645731686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731686, "uuid": "2eddf713-cbb1-4ae6-a570-826edfd5e686", "comment": "Malware payload", "value": "1642588e0151672cf1c380ec2cea02aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731686, "uuid": "4f1fffc5-ea94-47c8-abd0-e3a91a26c77a", "comment": "Malware payload", "value": "34f0988f7b8aa18124372d15bd6e7db193aa76019152c7bc2e0298804ea32a62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731686, "uuid": "c3035b4b-2969-4d7f-9cc2-168efdd3a0b2", "comment": "Malware payload", "value": "a920f086da0872b3b0ebf987aa07ea2cbe84c066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731686, "uuid": "6a404311-435e-4006-8d11-2656cc966523", "comment": "Malware payload", "value": "d37961d1cb4311c8b23124b55bde564ea8fc77b44ba62759603658930fd6e1979051dee618586898631dd3c5397496d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731686, "uuid": "b9bc9dca-8439-46b3-a0e3-e5a4ddfee9b0", "value": "T104E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731686, "uuid": "3258b3f4-cbb5-49ad-8d76-8513865628a4", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731686, "uuid": "2d0e1d6c-5766-4d81-a8c6-05e869436604", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XbsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWba1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645731686, "uuid": "d5865ce9-1a1e-48f4-9553-34cbc20c4da9", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645731686, "uuid": "680ecc73-31fa-4b74-a109-c49b181b0903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731686, "uuid": "2c9bde26-418f-4280-9b14-583538656339", "value": "1642588e0151672cf1c380ec2cea02aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9afa6d64-950b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645663761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663761, "uuid": "26639e2a-520e-4632-aba3-73dcc0c86872", "comment": "Malware payload (Heodo)", "value": "01cbc9463d63a27934c47d5a3a7e68e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663761, "uuid": "882d7836-43b1-48df-8d1c-3e8f17fc6ead", "comment": "Malware payload (Heodo)", "value": "354a54eeee42a78ade2a39960df8b15ea45ddc8482309f4173871509047c8edf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663761, "uuid": "49033aa7-7484-4db6-8ea6-83bdacffcea3", "comment": "Malware payload (Heodo)", "value": "fd6cec97ab3da38e08a0e9ffcb6314b9442c6833", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663761, "uuid": "98442ea9-8061-496a-b67f-e4eeae110c6e", "comment": "Malware payload (Heodo)", "value": "4d84464513a0e916ad632b0fd3edbfd41a5bf5f6c9c486981fda3214296f7c3752a2d95877328fdc565d3440017fd790", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663761, "uuid": "b1ff1084-75f9-4580-8ccf-c1b06d02aaea", "value": "T109E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663761, "uuid": "7a88cf0b-84c6-4dd8-b91a-ce1a6885c10f", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663761, "uuid": "b9a5e4ac-196c-4c14-af55-354706b5662e", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKwe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKwLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645663761, "uuid": "c4d41150-e4d1-49fc-8edd-73bef661e43e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645663761, "uuid": "a52c0f5d-06be-484c-a19f-9b3ea712d9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663761, "uuid": "15413799-5eaf-4419-a65f-3f22bb9bd172", "value": "01cbc9463d63a27934c47d5a3a7e68e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1798dee4-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "5c749fd4-6d1f-43a3-88d3-de368af35808", "comment": "Malware payload (Heodo)", "value": "41a6e31108f1ef21111253538e21e1ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "6117ca3d-98cd-4a57-bb50-c8f4b464c23d", "comment": "Malware payload (Heodo)", "value": "35a0a928dc1177e032260d7877a6caee4bc22a11cc7999db64f961cca135501f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "03e4f55b-47c5-44a2-912b-6cc3b7e9e07d", "comment": "Malware payload (Heodo)", "value": "4cb86dcafcfee3ed69e921d052e9b8ddb90249ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "66befb13-64b3-4554-8203-64a4bdd3978d", "comment": "Malware payload (Heodo)", "value": "6c425a16e7c179f46032dd91b5d68da30323dc51b55ab246145006a9b34af69a8e522b1ecf7ce7d3d225c78e1afb63dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "98c7bc1d-9b3e-490c-861b-3cf2f323644f", "value": "T1ECE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "0c12d1d4-8249-4be9-8dda-bb125b704f5e", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "ac034d82-4534-40a4-9ce1-371abc1b53e7", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA03hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf1PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660964, "uuid": "34649ef9-3243-48e6-aa09-6e2f5f5ddf0a", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660964, "uuid": "91ef8dd9-0463-434e-a356-07e031e80a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "083abf8e-421e-44ba-8c4e-d41c4d282f1a", "value": "emotet_exe_e5_35a0a928dc1177e032260d7877a6caee4bc22a11cc7999db64f961cca135501f_2022-02-24__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55195d09-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696286, "uuid": "d639a63d-0efe-44b2-adc5-223e2895edd4", "comment": "Malware payload (Heodo)", "value": "162c5894809a1dfd03f803735c276719", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696286, "uuid": "4d7a2d1a-a500-4691-996c-6baa808a56c2", "comment": "Malware payload (Heodo)", "value": "3737be5a6f78019427a2cd1a136920678c29d1cee42689cc0d962884b4021697", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696286, "uuid": "a8d69945-2a91-47f8-b890-8a95e19bc8b5", "comment": "Malware payload (Heodo)", "value": "a88a4ea1a7284d962f07f5f69a670991117f6c8b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696286, "uuid": "6d1f5f64-f660-4c34-b243-4da6ba7d7a28", "comment": "Malware payload (Heodo)", "value": "827ef6629553636f0403f01b886ed1b5b116435868f6274948016a7f1a1638574a68b45b2ed4be2acdfd87f6f4fe3ff3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696286, "uuid": "256093cf-b2d9-451d-a354-8ba85e1f77bf", "value": "T1CEE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696286, "uuid": "789f44e0-8a59-4f1e-99fa-bbd36e62cb86", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696286, "uuid": "ba088884-b79e-48f1-9850-5d5909c6b4b2", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA05hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfLPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696286, "uuid": "493dff6a-95c2-4889-9bdf-0257a398a4cb", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696286, "uuid": "30d8837d-c231-4488-8afe-df3e5369f48b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696286, "uuid": "d2ddad8e-3b15-4c06-bf53-3d5187343fa5", "value": "NZpmuVHUYLidjR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd2f5cb-95aa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732187, "uuid": "a37d1d03-28d2-444b-ae79-72f620fddd26", "comment": "Malware payload", "value": "6e5cdbff88b5f5604b844f7a8a439729", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732187, "uuid": "4605721a-e4ba-4dee-aa3d-43a78431901b", "comment": "Malware payload", "value": "37b15ff4311ac4362408b5b29c86d52b93188138af71e751424a87eaf775a1da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732187, "uuid": "6127b9e4-ab25-4e24-afb3-9afaa54d0215", "comment": "Malware payload", "value": "0085f6703e139a6742725d08f2e15686ffb5149e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732187, "uuid": "c0f2c2c2-82eb-43b6-b8a9-465ed0d48509", "comment": "Malware payload", "value": "cf507b8519bcb398b5a13499e6e3043ed473be8bc74fc059ded39b5518ee236fd2143eac300a28bc5d4912f894f0bc18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732187, "uuid": "838db744-84d7-4ec6-8a86-6ee4eff30903", "value": "T1BFE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732187, "uuid": "00ee6103-9303-4d5d-a6e0-ff6604b41582", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732187, "uuid": "d0e2e911-3aa7-4026-937c-14de7b22eb84", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XTsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWTa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732187, "uuid": "dd12f4c4-06d6-4553-85eb-b47adab2987f", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732187, "uuid": "998b2571-fb13-45fc-92a4-cc1b029a4833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732187, "uuid": "95919f76-1329-4e78-b3c2-19b57b07a75f", "value": "6e5cdbff88b5f5604b844f7a8a439729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b58c26-95c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645742235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742235, "uuid": "4121745a-b02b-4910-a96a-306d6e322501", "comment": "Malware payload", "value": "2dc6aeec49cee34c44d325d7278890df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742235, "uuid": "38d1a85e-1042-4b88-8ac5-e6640c63c6d5", "comment": "Malware payload", "value": "37f6c39a1c1e3cde1d8c67402e24d2cb35c2e59cc567cfcd207a7bb5fa427b44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742235, "uuid": "ea8459e7-ccc6-4682-8893-110ee40f82a6", "comment": "Malware payload", "value": "15c8d8be4ededcc551aa055a5a3f644c65d39129", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742235, "uuid": "0831565c-df80-4ff3-b18a-6904ae4568b3", "comment": "Malware payload", "value": "cf76defc2e481c4b2af1951ef6060c3835c0e928f6a00dacdca5a298781cbe3c7d9159b557bf23e6120a7ca902045007", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742235, "uuid": "8488eb4a-9e08-48e4-92a9-dae32f8ea949", "value": "T16B35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742235, "uuid": "c55fb99b-079f-4624-adf8-5789c2dbf26c", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742235, "uuid": "bb7f63fd-c6e4-4d6a-8b31-a9a27a598b19", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+u0VOe528JO6PC:6iRGcUY0UvDYNFtu45Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645742235, "uuid": "c166dd5d-2656-4855-91b8-6ca900db1594", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645742235, "uuid": "493f492c-5f0c-4e43-8de6-1a68a4475bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742235, "uuid": "e36833cc-574f-45cd-9505-609f3713613d", "value": "w2weS2hRf87l.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709d51f3-9577-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645710076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710076, "uuid": "9297a2e4-5ae6-4a27-8f4a-d4d324dc4d55", "comment": "Malware payload (RemcosRAT)", "value": "4b6da15fef5021aae8afa671f443a8e6", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710076, "uuid": "7f78b04c-98b8-4e46-ac30-16b357b61e72", "comment": "Malware payload (RemcosRAT)", "value": "3877c2478c7ef5664e2f93473ecad63729dd0ff08610a3b80e96478447f85943", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710076, "uuid": "fcfffa36-ce10-4552-9e48-14603bf27147", "comment": "Malware payload (RemcosRAT)", "value": "53536c501a2c636fc07ae8b49b8a2da06d37a4e4", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710076, "uuid": "7d6375b5-b9de-455d-99b6-a67e8a040769", "comment": "Malware payload (RemcosRAT)", "value": "20e131331e9c0d456a0c19655ce5c7bf6ad8caf64095938ec85de86ae72b3716f17222b632d8483500a86dd419365df0", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710076, "uuid": "be9915e7-0da2-4f30-8a16-475ef41c72b1", "value": "T19A22BE7E82D8ED27D51000B644CF2AE7154DC6F99120252F2B37899BE938242F36F5BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710076, "uuid": "db31e8f7-ca51-4339-bdd4-726d997cbb96", "value": "192:Hyl3OCNLRMVJkYKlpX3/iCQ56lShHX6KnsjFypDxOz8VqnREN5z7dZUp0kKtjblq:GOWMfNKlVg6u14GxOoonREN57dS0Po", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710076, "uuid": "89c62f64-a937-49ea-a6ce-aab23c213e2f", "value": 10167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710076, "uuid": "90376aaa-c62e-4b08-a68c-747cc472ca73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710076, "uuid": "bb9f7645-28a0-4406-aa1d-b38a83b10c99", "value": "09865432--094=-09876545.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2854b0-9548-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645689726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689726, "uuid": "b8f830be-c7fa-467c-b2d0-93defb73315f", "comment": "Malware payload (Heodo)", "value": "04c60312307c358634acb4574fc7b79e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689726, "uuid": "85bb6ddb-8396-4d3e-98b0-cca9cbc75e36", "comment": "Malware payload (Heodo)", "value": "387e09fee0f8de727b8f0746e0b32a8889a1680d157e8baed4b4486cd14a0605", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689726, "uuid": "c5b2dbcb-93f7-4f68-bd51-37836a8f6af1", "comment": "Malware payload (Heodo)", "value": "acba6722bb25fa6dc3d98fa84bbf6f06401a48ec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689726, "uuid": "8f742857-c174-45f7-abf8-7ba45c643a04", "comment": "Malware payload (Heodo)", "value": "5e3103e536598c28770c9f217922d9e777cbaf9201e3a93f99d33a209a2bfe3b10fe355ffc8b8349ada5856a0efa7462", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689726, "uuid": "84418f7d-89b6-4722-9c90-9c20986662e7", "value": "T111A4BF517390D036F3EE3178554A9AB05EED7C708BE19387BF802A7D5E316D28B3861A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689726, "uuid": "35dff26b-e892-4b71-9659-348eaab64757", "value": "6d1d8c8ae132591dccaaeee10258dcba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689726, "uuid": "56b1c8e9-dfe0-4da3-b1b0-66365331083c", "value": "6144:FjjHl52ek2r4vRnFAbN7ZmNWXpdJlc+kqIUlcb8/cKzLiag1/kO9IHSCgzUzA:1k2M+BZmNWZdHc+Fmb8DzLiag1/knyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689726, "uuid": "5fdd5839-95cc-430e-979c-ac91f49d8a7a", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689726, "uuid": "1b6b0175-e2dd-47ce-a691-8f62da4839d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689726, "uuid": "abff6109-b932-4d37-817f-f8c443d6a1ad", "value": "emotet_exe_e5_00a64091363d8f58ee9a92f208c8aea30299d53c1a2f9bb8ba460cdb3239584c_2022-02-24__080201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6455103e-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645692875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692875, "uuid": "22298d98-cc7b-4eeb-b55d-9bec6b935058", "comment": "Malware payload (RemcosRAT)", "value": "4515fc0fa5dbe2324e6fb44635854e8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692875, "uuid": "646f6ba6-6efd-4780-b2e4-b43f90a5d051", "comment": "Malware payload (RemcosRAT)", "value": "38c2822b3929fe567273c89ddbdc3fb49a750199cd795f36ad6dc29bb614e4c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692875, "uuid": "c43bf9a8-df38-4213-ab78-921fb44a6fd7", "comment": "Malware payload (RemcosRAT)", "value": "a18fb476947eb042d05762b309ee15d47a75a204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692875, "uuid": "ccbff6a4-c207-4614-8421-72ce889b8d16", "comment": "Malware payload (RemcosRAT)", "value": "1aefe340b30966155f5955507f0f9d032352eccdd324a1c7532410de680b1da69ffc5fdbcf9df637af4e88bd1b24ea78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692875, "uuid": "e54ce557-d6cc-48ce-add2-a1d214518f8a", "value": "T12535E02028BF20DDF1239EFE9ED8F9B1CD6AF53A2A1D75BA20854F534741904ED12636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692875, "uuid": "63eee72f-af30-47dd-bd29-470a73d13622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692875, "uuid": "52f527e6-954a-416c-aca0-bf5b42ee020e", "value": "24576:N94Euo0i0dxGxHsgxZid+0kIwSjdTwoIj:34E8xdxsJxZi9tr8oM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692875, "uuid": "e1e5524f-83c2-47c6-a39d-0ded28bfa24a", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692875, "uuid": "2886b840-da06-4119-b124-cc686962f47a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692875, "uuid": "d5bab953-c7fb-4330-b1b1-5e3741fe28f4", "value": "4515fc0fa5dbe2324e6fb44635854e8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b234c6e-9556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645695893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695893, "uuid": "228a3b11-de6f-444a-bb3f-61983b0cdc55", "comment": "Malware payload (Heodo)", "value": "393b1fafa4fe68c61207b8531f579ff1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695893, "uuid": "dc7bf426-1caa-4f5a-984a-b915e8f690c0", "comment": "Malware payload (Heodo)", "value": "395fa334ca328821d63424093e21cdfed0cd07253fd3a0cd922e4d731254fe41", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695893, "uuid": "b74c7950-9b9f-4aa1-87d7-feffd8a5f1e3", "comment": "Malware payload (Heodo)", "value": "14acdeb844721782c4381104ceff61bafb3dbe23", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695893, "uuid": "02a44d6d-996e-4dcb-9109-05a9bebad52c", "comment": "Malware payload (Heodo)", "value": "4c2fd67c34da94e841ee8e48f9f4bd9ede6599f19f75910ebc51cbd4af4d3210fe623344a3b48f93c5672d6fbccf071b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695893, "uuid": "4225974a-5b5d-4a8f-bb22-06eebab1bf1c", "value": "T1E393026ED32E44BACAF58434F108D4EB690E5D071409EA490890F69B5F7AAC58F7DCEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695893, "uuid": "f5a3239c-f608-4367-b0aa-aaf29d9ee9a1", "value": "1536:cyx1gX2hnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xX0Hi:cyDm2hyVEoBo6hKb4llGsQjbxoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645695893, "uuid": "81419729-2e70-4eeb-aa31-18347234e107", "value": 93363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645695893, "uuid": "7965a36b-e68d-4ac3-bbc1-cefe3fac8303", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695893, "uuid": "4457c7c1-09eb-4ea2-b720-6236c8a91027", "value": "UCH644111615MA.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde439b3-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694368, "uuid": "d4744985-4747-4a15-b0bf-c98c1d135cce", "comment": "Malware payload (Heodo)", "value": "e212c8cdc617a78cfd313c74dd953837", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694368, "uuid": "591ef88a-4316-4349-8fdf-7887f7ab3e50", "comment": "Malware payload (Heodo)", "value": "3a39d8e793f78290bb7b9211c1274b252cce64140a1434ee8da6b47bcfec548d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694368, "uuid": "5cc17d3c-7b60-46dc-841d-740f23c6faac", "comment": "Malware payload (Heodo)", "value": "3b00798efe7db069df866c62d47c1e650cdca593", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694368, "uuid": "bc79e1b3-c6c5-497e-819b-c761c9e382e8", "comment": "Malware payload (Heodo)", "value": "fd99edba61188b58782b72a5ba0772bae33ed2d38f4ab07d8544e47f6e864026f23abb28ae55059b6c48b246b9f432d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694368, "uuid": "f60d556e-c2d0-40b3-ae74-a5db2423f62d", "value": "T134E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694368, "uuid": "4afbfcce-d2e3-41e4-a4b3-693e3ce0af15", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694368, "uuid": "b98e4ed4-eda2-4f55-a46d-3eb6dff87863", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0fhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfZPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694368, "uuid": "446265a4-9408-4f26-8ed6-6554017463cf", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694368, "uuid": "d7f9a4ff-0612-4a7a-b264-d34987699841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694368, "uuid": "e8fc5168-94e5-4ee8-804e-55db93302620", "value": "e212c8cdc617a78cfd313c74dd953837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716914b9-9564-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645701917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701917, "uuid": "76313eb8-271f-4084-9ab4-0fb242a193a3", "comment": "Malware payload (Formbook)", "value": "ce5aa39e6b4bb8369514521fed12ff44", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701917, "uuid": "61392ba3-9ad0-438d-b35f-e359c7659e2f", "comment": "Malware payload (Formbook)", "value": "3a9961500c4dbb5da0bbb98f09741f34e10903ed48dee6d8df15178158afe9e5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701917, "uuid": "af112bec-4dbb-4ed8-9241-e5391a26f131", "comment": "Malware payload (Formbook)", "value": "c792b9c454bc9275d017082504036e890d52fe5e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701917, "uuid": "8498a79f-52ea-47a0-92d0-babb3ad67b91", "comment": "Malware payload (Formbook)", "value": "8dc6b24ea7f0d97a7a896abfaa54139227415eb6f81a50577fec101aee9640575aa65560ac7cb9036efd81d4d54ed18d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701917, "uuid": "0cde8994-c6c4-4cc8-a29d-8460df54362e", "value": "T1DD5445A0682F0972E748AE1E50E1704A1DF6FEEAB0C19731639FA564DFD46F18EC0857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701917, "uuid": "f4c56e11-ed81-4c48-8282-e11a6d1c1539", "value": "3072:iKe9uXcR06QRQe9uXcR06QRQe9uXcR06QRQe9uXcRadCKRdzFtr5RDAw5wfQ:CdDdzFt1RDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645701917, "uuid": "27c4ecf0-1079-40f5-8194-a546287bcb4e", "value": 290156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645701917, "uuid": "335d57f1-2fa6-48d2-905b-debde67c3f88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701917, "uuid": "4d046ae0-7d56-458c-832b-5e673c5d114e", "value": "POXCMT201201-1XProfero.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a821011f-954b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645691271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691271, "uuid": "95737194-41a3-47d0-bfcd-f8368cb915f3", "comment": "Malware payload (Formbook)", "value": "eab870030d6c210981b716393c97fc21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691271, "uuid": "4b70d4b2-7539-4f43-a805-6ffcdfde9348", "comment": "Malware payload (Formbook)", "value": "3b556486b755edeaf1d0db1901be72b28993c44bcf80ef5e0459500b7ecd2014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691271, "uuid": "5af3c2e3-aea6-448a-a0e4-b7d7b899a923", "comment": "Malware payload (Formbook)", "value": "9237b9e96c32cee7a30448d46761b8663c5d8caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691271, "uuid": "541a2ae0-5ca0-430e-a77f-08368fa62433", "comment": "Malware payload (Formbook)", "value": "fe5e429c4be904e08b39f829283a96c049e7a0bb00fd8e4f574c0a69b84c0a93ee3960c6e54441f563a47d1fb6e24808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691271, "uuid": "8eccf7b2-a417-4adb-b8fa-1c92cca06450", "value": "T10064121A75E2AC93D2036BF592BB17E7C7A592481AD1733F07814FFEBA21507244E281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691271, "uuid": "6a7785c4-ce0b-41ce-b9de-5fb21ff21be1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691271, "uuid": "31fe37b0-f20a-4ddc-b831-e11f1cf8b6a3", "value": "6144:TxDBXr2JZQCW0s/nTGoXEgQX5PxLvhgpy0hFkrCTxOYD8PuRxGzOvpa:372WTbEjX5IjTLRRx/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691271, "uuid": "b1091aab-3ab5-4302-84be-0fe4371d525d", "value": 326527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691271, "uuid": "f926429a-0290-4549-92e7-739e103f9d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691271, "uuid": "c1de8414-6142-4156-b8dd-9c1439069896", "value": "Invoice or Scan copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d8f85b-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (WSHRAT)", "timestamp": 1645723460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723460, "uuid": "f97ec900-22e3-4960-86af-6818fc0ae80b", "comment": "Malware payload (WSHRAT)", "value": "052a05ad4eb7e32870e0562579e97ddc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723460, "uuid": "4615d426-731d-42e0-a07d-e78ad7b6f391", "comment": "Malware payload (WSHRAT)", "value": "3b5dcd2b38403d1e30cbc282bd871ac8db74acad81d06d680441b9590f059200", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723460, "uuid": "a5046aee-914f-4632-9c03-67efc14f3162", "comment": "Malware payload (WSHRAT)", "value": "4c5de34e4acadcc419112e81a41d0ede02fab534", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723460, "uuid": "4ad6d002-b368-4ab2-a35f-34349adf808a", "comment": "Malware payload (WSHRAT)", "value": "ea85c2866a601d6caa621b9f1668c87551ca5adf4c73281cd1c19e2ff999962af015fb4c1ea47cb8b4b60ac419bd78df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723460, "uuid": "f808b656-8b95-4a17-8b0f-834bebbae899", "value": "T1BA3529874C281A0283A3F421472DB613DDB4EA1B2EA705E6FD857D8FAB7DC50497DB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723460, "uuid": "c346cec4-fb71-4b87-a395-47f71282ad6a", "value": "6144:MQt/qzBj7axU90E7sM4YIwn7rRyZoIttRj6YRufpC5NaSYcNrA+PQC4K4ITUC8lS:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723460, "uuid": "d2d06fb4-8ac6-4465-9824-84ebf7b17da8", "value": 1102649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723460, "uuid": "a188cad9-4c4c-4a1b-b073-552fdcc4af6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723460, "uuid": "7a22bd88-1390-4938-9b88-6178977a73fe", "value": "Scan00337.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279e22fa-9596-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645723268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723268, "uuid": "60456ef6-988f-41e5-a8b7-4c4c91aeeaf1", "comment": "Malware payload", "value": "5163f992525315cd44c1e23897bbb812", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723268, "uuid": "ba32bf8c-cb66-40f7-8723-4bc1f3caa6e5", "comment": "Malware payload", "value": "3b660658eded77390c2a90e1b5414c02872a23c8ba55add3c27c1bfee42492cf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723268, "uuid": "a9747807-4234-414f-b049-36bb6b8990d4", "comment": "Malware payload", "value": "78d3e137dd32eed1cbdde9be9cc0932acf6b4f81", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723268, "uuid": "fcf3a674-184b-4442-b7ce-3f08a5c6ad75", "comment": "Malware payload", "value": "a036337e468547a3c023c7a8de84f90151d8c8a136222a69e5be62b064bf421e60fe61524ebf5c865b960797aeef885f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723268, "uuid": "1db2845f-4245-4ec4-9c8e-d18df2cad5d7", "value": "T1C65444A0682F0972E748AE0E50E1704A1DF6FEEAB0C19731639FA564DFD46F19EC0857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723268, "uuid": "e6156754-de4a-4253-80e6-2b73eb9b65eb", "value": "3072:iUe9uXcR06QRQe9uXcR06QRQe9uXcR06QRQe9uXcR4lLLVtdzFtr5RDAw5wfQ:25LHdzFt1RDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723268, "uuid": "5a5afac0-8468-43f6-8d1f-d24f67f4ec29", "value": 289170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723268, "uuid": "9d3079c3-2ef2-408b-bc69-c0ff472b1d2f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723268, "uuid": "31f80b7e-09c5-49f0-bbe9-9624245d1f6c", "value": "POP_ThirdParty.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a125ea4-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645723326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723326, "uuid": "0fab1d35-0233-46ec-8773-4a2b023c5747", "comment": "Malware payload (Loki)", "value": "b5f173708010f54f6cdf369fb5909024", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723326, "uuid": "b650445e-2e77-47f6-b44d-2fb72362addc", "comment": "Malware payload (Loki)", "value": "3c0e7360ad47ab109b746608670802cdaa178eb22c3c116c5fa62acda8c1c150", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723326, "uuid": "251e6563-9fc6-48de-893f-fd74f4cd551b", "comment": "Malware payload (Loki)", "value": "d5a7fed5b595e800f90057fb94acc77d6c096db5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723326, "uuid": "8360c581-a6c6-48e6-b3d4-6bb0513166dc", "comment": "Malware payload (Loki)", "value": "c259838ab344ed0e1f5ce593951b9edfe858ca8343ad8cb0aa5a5ee3bb7296bf76045c9e916c5b5d49edf3989e5aae93", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723326, "uuid": "b5c2c195-7504-4fe8-8fbf-fee80b453d01", "value": "T1C4141218FE587047D0B2DEB828286EF125C09F1325E27E5A42277F5E5E75BCA489E3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723326, "uuid": "3dde9c96-e39c-4ad3-9f62-e1414c4d3444", "value": "3072:vTbk7nNlcYECkbejKYTUKdzMPWXKyWME2bQA2GqmjZ9iKfp/xTAkUB0K:L4HkijKYrzMwC2MlmVd9xTtg0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723326, "uuid": "0b93f13c-6b80-4c95-8987-cfa3ddb02fd0", "value": 191224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723326, "uuid": "faef92cd-d985-4fb7-af82-0e5721723a23", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723326, "uuid": "281a5d2f-a890-4793-bc87-0616667d84d2", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582213db-9540-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645686413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686413, "uuid": "d093205c-ff18-449c-b8b1-6303c1e616a6", "comment": "Malware payload", "value": "4ecc392d78b44320a9ba19b1495d5c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686413, "uuid": "b9279bbc-0e7a-4144-ac3c-2c7809c4ac99", "comment": "Malware payload", "value": "3db995ab386682dabab33188fd255f3930e4791bbfc7b9f494f365516e76ade1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686413, "uuid": "129b20b6-1481-4d1a-acbe-fdd3bfae80dc", "comment": "Malware payload", "value": "78a0f48e5573819b48faedf856c192f657e521dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686413, "uuid": "1049fa22-5373-4cf5-aa0e-e3dbc0d8ab19", "comment": "Malware payload", "value": "39c2c43c2ba4ddc428ed0663848e69639f36936b5e42f61b491ef45e4e31326b0ade037b31f81286f46ab1a9dd69b35a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686413, "uuid": "0405db57-680f-494c-a6de-e7c0b1443c35", "value": "T1B135384127F961EAF5B2DF39653F411B8F327C2519B5850A5F20B93C0C74A478A3ABE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686413, "uuid": "a42efeb7-3344-4474-9273-a57ab66689ca", "value": "89eeb57b303a1231a34736aa642e325f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686413, "uuid": "999fd1cb-b7b4-487a-9a1a-c7ce711b11a3", "value": "24576:vbWwZKBn/Tliaa4ns16xQ2D6W4kTSY2P7OZ0:v6LlxDvj6Pk+YIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686413, "uuid": "e6646695-579c-413b-a3a4-541ef5a8a634", "value": 1089392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686413, "uuid": "134f8794-d937-4659-83ca-c1c6a6356947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686413, "uuid": "8a0878a1-b94f-4aab-83b1-99430b0576ee", "value": "data64_5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1b4c7a-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694155, "uuid": "e0c0405d-efc9-4f07-8e72-0ece367fd685", "comment": "Malware payload (Heodo)", "value": "1609a7247bef90e22118445ccde8ded6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694155, "uuid": "192f82e3-3ee4-4355-aab8-5dc365028eb9", "comment": "Malware payload (Heodo)", "value": "3e471e92a7b601471516cbe5125aba1cee6423e2f48859841129b846910a5b18", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694155, "uuid": "5101dba0-81e4-49d5-9668-5b8a16c97a17", "comment": "Malware payload (Heodo)", "value": "a45ef6d02ab8f988151d63f7eb4ff477dac7f822", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694155, "uuid": "b4bee0b4-96d7-4e9d-843a-ba9c2720e9ea", "comment": "Malware payload (Heodo)", "value": "a004b0576f68b8699c6e41cc9ee477a1327830b5ef8f4597104ee2b10b89f5bb70571eb713e4053692f4ebc483ec6015", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694155, "uuid": "edeca606-6cb1-4ed7-8ae3-b6cd5fc0f8a8", "value": "T15E93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694155, "uuid": "b50dc98e-0fd9-416c-abfb-6ab2f09abcca", "value": "1536:jQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:KDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694155, "uuid": "0bf993fa-b313-453c-988e-96d03e20861b", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694155, "uuid": "04c160b7-9947-4e15-9afc-2ebc36123d9a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694155, "uuid": "ade6fd96-4acc-476f-a9e1-a671b450d72a", "value": "OPAST GROUP_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeced25d-9581-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645714583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714583, "uuid": "3e72ac08-d983-4ab5-9ca6-ad8d542c2c9c", "comment": "Malware payload (Heodo)", "value": "7273b4aff1758fdca2fb274d6b7f7797", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714583, "uuid": "f26c0f08-5deb-4917-8a9d-b19006c243c4", "comment": "Malware payload (Heodo)", "value": "3f714c4b74c381a4526c48984410ffbd8de2c1c6da33a1319b5cb6e770301236", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714583, "uuid": "766f4155-c017-4174-9f5e-c26dfd8d2774", "comment": "Malware payload (Heodo)", "value": "db2d2f2e4c28e80e4339d985bd4714f9b0462d82", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714583, "uuid": "e57090cd-3102-4472-93e5-5789a53807fd", "comment": "Malware payload (Heodo)", "value": "40f198848836408025dc6037d12d0e103752fb06ac3041801074cf07addfff77ea61ab6eccfdad511da5c9a2d823019e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714583, "uuid": "de23b42b-21fa-4c31-a9ae-76ef95a21c3e", "value": "T1E393026ED32E44BACAF58434F108D4EB690E5D071409EA490890F69B5F7AAC58F7DCEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714583, "uuid": "b1273901-c248-427b-ab93-6fc354bf359a", "value": "1536:8yx1gX2hnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xX0Hi:8yDm2hyVEoBo6hKb4llGsQjbxoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645714583, "uuid": "d30fb8c7-f184-493d-a79a-ef8003b6bd57", "value": 93363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645714583, "uuid": "6c4f3b9c-45a7-4e57-b84e-04653b26e6e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714583, "uuid": "d628f02f-79f8-479e-849c-0bf269df1ed0", "value": "form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3296b9-9511-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645666312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666312, "uuid": "bf063f5e-174e-488e-a1bf-0f3b4988f7f0", "comment": "Malware payload (Heodo)", "value": "be4935a12a64243456905cd9095097f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666312, "uuid": "a298e638-9a28-4ec6-9b84-d0d0c76203e3", "comment": "Malware payload (Heodo)", "value": "3fdb60766e6bd373f7b7f7cd412dab4fbc9feb60682f803bc9c89352ace2ffc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666312, "uuid": "997f2f44-15f5-49b9-b9a1-c8e17f5ed47a", "comment": "Malware payload (Heodo)", "value": "549eb358bb0945e3016202e0020d7925c46fdcc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666312, "uuid": "d22fe5ba-04ad-44e2-b0b5-364dce9175e9", "comment": "Malware payload (Heodo)", "value": "9d9d1bed0058e235bd1aebe92d74ac497bbeadaa22bc4e7ae12a712c325ea9e4c4eaf63e714608d2eccfbc8d239799ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666312, "uuid": "a8d5fac7-6bfc-4a18-b6a5-0c18cc842b56", "value": "T174E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666312, "uuid": "040ab845-6d78-4301-91a2-77a2d1c72a33", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666312, "uuid": "e17d80a6-6bab-4059-8862-87b89390cec6", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKQe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKQLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645666312, "uuid": "c8f57429-c42c-45cf-9175-be9870fb72ed", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645666312, "uuid": "cf9cb77f-5a86-4fd1-9732-288a2f1bda8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666312, "uuid": "5890be48-067c-4a2d-a4e4-bfca54e30dab", "value": "be4935a12a64243456905cd9095097f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bcfdc6-9540-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645686380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686380, "uuid": "a5646731-c6bb-4984-b9d3-3632da4eded0", "comment": "Malware payload (Mirai)", "value": "5186894c90f280070f2e782a8914ac31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686380, "uuid": "fcca7025-3925-43f6-90b5-9e1e4e00a8c0", "comment": "Malware payload (Mirai)", "value": "3ffdd0788daafa1c7458e8ddc19d2ae0893826c4b86146e24a57ac4f95cf0e75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686380, "uuid": "785aabe2-9a30-4378-8afe-3214129d08e1", "comment": "Malware payload (Mirai)", "value": "60e0026c309cb1469c63b4d556620e2f4008777c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686380, "uuid": "93cb2cf0-2ebd-4370-9240-e03b88e610a0", "comment": "Malware payload (Mirai)", "value": "706a385d0e07a8d0392edb614c6ac7f81791a8cb587a9c2b4e669675219a8fdeb51862876a8e4fbe0b806c61531f20e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686380, "uuid": "b90dc2c0-5d5f-4c2a-b836-07af5af3cb40", "value": "T1C783BF23C9641E54C24489B132A9EF3A83B3D695508B3FFAD255C62CA843EDDF1697F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686380, "uuid": "920931bf-d83f-44ef-8c35-127a97812a48", "value": "1536:opJX2bBOeHeL2bfdyTd4ZJ4RyiwOuKCJJqWKTqxzIEl2S5hrR:UGBh+6ZyTd4uMOuKZTsT5ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686380, "uuid": "7a57b906-1252-45b8-a930-c6338a6f1cc2", "value": 83304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686380, "uuid": "5ba0d8bd-d8d1-4300-9ca0-65dcc4743365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686380, "uuid": "76ee1592-0882-448e-9921-ef1accd1a075", "value": "5186894c90f280070f2e782a8914ac31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b50c424-9561-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645700618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700618, "uuid": "069c16a0-8cf8-48e8-816c-0ec7c94a29eb", "comment": "Malware payload (Heodo)", "value": "f8b92daacb7cc28c0bcc992cb0c0ac6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700618, "uuid": "6e99bb94-67c6-4664-a0be-b03a8c432caf", "comment": "Malware payload (Heodo)", "value": "40e84612fdc6dd4fc68d96c2a63945681eb285c7b599b9db46d195742efb411b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700618, "uuid": "082548d3-6108-4e9a-aeca-f55280fe7dd9", "comment": "Malware payload (Heodo)", "value": "7f75ca9bc2f26b3eaef32984efeced678e5d8648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700618, "uuid": "a02a8475-40d6-4cf6-8aa5-eee3017f1154", "comment": "Malware payload (Heodo)", "value": "fccd0574c3957be732fe1a61b40400def5b8eb0b4bd4547a3a3715ba50ecb7a6bcbf6b116a0d17d87180ed2084b39bee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700618, "uuid": "3bd8b971-7c47-4ffd-b488-0a4c2ef917e4", "value": "T1A5E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700618, "uuid": "3c89550b-4ecd-4941-9ebb-4c1c647515ad", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700618, "uuid": "43a8ae5f-bceb-4c71-954f-705e55a3daf6", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKpe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKpLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645700618, "uuid": "d1c76146-fabc-4e4b-9022-9c578f5c69c9", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645700618, "uuid": "8260a6b2-f3fb-475d-9be3-1459f97a910e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700618, "uuid": "e4562524-badf-4aa8-9d8a-5465b7e8c4d0", "value": "f8b92daacb7cc28c0bcc992cb0c0ac6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c331bbd4-9544-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645688310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688310, "uuid": "4b1cc3f8-7a3d-4a0a-9561-dffceab3a673", "comment": "Malware payload", "value": "5fe0d0dad7a919b9b47b0bcd9944f164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688310, "uuid": "68dc654e-954b-442f-9f44-594a0a0e0d45", "comment": "Malware payload", "value": "40fde29223b069264980b1ea82ba79803d51373eaca2bc5c949d657860ef5d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688310, "uuid": "eeb45bf4-249e-4cca-90f2-6204a8de25c3", "comment": "Malware payload", "value": "09a70e8b7129e72848183f0272d5ebb47fdf0dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688310, "uuid": "65cf24fa-9a62-40d1-aa78-a00d51cf3903", "comment": "Malware payload", "value": "33a59d309b0ccd7ed6f7af11491ed5e20519baeb303c25c4db5efe2c2e19c1c9a56c6bca33283282b4fefa24e771508d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688310, "uuid": "e16ff562-ac72-4c7d-b796-d4b342fd1a22", "value": "T1479428C5B4289081CEFCB5F1B8A2E95221F53CAA8DC3454D36F972361472A97DE0B52F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688310, "uuid": "46905450-8d21-4430-a78a-1eafea223313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688310, "uuid": "cc0ed63b-e904-4790-beda-c22d546453e3", "value": "3072:Wm4h7LCyDGmoRNyHXIQenAKo7MMye9zurKCy5bl0EBUUffNtWEivOOOJZoeVzYN/:Wm4h7LhEfAb7nC0WEG05iT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688310, "uuid": "40727c6f-dc11-4284-b547-a909de804f37", "value": 437720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688310, "uuid": "356ff88e-b6a0-4185-bb0a-42a851889f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688310, "uuid": "74f17917-0741-46f2-b4e6-444fc3720cfe", "value": "5fe0d0dad7a919b9b47b0bcd9944f164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d7dade-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "38bae36a-660b-46f0-94ee-610735b4eb64", "comment": "Malware payload", "value": "caea8e856a9b2dfeaa506b4c1357f23d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "ba1eaff6-d845-4c99-b41f-b1b93de78827", "comment": "Malware payload", "value": "4146352d158767d20e7e4547db226a374d9e4d36e8248e863960cfb37abd425d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "cf3c3c16-e8a2-4af2-8851-559faad176fc", "comment": "Malware payload", "value": "7057e731a3f34df659060e1d5ffee1489e4703ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "07129bc3-9290-4bef-9725-141fdcb227b2", "comment": "Malware payload", "value": "7012e4e2db0d76430f17501078f2a726316be5ab4f5630ebd0ab568f519228c17b550b390dbf3d03c7c55d452073795f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "e394732e-35de-493e-b61a-ac1a49dd87c3", "value": "T1C135BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "8b461b43-4050-46ec-af0d-69c94ee25b62", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "78ef5cdc-fd0e-4ecf-b74c-7fe49f7c607b", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+urVOe528JO6PC:6iRGcUY0UvDYNFtuJ5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738718, "uuid": "27f44544-1882-408b-a05d-916f68271e22", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738718, "uuid": "0ce77612-05e1-41a2-8aca-237432bb2171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "de87c5e7-801b-4eaf-9ab4-2a78fa57c85f", "value": "emotet_exe_e5_4146352d158767d20e7e4547db226a374d9e4d36e8248e863960cfb37abd425d_2022-02-24__213829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c83a510-95c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645744321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744321, "uuid": "6c127f7b-2c2e-475d-a8be-51fd31a71e01", "comment": "Malware payload", "value": "ecbbfe16c45e6cc8237a7403c3f4a9a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744321, "uuid": "254c52cd-b964-4a6b-bc7d-a646ae36a05d", "comment": "Malware payload", "value": "4168b9ba3fee3b75907716549daf6063b62125f5bdb4391a999f4f4abe3400ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744321, "uuid": "a7c84565-96bd-4188-93bc-97207c74d6e4", "comment": "Malware payload", "value": "694c551854d5823803c5c4fcc9fcd49d63139310", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744321, "uuid": "884c55a0-2234-43e3-b2fc-df0857b4e847", "comment": "Malware payload", "value": "369b05779de80c7953b382cee96621f701b7c6309cdecf7a7b175b1ef53299fe8a0f5b1885045b42ebef39f6d8ca974c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744321, "uuid": "e9d113e2-54a4-4cdf-a732-20369e1db60a", "value": "T14D35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744321, "uuid": "f9a5f72a-c776-42d4-82c5-710ecf06f5e6", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744321, "uuid": "f0884b75-70d3-45d8-b2fc-737e4a5738c3", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uKVOe528JO6PC:6iRGcUY0UvDYNFtu65Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645744321, "uuid": "2ffa4def-14c2-4b04-a070-66f5a85637ad", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645744321, "uuid": "2208adb6-5349-4feb-b658-b7dc9c153d9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744321, "uuid": "4b260d60-a7ca-423b-becd-437f86827bca", "value": "ecbbfe16c45e6cc8237a7403c3f4a9a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d75d788-95c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645742283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742283, "uuid": "46d42a83-df9c-4e66-973e-2dfbb8931d97", "comment": "Malware payload", "value": "7aca092b7a48dfc612f199fc2637a755", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742283, "uuid": "8e40619f-d848-46bc-981e-84a1d85c7863", "comment": "Malware payload", "value": "41dee6e8239bd9670400f9741183e639f9a27a1cb664cbba924c31b79d09651a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742283, "uuid": "60e611ad-ded3-4229-9792-8ec1dc441473", "comment": "Malware payload", "value": "5d9250ef4c10fef35975ed90ff55ae8cb287193f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742283, "uuid": "14a7c4ee-cace-4bc1-a57a-b985561fa193", "comment": "Malware payload", "value": "b3cb5ba348895793b3ced9fbe4922440b956f655d668e84c35aec709ce6e1d54ae15f8de0722d73d06f00b9b41cd3892", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742283, "uuid": "59a37b60-7fcb-4b3a-bf73-f25c4d7375c8", "value": "T1F135BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742283, "uuid": "f5ddd580-dc11-4746-88d1-5324573e769f", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742283, "uuid": "6e85c7fe-be80-4a61-9c3c-c897fa483ea1", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+ugVOe528JO6PC:6iRGcUY0UvDYNFtu05Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645742283, "uuid": "2c03845f-cbb4-44de-809e-f624cc1a274c", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645742283, "uuid": "44221305-8c65-4d7c-8402-4ade3cae4898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742283, "uuid": "964694bd-6a16-4c4d-9dd5-1ed8d3706937", "value": "Pzggws1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995ca4bd-955a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697689, "uuid": "ea81026f-db0d-4a87-aa5f-2d4cdc289098", "comment": "Malware payload (Heodo)", "value": "172835ce6516e0e7014088c38aff70c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697689, "uuid": "0408a5e0-e909-4f23-a1f6-95f49d4108ea", "comment": "Malware payload (Heodo)", "value": "41e2aeae843da49476a479489a5e30ed3a0d86e620916288156e29596ea3ec19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697689, "uuid": "85ef717a-0c97-482d-8367-275458094974", "comment": "Malware payload (Heodo)", "value": "bd8a082a5e49f7ca81316780e5f0bb1e5e54b561", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697689, "uuid": "ebca3e4f-58fc-4b8a-ae82-8902a5cf859a", "comment": "Malware payload (Heodo)", "value": "db15121975b2ea729d6a0d2fee6b704b58de4c1e021db2f685b83f66fb448df6c681b7078923978676a03272dbf54b35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697689, "uuid": "f186f812-62ab-4663-a751-d708aed7aa79", "value": "T186E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697689, "uuid": "18e5f500-3c73-4ed9-a8fb-f5c4cc3f2bda", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697689, "uuid": "26aa3256-03b1-4e44-b1fa-b31fdacf753e", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0ZhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfTPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697689, "uuid": "cba6a9d2-9904-45cb-a56a-6251d0261a28", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697689, "uuid": "3b8a9e27-7a88-430a-8dd2-ba9ddabfb93a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697689, "uuid": "9aa91fc3-9395-4485-9c8e-39f53656665e", "value": "172835ce6516e0e7014088c38aff70c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237f8f52-954b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645691049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691049, "uuid": "b1257e76-7dac-4ab0-b661-e6edb467c9bd", "comment": "Malware payload (Heodo)", "value": "f31e5625ae83477f06224e9f471ac87c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691049, "uuid": "09131cce-55d5-4c8e-b84b-f8e3fd0f497b", "comment": "Malware payload (Heodo)", "value": "4213677263ce404cc1aeaeb948d85eeb372c93d5a72b690f674bfbbc10dedb39", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691049, "uuid": "ddfc2d16-1520-4888-bd60-311a11721889", "comment": "Malware payload (Heodo)", "value": "cdaa852dd05fa0251289fadb317004cbeb7f8935", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691049, "uuid": "00bd37a8-9849-45fe-b3e1-e3b834642f3f", "comment": "Malware payload (Heodo)", "value": "1d050c174f8d2716209eeec9380bccbc9345e3d829d56b0e0800847ccc7d83ba50c4ae31f2776a9305735207f653913c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691049, "uuid": "c27ee47b-3cb8-4014-b8e3-771556e7bbf7", "value": "T1ABC3BE5AB21EC86DE965873048D747EA2737EC110F6F4B873A49B3227FB89904B1351A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691049, "uuid": "b432218b-eb86-49b9-b8d7-a4737c9d8337", "value": "3072:DvKpbdrHYrMue8q7QPX+5xtekEdi8/dgWyVEBB06h2bclliEQjfxn:LKpbdrHYrMue8q7QPX+5xtFEdi8/dgWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691049, "uuid": "ccb6235f-2860-4422-82c2-cf4160ca4303", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691049, "uuid": "998583c6-96e5-4cdf-bd55-25e6527e1325", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691049, "uuid": "5e65bcf1-f193-4040-affd-9ca20c034e42", "value": "MAIL_24022022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a79a88f-9556-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645695812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695812, "uuid": "096143f4-7c35-418e-b055-c88fd5e77889", "comment": "Malware payload (Formbook)", "value": "13f324601cd77d2f5369569c714ce00e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695812, "uuid": "83ee713c-f7de-443e-a8dd-9b0e0f59c31b", "comment": "Malware payload (Formbook)", "value": "42ee860737cc1e3f739b7948fde16d6f2e2e3014e9455c48484adbe4cda6c6eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695812, "uuid": "4e4a9e59-ad91-4b6e-9ec1-416ed44af3e6", "comment": "Malware payload (Formbook)", "value": "5256a4d90991b45f41fd94451243c75034c621cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695812, "uuid": "04120fe8-8c1c-4883-b8d1-618211ba1629", "comment": "Malware payload (Formbook)", "value": "996429f7ab1d2c7578f2f4ab1b5e506ef1625279a7ae5cd9a00ed74a54bd85b9d8e58befda087ba1f944e8ebbff9b044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695812, "uuid": "4153a01f-0fa3-46cb-91aa-766b9ede9a99", "value": "T1A015F1A9F3B95CA5F05B91BD9876D8311133BE5AA5278A1E325E311E08733C250B3F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695812, "uuid": "06c08713-b5ee-4398-9a53-df04e5e8cf02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695812, "uuid": "c7c9b50f-9d95-4321-92d8-b5200424d757", "value": "24576:wJORFPgWmwvTaUTGlcU5zpkgHp3AbhG42db5:N7P5xNG75Vk0V6G4EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645695812, "uuid": "649074c0-a468-4004-ac88-9ff9cfc96342", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645695812, "uuid": "9f7e37cd-0ec0-45d3-bcb0-d1ed91bb1db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695812, "uuid": "4463534e-4ad1-42f3-9901-2fa6a2cc0139", "value": "\u5217\u8868\u548c\u89c4\u683c-SAM-JUNG CO.,LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f37ba3d-957b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645711657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711657, "uuid": "4fc3c190-668e-4dc1-befa-d619c8e98dba", "comment": "Malware payload (Heodo)", "value": "777dc56cd1c2eb02d2877221130cf40a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711657, "uuid": "38a75c18-d5bd-41dc-8bfb-01fc4acdf24b", "comment": "Malware payload (Heodo)", "value": "4331714c351448e8dcd9820900750a40ca1317d122997368a8be752ec2b6bdb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711657, "uuid": "1cae7805-6ac3-4d38-afaf-b60040c8d30e", "comment": "Malware payload (Heodo)", "value": "d5e0e7bf9a1913f97f5f0c1a47bb0b3c519483ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711657, "uuid": "9ccc3b86-622f-4993-9f83-b6397e5904ef", "comment": "Malware payload (Heodo)", "value": "a0190ad5cf39cf2ef508447a8e7c489a2330d8afcb7081fa65319fb59e2c67332203fc49a4ea91a87eaa020175b59773", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711657, "uuid": "93926280-98aa-4bb1-8cc8-195e54e5527b", "value": "T10AE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711657, "uuid": "489006b4-3e28-4664-8249-02d8860a80b6", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711657, "uuid": "eca47f95-bc0b-4f20-a43f-2ccb3ee118cd", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XxsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWxa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711657, "uuid": "0bf42808-8ceb-4310-920d-0b45e369c0d2", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711657, "uuid": "902128be-41c5-42e3-8218-ee91e790ca5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711657, "uuid": "dcfe43a9-d56d-4e2a-bccf-385fcd4db457", "value": "777dc56cd1c2eb02d2877221130cf40a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690e11e3-9563-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645701473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701473, "uuid": "dccb768f-6a05-4819-8ad7-7241b70f42c1", "comment": "Malware payload (Formbook)", "value": "17d45a70868fc97f156e1bf612091018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701473, "uuid": "1f946015-a503-4787-9c82-7f9e8c23255c", "comment": "Malware payload (Formbook)", "value": "43d06e86f98619000a7cc9600f95da73794070c1a541cb5cec13835600631a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701473, "uuid": "662d77d6-0634-4f7a-9ca0-b0ad16dd601a", "comment": "Malware payload (Formbook)", "value": "bc8111f9b1ab2f90fa189cf1ae3645c4c3ddccb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701473, "uuid": "44e1065f-a21d-4b83-97bb-683ca5577a32", "comment": "Malware payload (Formbook)", "value": "cd71a8af8c9be98f8902cf0815ab2fa84e6b4457d05583fc2a78933e68d6e26a75d1766c09d0ab70dae054934321db39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701473, "uuid": "6f19218a-5e73-45da-9394-720656fff0a0", "value": "T1D8F4AD1024AF66CDF0769BFE1DD8A9B18ABAF53A3508F2BA1C815EC70751B41DD01A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701473, "uuid": "4bc2836b-18bf-448c-bad4-3830cd2b5240", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701473, "uuid": "c70e6e4e-75e8-41eb-b590-68b57dd0992c", "value": "12288:TRfCEJgYYz0lWZeJIxHBAfaJiXXnZKraxliRQT2eE1Dltml1IrwD/rywO:s9kbJgHBAff5Krk+G2eE1DrESEzyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645701473, "uuid": "1308dedf-ea44-4a80-960e-7e2fde0156ee", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645701473, "uuid": "acc2a578-7eac-4723-95c1-aaf559d76fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701473, "uuid": "1f5a92f9-46f8-4dd7-9948-b5b035384976", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.5815.21038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b75332-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "b4e8a16e-bd9d-4f25-8b77-3292ba6caca9", "comment": "Malware payload (Heodo)", "value": "30e47e3a2ae3a5a48d856d921125b5bb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "2787f3b3-78b8-4249-8114-368e7d123bac", "comment": "Malware payload (Heodo)", "value": "441b24956fa3d9490713f5ba6a470dcbd4581da3f5fb95b9e4cf7820861ee22a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "277d7943-9898-4dd9-aad7-826a27f766bc", "comment": "Malware payload (Heodo)", "value": "04ff07d9e1b029738f038b8c5c5e28a5e0d788b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "7c6fcd17-197c-4d25-b691-8f9141fd7e58", "comment": "Malware payload (Heodo)", "value": "ff8e2c4ebe504977df61f66a3e5355fc0854a6041c1a108a3e591a9af4205f8f73d666308e3eb3c7c2d8fef4417a0d38", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "7f2a1827-a231-451c-a0f2-61d102c36102", "value": "T1F9E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "da95c022-d3dd-4d94-97c8-a776da9cfb1c", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "9dbbb13d-029d-4d44-a47a-c4ede2c2ea3a", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0thR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfTPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660963, "uuid": "8c2cad41-d130-4260-84e3-5058f5adba85", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660963, "uuid": "ae01800c-ef48-4cbe-aeb1-1f1f98406cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "0382eec0-abe6-483e-a5a7-36d43be199bd", "value": "emotet_exe_e5_441b24956fa3d9490713f5ba6a470dcbd4581da3f5fb95b9e4cf7820861ee22a_2022-02-24__000236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f36b79-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645723294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723294, "uuid": "ae9beee0-853e-423c-88fc-f181ef6c1c6e", "comment": "Malware payload (AgentTesla)", "value": "86ae9fb7f6a5e36cf507619882594a59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723294, "uuid": "4e255d08-bc67-48c5-9b52-d2e87b2f3cdc", "comment": "Malware payload (AgentTesla)", "value": "44b4e35c8353531544436c46eb064cf3acfce04f6f1d4691ac5d518e67e8e6ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723294, "uuid": "aa2c97e7-e041-40fb-892f-7fe48aeddd3b", "comment": "Malware payload (AgentTesla)", "value": "51cf63a673f71b88a350359a3de08224b7cbac52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723294, "uuid": "545e3d33-96f4-4a97-91b7-1875f0ed1650", "comment": "Malware payload (AgentTesla)", "value": "c0a845aba1cc16cacc76a42ce7d2b998c2f01c0fd75cc1eb3264ae0dea7b39333840bc6f73dbaa2af9773b253d78e669", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723294, "uuid": "d617ad98-56e2-47ab-825f-f63df8779e7f", "value": "T12B141224BD39D22ECDBF29324BA647588FF9DD0722A1E81D905BF70CADF8855B01AC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723294, "uuid": "b4047f35-5a7e-4c9c-99b4-a0a2f12cceda", "value": "3072:aQ1E5eb2vFHNu2046wpnwSY/p+2U8HpdwxioFjuTU5HnrUfjeKm7HeYhrHCZbybA:fE5eb2vZrDpwmAdwxD/nueKm7+UblQW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723294, "uuid": "0fbdbdcc-847f-4f16-be3b-8da497fc47e7", "value": 190424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723294, "uuid": "9ed5352c-8cf1-41f3-b724-a76c64b98dac", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723294, "uuid": "33aa859f-9845-4171-a39f-fbe7d706b3d0", "value": "EUROAUSILI RFQ PO1098019.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09846119-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "844d15d0-8963-4ca7-89ae-b2fd0106dcd8", "comment": "Malware payload (Heodo)", "value": "9fb7b07fac1e45af9a65ff420dd959e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "0220d6f1-e5aa-4821-b3fe-47d81c5a38ff", "comment": "Malware payload (Heodo)", "value": "44bf377452c3d6c2e10cf32e4d8b7dd165794fc27413ea16dc2dd20878014655", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "4263d8bf-ef3c-476e-9a42-277e0c6b5fb7", "comment": "Malware payload (Heodo)", "value": "008a8d6b081f88881067787eaf6c2a18f4727a3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "d6557519-43ab-4d2f-9954-cf78e77b16b9", "comment": "Malware payload (Heodo)", "value": "379bce6a8b3174bbc86c2513a94443a259685bd07e88d88ead56b7aab6ed8679bb58db7f7beeff8591b86c93288d4f0d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "80ce257b-e451-40ae-96fe-3209b662a748", "value": "T17CE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "34b6e0b1-4fe5-412d-872c-ea575476553c", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "4ecc9657-31b8-45c5-b25f-94ea4e4630da", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKSe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKSLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660940, "uuid": "c50eebc8-709e-4174-939e-0f4d1593e97f", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660940, "uuid": "83db9d0f-0e4d-412c-b3c6-596ab5319232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "cf67a6a7-36ca-4afb-9901-2f5016d1473e", "value": "emotet_exe_e4_44bf377452c3d6c2e10cf32e4d8b7dd165794fc27413ea16dc2dd20878014655_2022-02-24__000210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd494545-95b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645737370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737370, "uuid": "11b3c839-ae3d-40da-bc66-74196a3d67f0", "comment": "Malware payload", "value": "6c8bb767d16ffb06382c22ebac63deb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737370, "uuid": "c0f38034-6bf2-49db-8beb-3c4fa753b527", "comment": "Malware payload", "value": "44c28519f942d16595987071f31b39ab143c80385d25d81163616b09ddf7ec20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737370, "uuid": "a0889141-42a5-4974-bb4e-1d524cca861e", "comment": "Malware payload", "value": "5fddcd8be5abc0e3496e0c3547d672065f294804", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737370, "uuid": "86000e86-548d-4839-b20e-c6fe473af0aa", "comment": "Malware payload", "value": "133697efb262c0c16aa8435bc3c691340a245b467ca599d2b0de7ec269e5ed4433579398d898457efa84f03e71a0960b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737370, "uuid": "adeb500b-d0ae-4190-805b-da404307c69a", "value": "T1F4E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737370, "uuid": "29ebd6a7-1844-4517-8e0f-9434eb4361c2", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737370, "uuid": "cba8d994-a47e-4cc6-855d-517760215f5a", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0X3sD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFW3a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645737370, "uuid": "e49683e8-b252-4013-b65e-aefad2e0aa91", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645737370, "uuid": "6cbdf259-6502-424a-bce0-467b00e3a0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737370, "uuid": "502789e4-a768-494b-9b4d-3c96158b50f9", "value": "6c8bb767d16ffb06382c22ebac63deb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbdc21e-95c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645743329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743329, "uuid": "f3128a34-5b85-4d1a-9c5f-9953d21826e9", "comment": "Malware payload", "value": "59aa541baf3a0ea6ccbd845c78d10812", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743329, "uuid": "ba453737-1ac8-4a2f-b730-d0f561d72355", "comment": "Malware payload", "value": "460bd4a42144fc253aea974de46bfd13259a0ded478990383efa595bf96b32a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743329, "uuid": "a3d8e011-72c8-4e8c-b943-97c0d248d329", "comment": "Malware payload", "value": "3c418d083d43d964d3e2b6042e788784a495ef03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743329, "uuid": "d7f66abe-e4d4-43a3-8944-510f7ca40888", "comment": "Malware payload", "value": "8df68c92362f7b7fd8d3412566bddd4c6e31c24817aaf5f482744773c5b5ce223a3843302ea133078065c5a965e0cada", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743329, "uuid": "8c6e1b73-d0d1-4bb9-99b8-1a954a4fd797", "value": "T19435BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743329, "uuid": "b077fcfe-0774-4faf-ac98-39268294b41f", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743329, "uuid": "641e1488-2fa9-40ea-8215-4d3bb2d24d7c", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+usVOe528JO6PC:6iRGcUY0UvDYNFtuw5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645743329, "uuid": "307c9861-25f9-4681-bad3-2de8ee1c37ef", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645743329, "uuid": "84e66a69-7153-4bf4-8899-11943c36ed26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743329, "uuid": "1057d789-b970-4587-a86a-da69ca6dd5dd", "value": "59aa541baf3a0ea6ccbd845c78d10812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc284f7-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729076, "uuid": "59c8df5d-fc1d-4ba5-a0de-97a5fbbde6f3", "comment": "Malware payload", "value": "dcce1e35a08c79f9d3f53522e6f8698f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729076, "uuid": "2cf4a08d-70c3-4b9b-b9e7-0858214d5b99", "comment": "Malware payload", "value": "46692149c30597743951c8cd2ff5201897bc42c6a7ff20d9d8127e86d4484450", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729076, "uuid": "85e0030a-e184-4272-a15c-da57855949d4", "comment": "Malware payload", "value": "6f99c6d7ba180d912fcb3ff762ad4f93218185c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729076, "uuid": "c21f83ad-21f3-4456-a7b3-a57440d2ceb8", "comment": "Malware payload", "value": "120fae3425f7d99caf633c4f28301a51d49dcf64c6edd9f89f33678db8e7290e27bdbe6d05e6aa0949bf5be8e9b64323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729076, "uuid": "42351cd7-cf3a-48aa-a6cd-9592d49021f9", "value": "T180C401E03941E439C0443A349466CFE0976EBC21C9245A8EB6BD3B2D7BB23D1667935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729076, "uuid": "95df0352-6737-475d-8723-34edfd6d33b3", "value": "c4af30a83bf15d312d21af9c14569a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729076, "uuid": "1689b221-a2f6-4b97-9158-a33f493d8790", "value": "12288:0O6XHUIhXh/AeUWEXCCOL0asA/yKH7udX:0OmUI//3UWoCCY0jA/MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729076, "uuid": "350392ef-6582-453d-b6f1-f836a6826163", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729076, "uuid": "3bb055b7-d232-40c5-83cf-ad004453937f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729076, "uuid": "745a1a3b-23a6-49e4-a48e-da4e30ed870a", "value": "dcce1e35a08c79f9d3f53522e6f8698f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26af88b-9581-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1645714535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714535, "uuid": "eb036a64-a9f8-47c5-95f7-d63a339c728a", "comment": "Malware payload (LockBit)", "value": "5490dac4a534bfa3743431a6b9a38f33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714535, "uuid": "c7bc53c5-c54f-4576-a722-989a45d721b9", "comment": "Malware payload (LockBit)", "value": "4672f4ade47a4717255db6bcd9ae1fb6f4d71e85d059bb08e65df55d416126eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714535, "uuid": "66adc9cb-838a-42bd-9fce-0fc5dcf06e96", "comment": "Malware payload (LockBit)", "value": "0c009af152ebf2859bc0d6bc8ee10be70aec519f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714535, "uuid": "4baa78e8-6419-4f51-9078-1ea660fc73de", "comment": "Malware payload (LockBit)", "value": "a369e19492c1a88318eaf0eb0061a4b859b1319860708ef641c9c44c9caee1206015e37494d91109e0afbc5bbf9a474d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714535, "uuid": "68668afe-6c0e-40de-a496-06ca4a344c53", "value": "T10B253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714535, "uuid": "63ce9193-c01e-4720-91f9-ce6718e23869", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714535, "uuid": "16153476-f321-4583-be8d-50ac8f6f1997", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdbF:Ujrc2So1Ff+B3k796F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645714535, "uuid": "8f3ba891-88e2-4e68-a5b3-890e5e9c9743", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645714535, "uuid": "c8d990c6-9111-42f6-82d7-0b658811345f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714535, "uuid": "e492a27c-5871-46a5-9128-469c94aff93d", "value": "4672f4ade47a4717255db6bcd9ae1fb6f4d71e85d059bb08e65df55d416126eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891f4e89-95cd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645747054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645747054, "uuid": "b0f000ae-1dd3-4ade-a1ca-eedcf1c0296a", "comment": "Malware payload", "value": "ef82b4ba6d65b01e5aa2a8b8954daf95", "object_relation": "md5", "Tag": [ { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645747054, "uuid": "a9572af9-192a-4548-8e73-f30751642d17", "comment": "Malware payload", "value": "46fe388157577131da95df816df6d1c4ef8e104277d9e01f25005ea55789a477", "object_relation": "sha256", "Tag": [ { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645747054, "uuid": "1e4f1394-c9ce-4da5-b79f-54d2d2b2f8a4", "comment": "Malware payload", "value": "e9ddd57ec28ac4de14a20bd48494f74adde27160", "object_relation": "sha1", "Tag": [ { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645747054, "uuid": "1513e427-9cee-4acd-b731-bc41b490a2c5", "comment": "Malware payload", "value": "ece8274f24bb0dcf53e8ff0a36f8a16e5ba787737fe0ff012a4195956db3bab6311cc0e498deec478e9ed5ecea5193cb", "object_relation": "sha3-384", "Tag": [ { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645747054, "uuid": "e44327a5-6abe-4a3c-bc06-b366f45fc1c7", "value": "T12E544B0027EC8B9AF2FE4BF8D4B01265C3B1B566B93EDB4E5D4461DE2922340D945BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645747054, "uuid": "a965a90b-5b47-46be-9d59-d36301a9f0f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645747054, "uuid": "a946bba8-250b-417a-b6ca-919416a8e65d", "value": "6144:Ef+BLtABPDOZJc9VjFe6Ulw01alYDRlA1D0AP6:NZqA6UlwHlYY1D36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645747054, "uuid": "5c50cc84-88c8-4d1d-9e6c-352dd98f1b79", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645747054, "uuid": "bc663799-2567-4a62-9497-75c318276e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645747054, "uuid": "41540b9a-daab-49b9-b6ec-161cffcbbb25", "value": "V00789hs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3c6891-95c1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645742064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742064, "uuid": "63944460-4ccb-4d53-a5f1-e20b1363bf7a", "comment": "Malware payload", "value": "f69351c2b1455b5e898a36eb484a513d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742064, "uuid": "ff7b2945-7922-48c3-9fa3-e52ebf725cfd", "comment": "Malware payload", "value": "4762820195209f3af60e3668cb3158737911111bd6a477397e2e4a8edcd0f659", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742064, "uuid": "e362d31a-da11-4f8a-abdc-3f3ea5a24d51", "comment": "Malware payload", "value": "5f823b5c9cc618a864917bcc780989b028ddf32e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742064, "uuid": "8f1bef6b-f215-4675-b738-62fdb3835893", "comment": "Malware payload", "value": "6de394b966e7547557904e76eff611837dc80b512bef9e1d60c3c7fab25245bccd6319d5fe54a03fc09095f6a2d71937", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742064, "uuid": "c91ee709-a4aa-4a11-a311-531c1f7345f3", "value": "T16A35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742064, "uuid": "2ad5b51e-5bdb-4989-9e49-a063b3072dc4", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742064, "uuid": "46dbcb99-b1b2-41d7-9d48-af531a8cb789", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uDVOe528JO6PC:6iRGcUY0UvDYNFtuh5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645742064, "uuid": "39cd137d-0f09-4314-a8ac-00e7b4806cb6", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645742064, "uuid": "4c93a224-8780-46ac-94de-decb1ed7e2c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742064, "uuid": "6b331d40-72cd-48b7-ac1b-6788ff098ab5", "value": "OrlKoamn6APFiictQW.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5faff9fa-952f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645679124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679124, "uuid": "169803b4-a36c-4793-afce-326b95b18572", "comment": "Malware payload (RedLineStealer)", "value": "be2f48f37ba90e34b1d26ed080c3d0bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679124, "uuid": "8312d7af-647e-4c12-9bdf-8d5300ad9bad", "comment": "Malware payload (RedLineStealer)", "value": "480427092e1dbc18897a159dac8d98cfad92fb3eb2a16b90d75e0b5f75ba4568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679124, "uuid": "133ef2ea-651d-4f69-b228-16aa544a0eb4", "comment": "Malware payload (RedLineStealer)", "value": "13d60e78b2d8c180cbebf59d46bf9a090dc378f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679124, "uuid": "59539e2d-c691-4c1e-b6cc-e7e005c50c09", "comment": "Malware payload (RedLineStealer)", "value": "3c5581445133a094b309b16da9356afdb9e5ce11e9c724e6a40b3c418b951a1dcf0be825d89b01bd25ac52fb51a11bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679124, "uuid": "2e5d77bf-bbdf-438e-915b-00fff9eb4d0e", "value": "T18A7633CABF54E1DDD47B607CDC19580D1FA0A8762D2969046CA304ECB398BA48D53BFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679124, "uuid": "f41f8da1-13ae-417d-8b4f-43a5a42820a8", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679124, "uuid": "57fc1461-66e9-4066-a28a-ea6e2e4acbd8", "value": "49152:G9VXiaWDD0Pd9Wvie7DBJMdVlOIqjrODzqNCU/ao/WNaYdN:GjXz2D0Od7DYdVsmyaoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645679124, "uuid": "2053df8f-9e06-46b9-b9dd-6baa4a2c9c25", "value": 7590528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645679124, "uuid": "4716fff7-0c55-4dca-a21b-40aea884f1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679124, "uuid": "9be3fe0c-b40a-44c4-b4cd-bd807169f3ba", "value": "psiphon3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13dfb1e-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694347, "uuid": "95be2d43-2c9e-464e-8060-ee384dc66e09", "comment": "Malware payload (Heodo)", "value": "c9aea19cbdecd2eef3a7b6a2915f5e70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694347, "uuid": "f19d7743-09fa-49ba-ac40-3bfb9159641c", "comment": "Malware payload (Heodo)", "value": "4854d41adbe587ea1ae406e5b680eb9f916d6c9edbfc155c05ec787e488b6ad3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694347, "uuid": "6cffde73-0c71-40a1-a03e-14fc68686a22", "comment": "Malware payload (Heodo)", "value": "bd8294b9f80a592bc21e6c4b0b6bb9629b196672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694347, "uuid": "f126ba12-285f-423a-9485-6ef172c75c71", "comment": "Malware payload (Heodo)", "value": "c8f458e93c13c76cf9f245a67919385bc866f57bdfd2b0e2bd0319813066d412225974d2316cddb72bd2f622b19e07ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694347, "uuid": "5d05c511-abd2-4bfd-865a-45262818df21", "value": "T1C6E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694347, "uuid": "51feb2a0-5b13-4d40-beff-47c0c9b842ca", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694347, "uuid": "b2f50a4f-391b-4563-8c25-911ae04b3d82", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0hhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf7PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694347, "uuid": "3d94c0ad-fbc8-4e9d-99a9-2cd3823531fe", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694347, "uuid": "34a17fdb-79ad-47c7-9872-25624dd30792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694347, "uuid": "9d243c0a-9f7e-4d0d-a2ab-33cd956a00d0", "value": "c9aea19cbdecd2eef3a7b6a2915f5e70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6b06fc-9542-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645687544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687544, "uuid": "12e694f1-f691-45c6-8fa4-c6e6dc202289", "comment": "Malware payload", "value": "33f7383c2eb9b20e11e6a149aa62dea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687544, "uuid": "e2a9a87f-6d3b-4a6c-89df-ea1532987421", "comment": "Malware payload", "value": "48566d4882de227e772721d6c39c0a0579dd38ee81532687135427a30bfdf33a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687544, "uuid": "fe3ee3f2-c4f7-498c-903e-f572dca79aac", "comment": "Malware payload", "value": "c42074929714acf44046e255a473bf5bc54f1ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687544, "uuid": "c173d1ce-8ef9-45ce-92b9-9e1420edd1d0", "comment": "Malware payload", "value": "24296b3706a09198873d71325347f7375ece8fd1405f7f87bfd5af2574f4dc1d958cb6150b161f36677eb782b1589d65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687544, "uuid": "368b1afe-9dff-4b1b-90b8-62da2f541572", "value": "T1F275BF0AA3A841F8D0ABD178C986964BE7F17C461231979F16E45E9E1F73BB01E3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687544, "uuid": "2ce90fc2-534a-4cd5-ba5c-7576cf993b04", "value": "23e911f9a82ac0d345fa6cc9104b6bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687544, "uuid": "94bc087c-46bb-47de-b716-3ca84a92d105", "value": "24576:VsSVUSfhBg2YcPTv9V4ddoCaL0DrQsDh9lEweiy9Q/qNy2s594Wf+LxoA8ZPo+Zn:fJ225HL6QVwa9OqNOm0Po+Z1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687544, "uuid": "b13bbdba-2f82-4fa9-9f57-f1cdfe8c9dd4", "value": 1701376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687544, "uuid": "f3556954-4cb0-4ad8-8516-853cebc0bf1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687544, "uuid": "d4cf8190-f216-4a9d-8d1e-a1b5da107e4d", "value": "siww1053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4ef09e-957b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645711758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711758, "uuid": "47da543e-4f6c-4679-92ff-2d16a085394d", "comment": "Malware payload (AgentTesla)", "value": "85042534096259dad5042659a6a31f52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711758, "uuid": "fc63a643-231b-49b9-b856-bbb17c54fafa", "comment": "Malware payload (AgentTesla)", "value": "487f11fdd241fe6a9217ab15a7f9731950c0fcdd0646f133d61b0d64126a31ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711758, "uuid": "d7c4ef5a-c5f7-4314-bb08-6bfb3469cb6b", "comment": "Malware payload (AgentTesla)", "value": "3623d7c19569dfa1c4bf387c6b7c64d39ad55304", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711758, "uuid": "9d6f448e-5213-4188-8a9d-eba933b3576d", "comment": "Malware payload (AgentTesla)", "value": "88207e299fe60c0dfc5afa19e5e49481cad052ecb9f8a37385d0f1a2409d8c6eae8f1182e4192a7bb9c728d152dc90ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711758, "uuid": "b4931cfc-60b9-4cd4-b265-24a660f23602", "value": "T16005BE6024AF6ADEF0369BFE1DD8A5B18BB9E53A3509F1B91C811ED70741B40DD02A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711758, "uuid": "78ed40fd-f478-41c2-84d1-9bd19cb6373c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711758, "uuid": "328358ad-a988-409a-ad00-17b486155562", "value": "24576:t9KW6/AOchlJ5XWPWnEOxjbAxKsnltFrNUK52:XV6YvJ5XxZbA8slDNUK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711758, "uuid": "78260185-a352-40fa-88fc-95ba859ea51c", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711758, "uuid": "e5c9bb11-3e42-4bd5-83f9-8f3028e4631b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711758, "uuid": "6de9a2e3-1733-4d04-b5cc-dd301c5bf4c4", "value": "Re QUOTATION-24.02.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0135f18-9557-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645696412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696412, "uuid": "98a458d6-660d-4a39-9495-20811a03a6ee", "comment": "Malware payload", "value": "ffcdbff28189a5f659fd8f58eab21583", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696412, "uuid": "457e8561-cb01-4d6c-9a01-be0b4a711dd7", "comment": "Malware payload", "value": "496213612d873633a80320bb3422b44d21edb064953110e86ec09f1c7c5ec87c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696412, "uuid": "31684175-409d-487e-b89b-809aa94067df", "comment": "Malware payload", "value": "dcbf1f5ad58787188de9828d8d4089245d64eadb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696412, "uuid": "b28cd787-b10d-4587-aabf-20ddf9affd72", "comment": "Malware payload", "value": "44ddc50e122fb0a03793e00b6fba17bc7a45f8189ae7c69190220b865c1f09ce87a5bd635abbbc936d3f21ddf0cdaa57", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696412, "uuid": "0e7179e2-9cff-482b-9a69-51d806ea1ce2", "value": "T1BF82BF3DD882B12FC156547D846412FBE34600C265C2E5AF58C6BFA7170928F8B9EF5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696412, "uuid": "f3e9fae5-0d1a-46eb-b49f-e88a77883f76", "value": "384:dW90BdNe7UNdtkz7/CEmsexjQfjISqVtc119Wj54:uGqANfkQxC1U6WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696412, "uuid": "4144d5ee-58a4-4200-869a-5ec690c47909", "value": 17695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696412, "uuid": "58285018-c282-49b9-b15e-b68c24e853f7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696412, "uuid": "c6151c1f-b203-4647-90f4-2bd076d98fd4", "value": "496213612d873633a80320bb3422b44d21edb064953110e86ec09f1c7c5ec87c.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b124fc3b-950b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645663799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663799, "uuid": "ad3e28ce-3b71-44e3-98a5-bb23cf864b28", "comment": "Malware payload (Heodo)", "value": "27a4b8f548ae158d56df07fd22e7f0fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663799, "uuid": "72a4868c-27e2-4f09-b974-6308ef26e33b", "comment": "Malware payload (Heodo)", "value": "49c4fee9854654aecbe1c839c4995e0e448abf879ab8a921247cc99290f33dce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663799, "uuid": "73624e73-78ec-4680-8d97-dd23b731455e", "comment": "Malware payload (Heodo)", "value": "c7198c9c231312ac7d1d65233d6cfd8abccf0476", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663799, "uuid": "b71b633a-337b-48ee-9c09-03653829a772", "comment": "Malware payload (Heodo)", "value": "9edebbbe4a9521b95984400c1eb918d98ca0e195b549b7087297507b844552396fccee3622720f4c97412dd6061c9120", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663799, "uuid": "db52307d-3b0f-4036-954e-e3f2c55b83e2", "value": "T19AE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663799, "uuid": "3c01b7f9-93d1-417a-8e14-cb35a79cda92", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663799, "uuid": "ad39aa43-fa77-45ae-9795-4eab1426c818", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKfe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKfLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645663799, "uuid": "6f78f57f-c7b6-40b1-8719-60c0b6a36497", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645663799, "uuid": "38cbbef6-179b-4eac-9e18-a83d7fb213f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663799, "uuid": "920363b3-72e9-4c6b-97db-137f06233ebe", "value": "27a4b8f548ae158d56df07fd22e7f0fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834ff9a5-95b2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645735448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645735448, "uuid": "5ee18af8-5fd5-4072-8850-98a62b669905", "comment": "Malware payload", "value": "6f9e9a672e70d55eb65cc742cfd034cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645735448, "uuid": "cdc5103b-4fca-4df8-83d8-eab7cce640a6", "comment": "Malware payload", "value": "49d3c5f81c3da22878684b7ab8007dc0f5c6f164a8c0360eac03e7740504fb2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645735448, "uuid": "64e92bbf-c314-4509-91c6-c27ff81b11a8", "comment": "Malware payload", "value": "adbfc45ba65dc60a65c7338de99f42cc9fa84d7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645735448, "uuid": "e89fd386-8a65-4a88-a169-7a027b121543", "comment": "Malware payload", "value": "3d7b75a1ff434ab299e2106adf0204a4e40aa0c589ce3a2e9d0136f6765171b2b9f8ca2b8f11a666654db87db88c348b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645735448, "uuid": "5b0b113f-39a1-4360-91f1-0002c37c4784", "value": "T10AE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645735448, "uuid": "52595e4e-533e-43f0-85f9-eafda336562a", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645735448, "uuid": "b567e678-251a-4015-96df-bae3357537d1", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XMsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWMa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645735448, "uuid": "dfaa1202-c481-4fad-9c18-99a897395c6c", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645735448, "uuid": "9e8dff0f-5346-4193-90d6-292313d873e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645735448, "uuid": "d66717ec-f145-4a3b-ab2f-b4d2f1c81a48", "value": "6f9e9a672e70d55eb65cc742cfd034cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fbd968-9561-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645700643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700643, "uuid": "5297f397-0dc1-47b9-96ab-d784a4844cb7", "comment": "Malware payload (Heodo)", "value": "6a7cad841d765e29964d7b8af32191f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700643, "uuid": "6a03bc2c-2350-4fa5-aa9d-ae5fe092df75", "comment": "Malware payload (Heodo)", "value": "4a63ece0626fa1c6a852a332f99be51c10fef09901ae080a882e09e38fd42099", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700643, "uuid": "b2214e7d-644c-40df-8b92-8d685a6b36b2", "comment": "Malware payload (Heodo)", "value": "641438c9e4e98551d2e737b30f06fdbf4e516095", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700643, "uuid": "3326af89-8090-40da-8829-4259be941b94", "comment": "Malware payload (Heodo)", "value": "6789e54b3541cb3b5d1e83bb3795cd143b8d9b789f000812f072f51095276907a79edee425b7a5199442ceadbd9f2a9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700643, "uuid": "39966e4e-af76-4d93-a5e8-f5ab8e1809f6", "value": "T183E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700643, "uuid": "ef732160-6b19-47be-9c8d-966fce6a987a", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700643, "uuid": "7a91d5e2-e864-44bf-a501-dedf3726ca8d", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XTsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWTa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645700643, "uuid": "f2813f5d-a201-4f58-9095-69928114e593", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645700643, "uuid": "58d21300-3d80-4cdf-a6c7-73f7ab2457a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700643, "uuid": "e5a8659b-3add-4ad9-bfcb-f5eb842c66be", "value": "6a7cad841d765e29964d7b8af32191f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4b6bd0-957e-11ec-9275-42010a9c0029", "comment": "Malware payload (Metasploit)", "timestamp": 1645713313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713313, "uuid": "04df5cd1-1f23-4f76-aaf3-0d722c4b1109", "comment": "Malware payload (Metasploit)", "value": "8a3710fd7460481a2dd9e8b8b90cd995", "object_relation": "md5", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713313, "uuid": "f8043e64-df0d-4acb-bba2-158b1ad1eff5", "comment": "Malware payload (Metasploit)", "value": "4abdbd7fc8afbbf9a346a8866b8fe64d90f821b23e1f486821a896123836673a", "object_relation": "sha256", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713313, "uuid": "50f5ef9a-6f2e-4fe8-9d73-6bf7b43dd029", "comment": "Malware payload (Metasploit)", "value": "1c23a95bf48776828a7032a396cfeaf198d51e61", "object_relation": "sha1", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713313, "uuid": "94bff5d8-ff2b-40b3-ac40-2947e8f389cd", "comment": "Malware payload (Metasploit)", "value": "42c58d0ddea0c1928f6ec463e358e3c2e3fd659eb7b7653613bb7a0b7ab1dfcf4fb59a67bd840a2b7bf7610984d8ff28", "object_relation": "sha3-384", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713313, "uuid": "6799ccad-3266-457d-a31d-d30f7eb2a829", "value": "T131832A23B440C4BAE6E3D179983EF6CE4A5FE8714BA032C715D44D9E25B29D288B174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713313, "uuid": "ea01bc80-d964-4c34-8ee6-58dd9e61755f", "value": "21eee46413840718d312a744da108aab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713313, "uuid": "f89a8ceb-8dcf-4068-8e8d-44da784f1067", "value": "1536:F6QxIuAnZP6hJT/wXDtr3x/2eoH8z9FX7KK2h6wEWr9hH8WkOsFXuKI:gQx6XDtr36czjKK2h6dWJhcWkOsFXxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645713313, "uuid": "f3d213c0-e215-44e5-823e-df5600901fa2", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645713313, "uuid": "b588fd52-6480-44af-9c63-a7be8b8e46cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713313, "uuid": "dff90342-186a-4944-9b88-45ecfafbcc72", "value": "4abdbd7fc8afbbf9a346a8866b8fe64d90f821b23e1f486821a896123836673a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65112321-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687723, "uuid": "fba667fb-ec8f-44d2-8e8a-6d27406c3b6e", "comment": "Malware payload (Gafgyt)", "value": "68fbda541e1490cbc912368f1616fb74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687723, "uuid": "36bf78e6-8db6-4336-a87a-9008f56a8efb", "comment": "Malware payload (Gafgyt)", "value": "4b0d41fc1ae052800d8dc039595d58d06b86d0e56393578fdf996dad8e3d0e17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687723, "uuid": "3f9ddd97-e9e8-48e9-ae0b-bec21a1711e0", "comment": "Malware payload (Gafgyt)", "value": "a7e8b0d7c989b9d76bd13b4475adffbcde98ee96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687723, "uuid": "db68e99d-4109-4940-84df-279c1a7f4ed4", "comment": "Malware payload (Gafgyt)", "value": "88fa92aff5213dfbf0d5c096adc6579b4e52d05cb96737d2c83bb3a3e161289963db8626fa44ee6de601ba2d851261e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687723, "uuid": "d02dcb2a-0edb-4983-9dc4-52a22ec529e2", "value": "T1E0B3C517AB618FB7C85FCE3306AA450120CDA55A12E97B2FB2B4D92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687723, "uuid": "e3a7b513-f337-40fb-9274-411782592594", "value": "1536:ZLeTmkthhSMOCMQS+ZjN4pjuIxreg2OeRWklwUmkiSFxfC7xbXe:ZBHC3S+dUreTRnwUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687723, "uuid": "b43ff201-8362-4f53-81ff-2ed19c608724", "value": 113268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687723, "uuid": "87000a07-27b6-4b4a-9493-95db17ee81a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687723, "uuid": "8807e897-bd66-418d-8364-ccbd1c96298e", "value": "68fbda541e1490cbc912368f1616fb74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdb9a27-9559-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645697297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697297, "uuid": "6db0ed9f-b15d-4245-9c00-c1ff76e370db", "comment": "Malware payload (AgentTesla)", "value": "64c83e6dbae1a7886183e03299f0fe08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697297, "uuid": "4a288aaa-8f40-41cc-b0a5-6f0a8b0e740e", "comment": "Malware payload (AgentTesla)", "value": "4bbc9ffb96abd3524114d94eb072e60d191843f82464961bbcc410fb55fad512", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697297, "uuid": "d9e46fd0-9422-4817-9ffc-06cf518bfbb8", "comment": "Malware payload (AgentTesla)", "value": "32ec4af9117e2aff16c52c24a277ed212c17534d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697297, "uuid": "46c36beb-3061-4cd7-a191-3fbc85bd7a8e", "comment": "Malware payload (AgentTesla)", "value": "dd417788240031b88007fca4a34a0ce9726ed37b710a9c7c15bbc5937e265b4d54b81aee89114805009b9c3b4fdb1cb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697297, "uuid": "205e8068-97db-4b7c-bb27-a97895175a67", "value": "T17405CF2039AB60DEF063DAFE8DD8EDB0CD6AF53B271E75BA24420F564709951DE02172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697297, "uuid": "ec24071e-0b9a-4d31-a33f-874d7c0f9536", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697297, "uuid": "ccc0a32b-622e-4366-bb12-211f9fdaf23d", "value": "12288:K/6iwi3Oqirjgf+rrTmSIm6m+45gmK0Irc1CKsmRe9h6DdnYdjB/nEJvYzwl:yiQWLmSIm6mHg9r+smRw8D4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697297, "uuid": "e158fb33-9ace-4d64-9d11-b689b7bc1d49", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697297, "uuid": "991516dd-59d5-4b2d-93ae-64b693530d4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697297, "uuid": "ea1e898f-1ea6-4f52-bc61-df3b116c01d1", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457be761-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645723318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723318, "uuid": "3c863e85-839b-4ed9-9a04-636ce23b55c9", "comment": "Malware payload (AgentTesla)", "value": "2fbd71f8d7df41a7d7963f5917d693b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723318, "uuid": "6f922d6f-251e-4500-ab64-190c03b5cfb8", "comment": "Malware payload (AgentTesla)", "value": "4be26ffafd5631f1dc90bf4bf14008bff5fbad5921b929a66c725cc866212642", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723318, "uuid": "ec78786d-e74b-43d6-a5fc-2f37a6d6f9a3", "comment": "Malware payload (AgentTesla)", "value": "4d3d540ccaf77a5370776ad03e3791355b9845d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723318, "uuid": "7f40bd0a-2a32-427c-829a-ddf74d6456ca", "comment": "Malware payload (AgentTesla)", "value": "2bdd63f70f480846cc132659880e989e6899d1b9a2019a82db7ec7a3e088b598e939dc90dc426ed00edd6c9a05316d5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723318, "uuid": "2276ef33-b4df-40d8-8aae-c75cc582b5bd", "value": "T18814127DEBAC8941F3E07939C4B7770313A7AD6266D784086556B9F802F21E2CBD121B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723318, "uuid": "163c9fe1-ffa2-4fa7-9fb9-d9b04e01f4d8", "value": "3072:VPcw4T/vE92Uyw/15WLz1bYvXYbDdywSOs76EObPgJImNSI/5umgx8HMIequ9XHC:t+U92Mq2vXYbEwS76h6lSm5uOHleqKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723318, "uuid": "8e894eb5-127b-42d9-8c3a-4afad7bf66b8", "value": 191016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723318, "uuid": "19ac9c2f-243a-4a04-bea7-bde47be5294e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723318, "uuid": "5ec2d290-9fce-4fb5-b29e-785d95a70db1", "value": "Purchase Order No.11724570.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721cd8d5-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645688604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688604, "uuid": "e6bdaac1-503a-4a4f-ac1e-5399a9558c4a", "comment": "Malware payload (Loki)", "value": "6779767bfb89cd708e462f7852b2c313", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688604, "uuid": "761d469b-7d90-4a74-a03d-9928a734194d", "comment": "Malware payload (Loki)", "value": "4c03b1f7e615cfb8842736c020914d004f256179c0d1ca0734e0a89024155886", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688604, "uuid": "3f3ddf1f-bb13-467d-b22e-27d0057c7ced", "comment": "Malware payload (Loki)", "value": "7436ff7032d36e6d19b6bb92ebb0ea66fc00c686", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688604, "uuid": "e84b4c55-3991-4abd-8b8f-520ba09478ca", "comment": "Malware payload (Loki)", "value": "4d945e35e312851f03ef9bc1eb7baff3acd302bd94b82d0c77dbf7be7e3a3b8c27b071800dd4641b7ab27b25810399da", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688604, "uuid": "55049658-fc24-4532-8bf7-79d869909e31", "value": "T1FE14124077C5355AE4E5EB3FEF604E622236CE262A8593500A65BFD10CB2754A2ACF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688604, "uuid": "fe8eaf2d-8487-4104-926c-2e9339468853", "value": "3072:lN/R/k9P39yvz3csxEnibFhS9wDpd/xaR7A87C5d69Domit6YeyspRksAdNTzBzg:H/R/kx9ybcs+ixw2HMU4sIDQt45pRksP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688604, "uuid": "5bc1e0b9-a44b-4f86-aac8-30ad8f7d12cf", "value": 190408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688604, "uuid": "db372be7-54c8-4677-9933-c520d0d9d273", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688604, "uuid": "0f2c7bf7-5530-47e1-b46a-271dd614b50b", "value": "shipping document.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84521f93-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "ed098e22-7ad6-4da0-9148-cc0eed71457e", "comment": "Malware payload (Heodo)", "value": "af1ea3cb79bada6e6d512de9ae883025", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "b4145489-4c42-475b-8c8b-5d8bad3c5ee6", "comment": "Malware payload (Heodo)", "value": "4c066c93c169ac615f62adae6b45e87eaa53beac0515041db56463f3471488d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "d4565b35-d7a4-43e1-b58f-b60563d95f19", "comment": "Malware payload (Heodo)", "value": "c066ce78d8f12a2b4b45c009edb899a1e6b450dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "27dbfd1d-20d0-4f58-b72b-234130e36418", "comment": "Malware payload (Heodo)", "value": "2e72f83d9689a4ba2c5d9e8ff9204b74ee76fb98f5e641d944f6c9c4e9c607204ec2824512c0bf8e11a0250c1174bf9a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "b3d4d8ee-087d-47a1-937f-3cab8057422c", "value": "T12EE4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "b782b349-11b9-4936-b506-01dfd35c1f87", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "59110aec-88db-4182-aede-e861b5550953", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKWKDYjX3rUXY:ygHpbVy97Z0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710539, "uuid": "03ca0ebc-01ef-47d4-953c-3fed35b9ff55", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710539, "uuid": "a05acabb-0f80-4b8a-8b52-8aa78e9ed050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "aaeb7032-9c35-4f1f-8c4e-f31b32a69799", "value": "emotet_exe_e4_4c066c93c169ac615f62adae6b45e87eaa53beac0515041db56463f3471488d9_2022-02-24__134852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43be0b6c-950f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645665333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645665333, "uuid": "2e443812-04ce-49b9-84c1-556884c48105", "comment": "Malware payload (Loki)", "value": "67e6e4bf69e31e60ab826309dfa5cb5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645665333, "uuid": "794d116f-99b4-4ecd-a04e-86412fb7c062", "comment": "Malware payload (Loki)", "value": "4c33d464564a44e3b6f75adc4af06125b8f8537efd8bd7aa00f121ecb6979336", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645665333, "uuid": "da978448-e8e6-4cc9-a522-e5e19364a18a", "comment": "Malware payload (Loki)", "value": "9bcf9d930059baac223d796d9392afd2f7dd7d0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645665333, "uuid": "7b100b91-4b21-40da-a265-e3a77a445fd9", "comment": "Malware payload (Loki)", "value": "14f96be9457611f7348502ecf5843640db150b4abb7f36e1aaa16118897bd40129fad341c1c32db8974d1228c60cd46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645665333, "uuid": "924259b7-5ee8-4094-ae15-d5823f91260d", "value": "T148E4BE2029BF20CDF0239AFE9ED8E9F1CD6AF67A361D35BA24551F170B51900DE42636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645665333, "uuid": "1f5a85a2-ffbf-4421-b8fa-9cdc3823f512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645665333, "uuid": "63b09dfb-bd78-4fe1-be74-e3bed258acfb", "value": "12288:UEJgYYz0ZEl87Wpna1klOOPCfxcpaR+4fQHjJkiPxaKiosa:U9O7WpNCpyn4fQJXcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645665333, "uuid": "54e29808-afcf-402e-a505-0ca4d185de56", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645665333, "uuid": "6ed90511-1acd-4cb9-8746-b756ad91612d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645665333, "uuid": "2c3eb289-91b8-49e9-ad11-70254e0816e2", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211a6056-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "cc370ef9-eb3f-4eaa-b201-2e85ad4c4162", "comment": "Malware payload", "value": "2b9ab9cdc6ad8b61ae8aed8c235cf90b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "cd453c98-7d27-40c1-bbe0-aefec2116fe5", "comment": "Malware payload", "value": "4d1525e2f5009aaf4dc00cb3646311a5267eecd4862d13643633417fe5a69c5b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "feb2d34b-36d1-482e-87a6-8e6fc366cfba", "comment": "Malware payload", "value": "c610f1918815de28d8a41ae5ce7ae6b6e61510e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "14fcb6c2-fad3-4ff0-8735-a08a51f47f45", "comment": "Malware payload", "value": "276096b243600b49cf4d4854a58d0effc38e802d1c2aae5bd9ae89f33662e0b86f4025dde754e169b3983db940a3eabd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "d15ac4eb-1f24-451e-9fdb-1ed81b62d4e1", "value": "T11F35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "cd847fdf-2814-4279-886d-b70f46df8794", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "80ec83b8-f1e6-423e-9cde-7bf07391022e", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uHVOe528JO6PC:6iRGcUY0UvDYNFtuF5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738719, "uuid": "891149ac-aa17-458b-a3f4-b0a9a3359afa", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738719, "uuid": "f46f8b8c-918f-4b82-ac94-5ffbf2edb701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "b4fc2f02-c712-4985-a797-ba34d91b3884", "value": "emotet_exe_e5_4d1525e2f5009aaf4dc00cb3646311a5267eecd4862d13643633417fe5a69c5b_2022-02-24__213832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fb3df9-95ae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645733519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733519, "uuid": "79bc7f66-e433-4870-9c3c-61ee066ba08c", "comment": "Malware payload", "value": "02ed9bc39f9abb34e199b83f36e102fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733519, "uuid": "68c9039e-d02e-409a-867c-3861a3ec1887", "comment": "Malware payload", "value": "4d61a8ff22a6d9d37b149d20cfaa1a6db4d15b2c81b3b130059c4b3f930a5ce3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733519, "uuid": "c669d58e-404b-4d77-ae76-6e96254c8c5b", "comment": "Malware payload", "value": "5d29a8ce450d3b2ddd02cf95eb1c767154059dd7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733519, "uuid": "7c7075f1-1e3b-445a-bb0d-9e809a280b7a", "comment": "Malware payload", "value": "23d5b09dbc709aeb73fcd58c3f8f228dd9ea1d043ed1e52dfebf77b52296e0a73b2baaa3ac390c755074cfc65aededec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733519, "uuid": "66b86637-f6ec-40a4-ab91-abf475a2d0f7", "value": "T1AFE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733519, "uuid": "703c0b41-c85d-46f4-b41b-710f3ebfe6e2", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733519, "uuid": "e0187c0b-ff60-49b4-99c4-31d5456e46f5", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XgsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWga1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645733519, "uuid": "42b0a04e-10df-449f-9ef9-93589f978d49", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645733519, "uuid": "d69832a1-3fc3-4428-a6f6-043632d202ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733519, "uuid": "b1cd006d-6de7-4207-9675-25926fed4d19", "value": "49p1U559.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec94b01c-951e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645672059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672059, "uuid": "011932a0-fa82-4f36-8030-e391fd6eed2b", "comment": "Malware payload", "value": "d5d2c4ac6c724cd63b69ca054713e278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672059, "uuid": "b0744ca1-c2f9-49ce-a25c-1ee0efbe1c49", "comment": "Malware payload", "value": "4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672059, "uuid": "926c9a6d-b6ce-48e9-bd30-94e1de18e469", "comment": "Malware payload", "value": "f32d791ec9e6385a91b45942c230f52aff1626df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672059, "uuid": "3d3ad5aa-9964-45f8-996e-4134c23a5dda", "comment": "Malware payload", "value": "5c66b57b7ced4a923e6d8fd06b89bca0cffc2f56ebfc14dc17db04804866e26c0bbaeabaeda07439c051dc711e153fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ukraine", "colour": "#5F7374", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672059, "uuid": "80208741-f07a-40ee-a522-e93def7aa897", "value": "T105E53A16EDEA18E3C7FEF23148A257217771B069432277C36E54977D291ABE42E2E340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672059, "uuid": "6d4befc2-f4b8-453f-a9f9-59d02877e56a", "value": "96c44fa1eee2c4e9b9e77d7bf42d59e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672059, "uuid": "6ca40ffa-8627-4d37-ae68-12aef377e2ee", "value": "24576:TAPQ+bVjmqe0I9hmkHEGPmGBxqdV9xvW4b6TeASSBqo00bIYM+yP:TAI+Jpet9hhEQmGBxKV9xOb6LeM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645672059, "uuid": "9085c6e3-69e5-4835-a2ad-f1a594407282", "value": 3295232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645672059, "uuid": "8f12a6b8-4753-43d2-bf0c-3c45ad7f8073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672059, "uuid": "fb9e3fc1-d13a-4f21-8960-874224e3222d", "value": "43564aa0-94f8-11ec-9d1d-005056a01a83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538cf773-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694136, "uuid": "e59bf04b-8dcd-4fce-a753-b2556a370c89", "comment": "Malware payload (Heodo)", "value": "3444892bb612a7f392ce6fec80fa4cad", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694136, "uuid": "98258266-667e-4d44-ba5a-7c744e052096", "comment": "Malware payload (Heodo)", "value": "4e067647948acf1ab0100a2e1d48231dae5245ad4e3bc039897468e7963aa351", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694136, "uuid": "f50e2b70-5096-44b4-acbb-d266c4ed6a45", "comment": "Malware payload (Heodo)", "value": "8c99cc6f8a2f67883599622f3ba0dc0bcf504ebe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694136, "uuid": "b8199cfa-2040-4a8c-8389-31d4ac8c740b", "comment": "Malware payload (Heodo)", "value": "d8149df5a17e810433d9cd9f0c331ce8a5f2ec40001fab0f7f9ed4f4b84fdbc81585aabd96f76271a53a25e2d14dfa28", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694136, "uuid": "e38e0a6f-a9d3-4dfe-b855-7eb38fd29348", "value": "T10E93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694136, "uuid": "0dfd1afb-db9c-4949-9820-743883ca5823", "value": "1536:DQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:qDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694136, "uuid": "eb25fa92-22bb-45e0-bf2e-22682800d746", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694136, "uuid": "4aada156-d482-41f0-bba5-b14963882e2f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694136, "uuid": "0a5c721c-6d4d-4760-8622-e14fd4e4818c", "value": "2022-24-02_1244.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc705ba3-954c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645691735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691735, "uuid": "e70e7dc4-679a-45a4-ace9-83e1ca03dd19", "comment": "Malware payload (AgentTesla)", "value": "4ead9a521ae030aaceaf3a317d0a2806", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691735, "uuid": "a00d401a-ecdb-44ef-8f2e-bc8380b3d89e", "comment": "Malware payload (AgentTesla)", "value": "4f382a45ccadbea5c8c789f482cd8fd9bde3a87d43f47db8f6f8930e461d482a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691735, "uuid": "48f97877-4e1e-4247-b661-1a259b109a4e", "comment": "Malware payload (AgentTesla)", "value": "5aecbaa5b20b539c0dcc4ac2825dc967daf8cdb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691735, "uuid": "6b169556-4ded-40c9-ad84-8e5d0c3a084b", "comment": "Malware payload (AgentTesla)", "value": "ebcfd36154f50d425d0e27ec144a6f6a28270dd6e6eb6da820664b908b42faa03238cf68a029c2a3754293641dee44dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691735, "uuid": "0efaee7c-70c9-45b6-90b7-085b8b40be2e", "value": "T1F805CF2029BF20DDF0639BFE5ED8F9F18D6AF23A660D35BA24855F124B01D44ED12636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691735, "uuid": "0f9aa805-f257-46c4-9860-a2c00ffcb8a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691735, "uuid": "41645179-ba34-4ce4-b718-5e94542ae6b7", "value": "24576:N9bd+IWHQTiUpyaT9lBWGuAzz/JTPVI1tG:3sI0SpRhiCNTyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691735, "uuid": "92773969-4f3c-42c8-9154-07303afd5e03", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691735, "uuid": "81e420fb-30c7-446f-bdf6-736108a71a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691735, "uuid": "b11eaa79-df12-4c63-ae61-767b6472af21", "value": "4ead9a521ae030aaceaf3a317d0a2806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9d691d-95b9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "f3bc5021-5e17-4ddf-8cff-1bd27039104e", "comment": "Malware payload", "value": "8f740d37c9037e034e940314d2f8ed88", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "61cbb657-e9ac-4a88-bf93-7244b435437f", "comment": "Malware payload", "value": "4f6ccbd820cb70d2ab375e1e76f14e1e076c01513a09b8b781a607daa8f009a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "92d8e8fd-d8bf-430d-94cc-c454652894d8", "comment": "Malware payload", "value": "855db54b2edb4a71bc4071c0fa7280cf793bde7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "6273dda7-5f46-450c-aac6-21ba6df7e074", "comment": "Malware payload", "value": "9709419a385f2a71dda87a0ed97528fc1d1aab38df650ca3d95bd60690240045abf8eb713d0efc185baccf532ce7a63d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "c8abcda2-2a41-4463-8b62-80ff791e9c04", "value": "T1B435BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "eef1f266-5cdb-482b-b2bc-342c3cebf499", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "fa4f8a36-89f0-4df4-bf71-9bf810d59ba2", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uDVOe528JO6PC:6iRGcUY0UvDYNFtuh5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738663, "uuid": "8bce06ec-eb11-4aab-be64-52438ee85a99", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738663, "uuid": "c7c3e0ac-5b0f-41af-8fc6-00cde74e7972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "2d098f60-4257-4106-bf0c-d63b30be2dc5", "value": "emotet_exe_e4_4f6ccbd820cb70d2ab375e1e76f14e1e076c01513a09b8b781a607daa8f009a4_2022-02-24__213737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043413db-9575-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645709035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709035, "uuid": "e493d097-c1e2-4e8a-ace9-cd588d14e4c1", "comment": "Malware payload (Heodo)", "value": "363c4eda008b8486f6ecb7204ff1857c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709035, "uuid": "ec975ddd-b1fa-4548-af20-0e8dc4c42521", "comment": "Malware payload (Heodo)", "value": "4fad4c367b2c055e45f1c8d64e835df4fad57e7cad43425b1b427a3dad22ad52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709035, "uuid": "34f3fbb6-dc72-4b51-b4b1-e9c6a939f5c1", "comment": "Malware payload (Heodo)", "value": "5c311c154c8cf230a2eec83f06552e3b6e456d2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709035, "uuid": "90d7216b-f7c3-403b-8ffc-a872c652e02e", "comment": "Malware payload (Heodo)", "value": "d4bd47ade9bc3aa3948685fa00d0df3c0e4a6439b20524de7e655c1fa90e329019a4a810e97665a704385b4a2856ba68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709035, "uuid": "bb0a1c8d-0335-4578-af25-3df61a4c58e9", "value": "T110E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709035, "uuid": "d6ae9df6-ba84-43e0-9d37-da893e1736cb", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709035, "uuid": "4cd6a7cc-2dac-413c-a2c9-e6baa77c1805", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XTsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWTa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645709035, "uuid": "8f15126f-496f-48c7-bec7-e68c922f0e84", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645709035, "uuid": "740266b1-b33a-4e87-a1c5-2a608f283a46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709035, "uuid": "0ddeb363-7c5e-42ca-bd82-664082d10706", "value": "363c4eda008b8486f6ecb7204ff1857c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578881b2-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645682546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682546, "uuid": "d326b8a6-52d8-4876-bb62-d4190fb743d4", "comment": "Malware payload (Formbook)", "value": "7b9ee6d79797a5845aaddea358f7e48c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682546, "uuid": "0d4025f7-c3ab-4384-a01a-5ba00322e091", "comment": "Malware payload (Formbook)", "value": "4fccd7e86fa78a3510dc1e5bac951cfe95dfb6629536e22d0cadf00f049de500", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682546, "uuid": "796b2a2a-2f5b-4933-9074-1c57ae6b9ed1", "comment": "Malware payload (Formbook)", "value": "f29b722e3560b260a3e628cc3427caff8792e8cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682546, "uuid": "1fdb240d-cefe-438b-b5c1-1021f7d198b4", "comment": "Malware payload (Formbook)", "value": "a5980a07569822a80e05c3e954ea4acd3bffc188625c01c4cf41c9345dcde8a4616d01b610abb1ab547f8be425276cbc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682546, "uuid": "74d73506-2c57-4a56-aa10-d6919306a7bd", "value": "T1BA1412C56AE4F159DC3536F6A726C06BDD98EF46A5D20986BC06BB0F043DB1900E17F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682546, "uuid": "432fa7be-3d9b-435f-bd56-003d37b1380f", "value": "3072:meX4LBKgVno2r9nPtuHkPWuV8r7BbNyattIHDRTYLWY+jMC5ViXWnUQDlT5tYQzb:ILbVnviHkPYbNypjRcL0jMC5UXSVDdXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682546, "uuid": "5b6bc6cc-8008-40b4-9bdd-39bb86c503de", "value": 191080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682546, "uuid": "81ecf072-35bc-4783-b8aa-3521a7296e57", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682546, "uuid": "47dad72d-18c0-4564-b0fd-ffdbd96c0625", "value": "DUM 70-779 D.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f620bf5-957b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645711792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711792, "uuid": "d8954024-1fbb-465c-963b-cb2d05f1d3ea", "comment": "Malware payload (Heodo)", "value": "ce1881fb55757f1ca8aec4e5b9c4fa35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711792, "uuid": "f456007f-19b7-49dc-8bec-2c684f0da461", "comment": "Malware payload (Heodo)", "value": "4fe515be3ff0ce8f2b5dac84af1b6f00de80fddda76c6eb4472db9e3f445bd27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711792, "uuid": "440d7e26-7e7d-4465-929a-ecb735ca267f", "comment": "Malware payload (Heodo)", "value": "675ebc054e85a93dbeae63ab0cba18410155305f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711792, "uuid": "9a66deb4-5537-4ea4-a772-e7949e7f8e38", "comment": "Malware payload (Heodo)", "value": "b2ad5361af70bfc28afdd2c28a1ae9ffeab40f078f7a716d9607d3eace6a0d317bd838f99ea84d00aca5d43ed2cbe6d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711792, "uuid": "9d3fb42e-79bb-4dc7-bae6-935c84bf24f2", "value": "T112E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711792, "uuid": "1082f9b8-4582-4a92-82de-0d15fa02e09c", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711792, "uuid": "bb7254dc-7c47-4bf4-b9af-4ce308a7dbe4", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XtsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWta1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711792, "uuid": "98247897-d524-4d94-9492-4865bad83c30", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711792, "uuid": "7ac4a6a6-a38f-40fc-ab56-dea1482ed07d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711792, "uuid": "76a03d37-a2f8-414a-9593-01f788b2c763", "value": "4fe515be3ff0ce8f2b5dac84af1b6f00de80fddda76c6eb4472db9e3f445bd27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d341c6a3-951e-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1645672016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672016, "uuid": "ef1f67be-a10f-42aa-af74-b042e392c7f9", "comment": "Malware payload (Pony)", "value": "0f239c39870792d5601e9cb8d13282d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672016, "uuid": "64a91e28-1f26-45fc-87e5-30e50dcd09d1", "comment": "Malware payload (Pony)", "value": "500454df4886817c66d4430d00ca28fe3bc0509f1fdd5e0863a151e50c591109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672016, "uuid": "944684c6-d4ce-4a8b-94ed-6c0d3731c02e", "comment": "Malware payload (Pony)", "value": "222c934753f608665fab9367bd37ff83d9e492a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672016, "uuid": "b4d2cf46-0a2d-4160-a0c1-cefe6331d5bd", "comment": "Malware payload (Pony)", "value": "708e5ccf93d1d5c8a71fdd5f21d9e6a306bfc68d0a43a218bc3e802cbb059154c6b74ed199c1009bb0d873bf2ed97016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672016, "uuid": "e577e747-9ecc-4b20-a06e-9646385ed783", "value": "T15F930903F5C0E0F1D1A12BB277C11761E7F99E79BC3A8D4AEF4C49896DA26877B12442", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672016, "uuid": "7a563707-c41d-49f6-97b3-0fd9af669932", "value": "2c8567c932832b8c3359ddf9343a4028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672016, "uuid": "48e5c04a-ed27-4408-b4a5-8ed469ecbd9d", "value": "1536:2rZQ3gHqTi5bU3Ld1/KT+lu5S3nQOosrwTvJEAukzZe:CZHOLd1STqMOodEABe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645672016, "uuid": "effe88d3-42e1-4911-a640-7fff768968fb", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645672016, "uuid": "61250c6a-06e9-4f70-afa5-055bf45bb042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672016, "uuid": "3abf4875-0450-4ca0-9e3d-7982cea3bdde", "value": "500454DF4886817C66D4430D00CA28FE3BC0509F1FDD5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2108ada7-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "5629c396-85ec-4e22-b86d-0286e97a7c4a", "comment": "Malware payload", "value": "efaef35c6222734ad8d53df9cd88c466", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "4b988eb5-bd84-4062-b0f9-3daaf862d71b", "comment": "Malware payload", "value": "503acd16b5b900a5ead5be7f634c8b668c996b68bba1661e19efb36c35542a92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "581fd8bb-730d-4795-8a5c-9d795d6e9cb9", "comment": "Malware payload", "value": "a760f27150cb6e2259b72e556d45e03d29821394", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "0a43ed7d-236f-446c-9c2c-1986c38c3524", "comment": "Malware payload", "value": "eddec7b16b995de9536a1e965fa4f2615b465511764257caa221719dfb32491e4d4274f60273fd28482db6cb66f65afc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "fe146f94-70d5-4c07-a252-1b3f0cb3aabb", "value": "T1FE35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "b4f39787-333b-408e-b751-103e18798622", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "1fe677ef-4301-43e2-95ce-6d0d45ce0b57", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uzVOe528JO6PC:6iRGcUY0UvDYNFtux5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738719, "uuid": "9c7bed24-9c01-4b99-a5c4-f76e88d96193", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738719, "uuid": "97ca2d39-e2da-440a-9a8f-091bba9d618d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "a366227a-2bf4-4bd4-9f5b-e19cbb662bbc", "value": "emotet_exe_e5_503acd16b5b900a5ead5be7f634c8b668c996b68bba1661e19efb36c35542a92_2022-02-24__213828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c310938-956e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645706042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706042, "uuid": "c03b2933-0875-4bc9-b0f5-46d0df4b30d0", "comment": "Malware payload (Heodo)", "value": "cdf8e2a837a6b29d10dd8871f8816a8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706042, "uuid": "ff44d7b4-ec16-44e4-9bfe-4bc4b0d2d497", "comment": "Malware payload (Heodo)", "value": "509f888ec63fb94e5182475152ee75d3fcde927caf144ee024e085250c401279", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706042, "uuid": "0adb9635-955e-40ef-b32d-d628f58417df", "comment": "Malware payload (Heodo)", "value": "49891d1702a5c893f66e47bd88c3282241187912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645706042, "uuid": "7fa718b6-b58e-4377-91f9-f6929d17fd85", "comment": "Malware payload (Heodo)", "value": "591fe08ef5f36f74fa344ca45324d8e872a1eb53f33e122916a0cb70e55a0bc7ffc2365a389c0da1b2f3a2023ae7fcf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706042, "uuid": "3a2a540a-1c7f-4871-b390-d750e1ef1204", "value": "T121E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706042, "uuid": "5b6675da-4295-4a6d-b33a-4359b9bf4499", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706042, "uuid": "97c67ed0-93da-4924-9af2-a0e75849d7ef", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKke/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKkLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645706042, "uuid": "08ff8bd6-c995-4d57-b4a5-2a3717c48d10", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645706042, "uuid": "ace31428-83bc-4323-be6a-40411771fca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645706042, "uuid": "85c1fede-15fa-4574-807c-a72f0167d39c", "value": "cdf8e2a837a6b29d10dd8871f8816a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cdf176-955a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697708, "uuid": "5afb8606-c77a-4c53-8220-f5e482a793c3", "comment": "Malware payload (Heodo)", "value": "bc032f9cba025b8cc237b4a9abe72678", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697708, "uuid": "5e102c91-137b-449e-a016-a5e3d397c651", "comment": "Malware payload (Heodo)", "value": "50addf23729a3a477bae856728251fa58bd9a8d320a9aba32fb633dcaa4322e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697708, "uuid": "f895bd84-c20c-446b-b99a-50e5cb437667", "comment": "Malware payload (Heodo)", "value": "0b8bd5e765103a5c4b8756b09273232894cf2bcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697708, "uuid": "ff7ab314-e8f3-4bfb-90dc-90cff58f0513", "comment": "Malware payload (Heodo)", "value": "0d038de430b3689c4a94e07e2decc5a9a60ea310a1220f050fe7694e41caa1ed5f37ece7fe0959e4659f90c9e09bddf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697708, "uuid": "529742a2-559b-4ef3-8867-0d5001986629", "value": "T1CDE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697708, "uuid": "b7feb211-dbe7-4d82-8450-9bdbb0a61e2f", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697708, "uuid": "9b197825-863a-4d5c-bbf2-7e1acc7a1242", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKJe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKJLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697708, "uuid": "1f228eb8-6548-4821-8c7c-82616ee00793", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697708, "uuid": "3a81a377-40d2-4017-8fdb-751a34fc9b56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697708, "uuid": "f4a8386e-0581-453f-a7ca-7027699f083b", "value": "bc032f9cba025b8cc237b4a9abe72678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68651f2a-9563-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645701472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701472, "uuid": "a964ebcb-270b-4cf8-a55d-f3bcc763f968", "comment": "Malware payload", "value": "c98e46392bd4a6b17cccb942f2e270f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701472, "uuid": "1cd420e0-8701-4778-9079-7b2a0e200242", "comment": "Malware payload", "value": "50ba6e5665b9956add343b71f8047e3b47108fa452c3a565c1b935648adbf0e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701472, "uuid": "fe1d65e5-538f-4508-966a-93369c4024ea", "comment": "Malware payload", "value": "d617e7c274dbb9f80a06ce9dbcc42b4fb222fce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701472, "uuid": "c2b322fe-f0b4-405a-b4d7-b1cba3015f05", "comment": "Malware payload", "value": "e137f9e28434a7464552c2708eadbb64e8a8e9d514b25e49616b5eb6847542b619b5561a9e97edcb3d8af2b85abd1a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701472, "uuid": "6ff4fdba-661c-4e55-9597-cc3bf2b470e7", "value": "T1CA248E0061D6413FD872A6B38598968189FF7D263D6A8FCE578C2C7ECD382915336F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701472, "uuid": "bb451e43-2102-4bf7-b78f-e4547cb6d8f9", "value": "a7b6ec0d4c24b8b31f2ebf3e46968180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701472, "uuid": "b6848120-06ee-4c25-b62f-676e788e1800", "value": "3072:m2mJamjK63BsvtPN668Okm8Q1vwVgTAHMbmRLppyuyQRbAfbCBV:mU63BsvtPcBMvhUgmRLps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645701472, "uuid": "92a4f1f6-9b6c-4044-af7b-e23bb79173b8", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645701472, "uuid": "568fef04-165c-4d06-ae8b-2fec66d8f40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701472, "uuid": "3715822a-dbab-42c1-9586-b4264334ba99", "value": "SecuriteInfo.com.W32.AIDetect.malware2.10957.2110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb7bbf5-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696275, "uuid": "edbfd48b-51ea-4d16-8346-def9b93379e2", "comment": "Malware payload (Heodo)", "value": "020d288cafe1dafad21fea9b9dcb382c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696275, "uuid": "85e72483-45c1-4054-af4e-b1ad7c450744", "comment": "Malware payload (Heodo)", "value": "50e9b7100d4990d1c3efba3b211965bd28218e18fbec17d3f4e754e202d8ea28", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696275, "uuid": "f4686df2-817c-4bcd-bde4-0b984bb1e224", "comment": "Malware payload (Heodo)", "value": "12503c98e01890cc134f620915f3fd74a04f7e1a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696275, "uuid": "f51a8c1b-5841-4538-b520-7f891385cb32", "comment": "Malware payload (Heodo)", "value": "b6d93af15c58bc006beb18896d96250d9e8d781350a5ffdfed3c44f230652c597da3454334304f2561a6684ddacb5417", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696275, "uuid": "19cbdcc6-b4e9-447e-a2d8-4cb8f49f1495", "value": "T154E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696275, "uuid": "198614cf-61b8-4cf1-b4d9-6241b757a6a4", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696275, "uuid": "15fc838a-dee1-43c7-8f94-ace5306f4991", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKTe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKTLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696275, "uuid": "8d21c52a-cec9-4139-941d-b250104fb22c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696275, "uuid": "7b679bd0-5189-428d-bd17-2dadd0a41671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696275, "uuid": "33a27078-28d0-4ceb-acda-de892e6154d7", "value": "cvNo36hSX08HcKblNvSOy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5be7d4d-95b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738082, "uuid": "60af862b-57a8-4a80-a709-cc3380eabcac", "comment": "Malware payload", "value": "78dbfafd43e2091ef41a04c47d2f3de8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738082, "uuid": "f8241ddb-9ff4-43ca-9bba-fadec4ff4498", "comment": "Malware payload", "value": "521060d740410f0d69206f5215709cf0efad0769a5ebf61f21c83f8d3fc06d7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738082, "uuid": "c7f83b46-019f-400e-9a86-ef28af02996d", "comment": "Malware payload", "value": "c2193361c92264adfc1d1112340c54f5f57de6ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738082, "uuid": "aa3b00fa-143a-4361-97bd-6881d502ce16", "comment": "Malware payload", "value": "c91d779474e74fccf50fefd9c54267be6f24ed19c84ccef84147d9fdb634b19bd7e5c540a56e970a517611e790b9abb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738082, "uuid": "dbdb2b2d-ce86-4b9b-8d7d-4e1f9f26e02b", "value": "T192E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738082, "uuid": "af94e2c0-e0a6-4fca-9079-a4b243f3ef2a", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738082, "uuid": "fe0e3a3b-277d-4c21-a7c3-4278c521dc9b", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XXsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWXa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738082, "uuid": "a4864487-8a9a-4b80-ba14-e1772b36d3b2", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738082, "uuid": "62cc3763-2044-4ad7-91c6-00f960fa4ad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738082, "uuid": "bca9b6e1-432e-496c-9594-d6c4b3f683ad", "value": "78dbfafd43e2091ef41a04c47d2f3de8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed5c258-95ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "ca0b63b1-2f30-452a-b6ff-72fe55db318c", "comment": "Malware payload", "value": "cc0ec10fd79df296c634399df4a9a4f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "eefc4dc4-fc95-4fa1-b2c8-814765dd7a30", "comment": "Malware payload", "value": "52c6aab00356727e9c56ce4949e7aa2e3505fe14991f1490ab8a5522ba597971", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "b403a4d6-db23-4400-8708-aff2a87d02a3", "comment": "Malware payload", "value": "899ace46b757907f0d311b84b7adc4095906ad1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "070a6cc6-e290-4f4c-b1b4-18ed1c998c5d", "comment": "Malware payload", "value": "6fadc3a0cf14b9ceef964be2315a916f3aa2add420fcae1a7d675c56d8332918ada7c9b09b6231d3f9b15ff8278716c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "8ebfc6fa-8b5a-4379-85db-4a74d8d0a9c2", "value": "T1ABE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "ab60e974-69da-48c7-924f-ff81d385a5ba", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "b4529f86-0dc6-4b56-9efc-a755617b49e4", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XhsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWha1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732487, "uuid": "7c648fcf-2a0a-4a5c-b6d7-66c20971b24e", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732487, "uuid": "c0bfb82f-3f2e-4b5f-96c9-8871d1caabe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "d9855482-8686-45bb-b7e1-cdca0f54cc79", "value": "emotet_exe_e4_52c6aab00356727e9c56ce4949e7aa2e3505fe14991f1490ab8a5522ba597971_2022-02-24__195441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9192097-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645693018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693018, "uuid": "3a4dfbc2-ddb9-4d74-811f-4e52943d9b36", "comment": "Malware payload", "value": "86c3d9ca29e1daf6161c0650e429d0c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693018, "uuid": "8ce9035d-8f8b-4f87-b4a5-21f202d45991", "comment": "Malware payload", "value": "52ebcedc43fa6df723891a109c63a4643074595d67a279d558d177940a5a5a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693018, "uuid": "f6510195-040b-4809-8887-d8ffcbc83b96", "comment": "Malware payload", "value": "779a23788a182250a55ea2fa1758883fe3f9dd31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693018, "uuid": "bf8fe2ff-57de-4ba0-b6c7-0a1ee1ee34ba", "comment": "Malware payload", "value": "916cf3b055c7cd2f023132ad54ad4cd8f07fcc0f7ecdbd4c0811269e5072d2917f1506a031daf688a3a1d7bed4c50d4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693018, "uuid": "cfce4950-af18-446f-94ea-52b7aa6cc02f", "value": "T128C42321FB65C1D3CAFD1030187E63F79F69B9A50163D7630360EE4E39539A4A92CBA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693018, "uuid": "776d2e4a-265d-462a-804d-356ab4809312", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693018, "uuid": "3e007a12-beb1-4d49-ba92-2a12aa08e55d", "value": "12288:iblEFplTpLHvo09Impr3mH3laistR0J5AtePPW92/rb:iblEFplhh9IKr2H3labC5AtSW9QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693018, "uuid": "dac4be4b-92ac-4adc-8fb4-a00a3f634b44", "value": 548499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693018, "uuid": "cb09fa02-eead-4105-a77c-57b8a168786d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693018, "uuid": "573f4d1f-4d7c-4ffc-8175-c3ee9eafc0d4", "value": "86c3d9ca29e1daf6161c0650e429d0c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06f26a9-955a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697701, "uuid": "3b9b951c-896c-45f8-8e23-d5f51fad33ca", "comment": "Malware payload (Heodo)", "value": "52bd60780e0528e10d5ed2e2db94d6b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697701, "uuid": "67bde9d1-9562-4ee3-9480-c211737337cc", "comment": "Malware payload (Heodo)", "value": "530508e54e6adfaf064b39ad53f38403e160e5e834c0b6836ef1134120377c6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697701, "uuid": "9ef1de20-b71f-422e-90dc-35c9be18bf1c", "comment": "Malware payload (Heodo)", "value": "aa8d28be15cfcb936fab769d1815671d0046e774", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697701, "uuid": "16e49b03-537f-4d28-b380-aa3d0a0038fd", "comment": "Malware payload (Heodo)", "value": "fc4ab3ba9da66d80b622527d03ec80f30438739e0f83778f99cc53c6ee2e175b57c4b65711c44c43225ccf0c8de9e710", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697701, "uuid": "6aadc422-5797-4ac8-b4a9-c057404467c2", "value": "T11EE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697701, "uuid": "96f9af16-ef6a-41ca-85bb-6e6de2ae7336", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697701, "uuid": "a1228858-a403-4d00-8094-c04ec623b6b2", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0vhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfZPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697701, "uuid": "6b1500f3-2560-4071-babd-ca3dda09b996", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697701, "uuid": "71586d88-4700-420e-a199-4e4405e58113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697701, "uuid": "a4c9cfd0-d336-4281-b59d-ff80cfeb7968", "value": "52bd60780e0528e10d5ed2e2db94d6b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e983023-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687712, "uuid": "824c9e46-2ad1-49d5-8cda-85cfc8a0c3eb", "comment": "Malware payload (Gafgyt)", "value": "870d2086fd4c87864e7feb3d6c55e06f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687712, "uuid": "4f0dd628-78b7-4b0b-b2f0-2541f29fe67b", "comment": "Malware payload (Gafgyt)", "value": "5321b04476eb75fb31885d8574fd0e54243d4cb0b269f36ae257f97d12a007b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687712, "uuid": "912b3397-58ff-4cc8-be87-c73ffd245f11", "comment": "Malware payload (Gafgyt)", "value": "ae3cf21a3c1fcc49570be1426f92552e0846e108", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687712, "uuid": "d95d6614-efb7-413a-9e1f-361c1a4cb7ba", "comment": "Malware payload (Gafgyt)", "value": "ceaf93b65afd6832d0341ab71dbe29d72f61c40b3060e531b53bbe088a7b9c3c51c52a825b7cb7c9f639cd2f8ab23948", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687712, "uuid": "add6a9cc-aa6f-4fd8-bdf2-fde608c776f5", "value": "T1A1832A43B72D0B43C49B6AF02DF72BF087A9B9A117A76180A10EBFC45772AB02512F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687712, "uuid": "940decf2-66b2-4b8e-953a-1335d243f61f", "value": "1536:VQe/XY0EzMr/aj5ecEo39igRNaUUC3EmQ9VqXjtWf2Xe:VNhfSUcEo3tZUC3EmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687712, "uuid": "c7970d3d-07dd-4c45-a6f4-05f3a4aaf602", "value": 84789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687712, "uuid": "9cd9c7c6-3b2c-485d-8d3d-22cd2d77c2b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687712, "uuid": "1e10c2e0-3a86-475b-a93a-3387c5e67bff", "value": "870d2086fd4c87864e7feb3d6c55e06f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5798108f-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696290, "uuid": "9f7e6495-b6e0-4439-827c-07bdf7b4920e", "comment": "Malware payload (Heodo)", "value": "81a187e615718e1ef381cc3e8ca2ebfe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696290, "uuid": "1d20a519-4538-4012-ae4d-772d6c2cc20e", "comment": "Malware payload (Heodo)", "value": "54364b8c7ef0a57e8183e4fe9a18621c2f30049fb4608aed14f1d4d7530cb192", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696290, "uuid": "dd452e69-1204-411d-86cd-4316acc26c1b", "comment": "Malware payload (Heodo)", "value": "d073831d4cc6bd00adb9fa6ecd7192378393c373", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696290, "uuid": "457e81ea-dd68-4561-bce3-f91fe5680846", "comment": "Malware payload (Heodo)", "value": "bafd52bd61b3d0dca1f63d6e0e040994fa8d00de396f02ac278db4503c3921cca81fbe8a973bfd3651d7da42c9b4b077", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696290, "uuid": "62010ff1-2646-460c-87df-4bf9c925623d", "value": "T150E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696290, "uuid": "8eb21789-9c74-42d7-b985-654634c54ec5", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696290, "uuid": "733c082e-03c3-4032-ba39-02dfdc027e4b", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKte/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKtLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696290, "uuid": "e04a1233-add1-40d5-ac29-ad641a9de2f0", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696290, "uuid": "1e203c5d-5552-486c-a035-b73daddc80ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696290, "uuid": "5f4b7301-daef-42a3-ba85-826e404098b0", "value": "VAfnyaOOP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631d3122-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645688578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688578, "uuid": "421f3e1e-f2ca-49e8-a1cc-18367392e98d", "comment": "Malware payload (Loki)", "value": "2470c4aa65e5b6fca0470666db16df07", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688578, "uuid": "3d5e593f-02b5-4cc9-8a2f-f81d8d4449c0", "comment": "Malware payload (Loki)", "value": "544dfd03f093a9c34492c7b807659b8df2a67702e456584b50b831c161084611", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688578, "uuid": "1f1479e0-54e1-4813-9cf9-71a2372dfee4", "comment": "Malware payload (Loki)", "value": "540339bac58b30f7df14697708b610636fa2965c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688578, "uuid": "3c573f90-4f22-4da0-8c02-8c3472a1ec75", "comment": "Malware payload (Loki)", "value": "cc2fec603fc352904e8e44292997fb421a4bd65a6682ea2ec94ccb6fa834188d990dca081ca785fd398dcec05aa145f9", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688578, "uuid": "cc386a21-bf4e-4c3f-b9d4-42413296ca49", "value": "T1AF14028C7FB58485E6B9B0326BC832B3D964FF2896C1911910C2FB9D42B65B7C971F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688578, "uuid": "d81d3b47-d654-499b-a767-763a318833e2", "value": "3072:YQYfCdeTvgZwkB7mPBqPctsNEzK4IPO3leIxApZTlaXkDj2bFaCRKcKiKPQTo:f+CdI+uBGc/dLxAvpaGj4FtKIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688578, "uuid": "48322541-d737-4ca2-8a7b-b019e72a48a4", "value": 190584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688578, "uuid": "cca0bb98-c910-4211-900b-6e3800e99a7e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688578, "uuid": "7a37c016-0d12-4371-a83b-ea6a4b98b7f8", "value": "March Order102023.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bf5f84-9573-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645708306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708306, "uuid": "5e19d9d3-86ae-40b8-807a-c0b2f826923a", "comment": "Malware payload (AgentTesla)", "value": "fcdcbb1d746a4b0bf62e080f8f8dc495", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708306, "uuid": "12d57648-5d66-4b1f-b6dc-cfae99e0857f", "comment": "Malware payload (AgentTesla)", "value": "5480ffc346e0173c470774c90d7e97c1bafc7ae8ac8688ad911ef4146f51619f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708306, "uuid": "d89b3e49-dc61-4aac-9298-718f75f46c86", "comment": "Malware payload (AgentTesla)", "value": "b02c33066c7612af851c2e54f65357db620949fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708306, "uuid": "cd7ccb73-39a6-408a-850b-6d19c737016c", "comment": "Malware payload (AgentTesla)", "value": "4abe535308542962a5bed4d75606d487c40168eed22658b219eec19f20b8be77bb8fa76e9059a1fc0bf3ffc7e965984b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708306, "uuid": "4515e479-487b-4bdc-9416-40953ee541d1", "value": "T1AB05BE1024AF66DEF1769BFE1DD8A9B18FB9F53A3609F1B918810FC60751B419D02A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708306, "uuid": "e37b0ed6-fa64-4a5b-889c-19602d1f142a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708306, "uuid": "f04e2801-112d-4e5f-8bc9-5e15fb8d5891", "value": "12288:3U8LEJgYYz0kZDsWOwhvJAh3W9aZJw3UHAh9xPkEj2xkrTGaIPl:P9rZDxOwhvmh3WsGEHi1krkrTXIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645708306, "uuid": "f41fbd96-fabc-4734-97a5-c23eeb6ec76a", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645708306, "uuid": "7643b142-9c7a-4100-9397-8d5198e0a541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708306, "uuid": "02b9b0ce-bc43-4831-a163-4e70aae85bb1", "value": "SCAN(02).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e2d428-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645688068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688068, "uuid": "8bcf67fe-66b5-4b68-91b8-36478a70106a", "comment": "Malware payload (SnakeKeylogger)", "value": "28bb9fddf14dde3d3d2fa2c51454abcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688068, "uuid": "8901c604-2928-4c76-9a17-e5f190059691", "comment": "Malware payload (SnakeKeylogger)", "value": "54a07ed163d00be87ab85f125019c5fb8881bd0126b6d0a1be2009dbb73be3c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688068, "uuid": "84217fbc-1367-4d96-b338-d9366951e235", "comment": "Malware payload (SnakeKeylogger)", "value": "2150ee34b1887a79ed9d2f499469b6c59dd1e79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688068, "uuid": "1fcd76ed-52b3-45d6-a6f6-ce113f6e9087", "comment": "Malware payload (SnakeKeylogger)", "value": "52a80ca810e15ea8db15d0a420d5d916c48781e8265ed8432e08ef5d1a781943943832f3fe76599c2614bca13821b727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688068, "uuid": "69a30ef1-1a54-4417-b03d-ec838401c8b2", "value": "T135E4BE2038BB20CDF1679BFE9ED8FAF18C6AF63A260D75BA24450F174751941ED02636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688068, "uuid": "02f95df4-7c78-45e2-821d-7ddd46014ffd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688068, "uuid": "1b218b97-9793-4ae4-9dcc-d51d06de4142", "value": "12288:VEJgYYz0zW+gCXc/eTXenoXM33NJxmCr7/snpMT8SwQ9v3w7Ss48ZO3SrPuRIjA:V9q7rT0ocbkeUbtQNCXaxWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688068, "uuid": "dfd42ff0-e1e8-48cb-93d2-4f0314259508", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688068, "uuid": "f152ba56-4b67-4f25-bfd8-311308e5910f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688068, "uuid": "96beeeda-48c9-4cca-8436-af92b46f34b1", "value": "OC GH0085362452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63714a0-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645710703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710703, "uuid": "8453630c-d895-4b1f-b01a-a9716e6a3f1c", "comment": "Malware payload (AgentTesla)", "value": "ace422ebf740d0f6aa7a466e86e7f2b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710703, "uuid": "790adbe1-b355-47c2-ba4e-89df9f46594f", "comment": "Malware payload (AgentTesla)", "value": "566555a4376c7aa9fb9852f500db0fb1b1ef2696c429d34de1effa6ccc250d38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710703, "uuid": "b979439e-f55a-444b-8ec6-76d871968626", "comment": "Malware payload (AgentTesla)", "value": "040a9c175aa5e2bd5b9fa040dd0a579cc5b28eed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710703, "uuid": "3a3aca94-7aba-4df3-a402-599775362e3d", "comment": "Malware payload (AgentTesla)", "value": "5a9d00f0b3813561120f6014869a9974956af158a5a3bfac39b2c2417c11d933eb7a9db504e59cf383c5d88239fec8cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710703, "uuid": "6d77d243-0127-4e48-ba93-4c4910294793", "value": "T18FE433BB9B859842EBE4D7B0D5ACB30D0725D9A1A70CD58FF84B0F688AB705BB4D1740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710703, "uuid": "5883f645-798a-4e90-9d1c-f62ba32e1ba9", "value": "12288:Ud/McoBq46w9w7Rcj2GjJ8x2J44wCA73Hsix8b1/uaO92NCeGVRuBfyG:Wy6w9wVo9J8xCPwn7ciqhGafCpM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710703, "uuid": "41bb683f-440c-4b2b-a2ae-682270f603db", "value": 717858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710703, "uuid": "e98d2d75-b0f6-4821-8dad-5b953a8fb5bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710703, "uuid": "2c8c6d2d-7742-4608-aa5d-809298a1cde5", "value": "INQ-18104353.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f159d3fa-9561-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645700843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700843, "uuid": "78c0c54e-a2dd-49fd-8e5f-5a8bb915b658", "comment": "Malware payload (AgentTesla)", "value": "529095d6d7c608977692afd6064bec19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700843, "uuid": "7220ca40-9b90-4835-840f-946d69a19921", "comment": "Malware payload (AgentTesla)", "value": "57355b94a2b43976a06f8519af77f9cfd0c10d29a0ed35cdf696eacf59499f4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700843, "uuid": "464e230d-14f3-49ec-babc-c019f0badc69", "comment": "Malware payload (AgentTesla)", "value": "51c4b565ea08d84b892e775700788cb55fc780a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700843, "uuid": "205b06d6-313a-41c9-b55b-a64aa81a5e27", "comment": "Malware payload (AgentTesla)", "value": "7a3503c2ff4313c6d785523a01b76bdc3aaa795353f0653b7eee7dc5f8eeca6c13fa35e5f2be4a3ed3455492f5a27a8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700843, "uuid": "7b274d93-c76c-48d3-b14c-5cd5fd7b75a4", "value": "T156633B42E6930523D9594672F09341C307B1A30E28E7CEAB65CD311E8A9F3D72A56FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700843, "uuid": "9eb29b04-fa8c-49e6-ae54-976cd3f9a43b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700843, "uuid": "06f14f08-3047-4e0a-907a-43c9eae2c36f", "value": "1536:hJ5zA87Cpga/eHUTQQQQQQQBdBgN6b5/2kWSC6WLrXUJQ:hJnCpga/eHUTQQQQQQkdBft/2YWLrEJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645700843, "uuid": "c9bd6718-770c-47a0-aeaf-1958617859f8", "value": 67784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645700843, "uuid": "2cbb388d-dcc8-4865-9ae8-1115e43ac337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700843, "uuid": "e109f505-373a-4bff-bc4e-7fc3eb2b1455", "value": "Invoice-38839-2334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3f0a91-953f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645686255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686255, "uuid": "582f5c41-9c75-4519-afa6-16f85b27d560", "comment": "Malware payload (AgentTesla)", "value": "cc06342d4e05b9acf09ae66ca4c3f387", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686255, "uuid": "a838158f-0db2-4173-9dd2-eb48ed40ff0e", "comment": "Malware payload (AgentTesla)", "value": "5769a709c66213d7ad8f712101fe972e3c54e3c01dbba0547bb8affab6dd4f0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686255, "uuid": "d8004bc9-1ce8-495f-9f66-3a5c016dedca", "comment": "Malware payload (AgentTesla)", "value": "24878c806683283aaa08aa994d84a4db7e10f6eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686255, "uuid": "66c77c99-f462-4c8d-add4-11b2c746467e", "comment": "Malware payload (AgentTesla)", "value": "8cceb9d8e67faeb190d8e253da0200097f0cfec7bd7ac736654c5f2f830d9b9c38afcb33fce751c35cef8d6233b43498", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686255, "uuid": "54c9a71a-055e-47fc-9924-38ed300f45d8", "value": "T1E405CF2035BF60CDF1639BFE9ED8F9B2CC6AF13A260C75BA14450F164B41A54EE12636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686255, "uuid": "fff0c75a-bba1-4507-836f-8407fb9923d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686255, "uuid": "610f9729-2a6a-4fff-9ee7-50dc2d0f598c", "value": "12288:QEJgYYz0npV7Nn7DfJVU+WS/jou1M2JGeMlsXvuQwtRBddzYELjfOW:Q9+FNnRG+WS/skhuyBwnBzzbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686255, "uuid": "9b2414a4-aaf7-4e1d-85ab-3be16c881f79", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686255, "uuid": "ad42b654-ec59-4885-8b18-86dc7468e172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686255, "uuid": "ffbab292-0ef9-4443-9f3e-15e28d3fc089", "value": "1LLZgFPzZH6Wzjk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cd627a-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "e5a64c91-2c96-4261-8fda-7075e7aba092", "comment": "Malware payload (Heodo)", "value": "7f62a05a75278574c037253b6d82478f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "18885dbd-67e9-4668-8e67-b580389a535f", "comment": "Malware payload (Heodo)", "value": "587fb8c32a5498583725d2bf03101562368927013267828f74490fdced5f44a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "b3357fe0-378a-45f7-a701-ab3f838de741", "comment": "Malware payload (Heodo)", "value": "9e74e4c891ae527e8f919028638656e26dc33715", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "5a46b49b-8b42-4e02-b8ac-97bb25c8d07e", "comment": "Malware payload (Heodo)", "value": "3d2abaf5c4dbf1b670ab951645ec0b7d67e694a8ed396466a9731c6e7a8df7f18860b50ea0438a527c893f47a3a01e84", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "a7b7d546-0f31-482e-828c-d0dcb7a12277", "value": "T138E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "4d2fb957-639b-4889-acb6-0ab491bc5dec", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "f0eb2035-3973-4612-94f4-f3f1fe3ba8f8", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0X4sD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFW4a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697894, "uuid": "7cb57bb5-7aea-4afd-83da-f4dcc09e82ea", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697894, "uuid": "740acc64-af73-4f14-8ad2-7e4715675080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "3a171664-290e-4e3f-8138-1cc77302aebf", "value": "emotet_exe_e5_587fb8c32a5498583725d2bf03101562368927013267828f74490fdced5f44a0_2022-02-24__101809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9208f0-959c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645726200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726200, "uuid": "0acea15d-4134-4e35-b726-8dfb9643a326", "comment": "Malware payload (RedLineStealer)", "value": "cf345c59268b8d486cb4bbe9fd4e16d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726200, "uuid": "782b2e19-10e8-42c0-8f20-e33c681d28ee", "comment": "Malware payload (RedLineStealer)", "value": "58923e87395ef23b613b8096388e659783ea8d25f8a4805ffc551d9be31f7952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726200, "uuid": "423fd1f7-0adc-4178-b503-bdf9783f054d", "comment": "Malware payload (RedLineStealer)", "value": "6b17b73166d04572bb7ad83b2ac4f2ce445fbc3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726200, "uuid": "f23d4465-5363-4972-b562-489306bc1f9b", "comment": "Malware payload (RedLineStealer)", "value": "8dd15a08861aba718382075ca6a5d9d8f69661b933e0ca07f4917077bdd107e0b03015c5ca2322cb04cab787e8859907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726200, "uuid": "ec534880-b6d9-4b71-bd92-65a23a7a185e", "value": "T15AE412D175A0CC71C9943430A927DFEC57AEAE62E5204A43B2B83B1E6B732D5277520F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726200, "uuid": "371daf50-136a-4265-91f0-8b566be4cd0d", "value": "917b0dc587f632b60bbe39ab8c418265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726200, "uuid": "14890264-fba4-4d7f-b5c4-a0ee7beb36aa", "value": "12288:hKcE+HtNK1o75EmXhQl7YVd4oDDOrOycVpwRazZ+R7k8:hK5+H+1o7S80cQ2dyEpw4zZ+m8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726200, "uuid": "e4f046fb-d8c7-4d33-910f-61286db3e277", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726200, "uuid": "68617dff-9a9f-4bc1-9c40-4ac4ea70f575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726200, "uuid": "c98151b3-9519-4a12-976e-6fa5f85d4e0a", "value": "cf345c59268b8d486cb4bbe9fd4e16d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16df1fcd-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "ae0db48f-ba57-437d-a139-591ad0e85070", "comment": "Malware payload (Heodo)", "value": "138a9555ad78824393878d21269bb69e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "17983873-3d4c-419f-a2e5-bc46fec3697c", "comment": "Malware payload (Heodo)", "value": "59fe38e580c35949bbc147fbbe0e4b272e586237d4050b27f9e50b67f0eae59f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "787719d6-3452-48f1-810f-1615cefcd50c", "comment": "Malware payload (Heodo)", "value": "fde5939c9a28c1afddcae9433877214ea9716118", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "66f6416a-220e-4388-acf5-7d581b72a4b2", "comment": "Malware payload (Heodo)", "value": "263d0c7c3533d852744b691db4d6169f5933f64322459e8395fc1f58507f13bbaf6eda66f04c45aafc63226096b3e356", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "c0368bb9-3ba7-41e0-a5ab-bd6689674717", "value": "T112E4BF4176C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "4d0ac1d3-3b1f-4688-9d1d-3dfb55eaa707", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "17e46b97-f489-4022-bf62-37f2fddfda1a", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0+hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfePhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660963, "uuid": "21bb21e1-0a7b-4360-9f21-9c5e10f6a96f", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660963, "uuid": "dc8f4d64-86f3-4c6a-a6b0-7cc52a4bb4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "60d2f6b3-fe07-4ba4-96c9-584cf7c2a1e2", "value": "emotet_exe_e5_59fe38e580c35949bbc147fbbe0e4b272e586237d4050b27f9e50b67f0eae59f_2022-02-24__000238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd63fa2-9550-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645693160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693160, "uuid": "530eeb93-f148-4a3a-affe-7a2fc1ccc53c", "comment": "Malware payload (AgentTesla)", "value": "fa9dc65f046c7aefdcfdf3d25dc642ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693160, "uuid": "db7c806c-5755-47a0-b641-785706068c9e", "comment": "Malware payload (AgentTesla)", "value": "5a0ae4151b54929fcf0f93e40731e8cfabac4bc51241c589d39c7e0b8a080863", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693160, "uuid": "0dcc4b17-7100-4a12-9504-5adb0da40424", "comment": "Malware payload (AgentTesla)", "value": "9440feb98bac07cc15c3f19e8157755c5f1b0af9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693160, "uuid": "9eb91314-5fbc-4e1a-8972-6601ca207df7", "comment": "Malware payload (AgentTesla)", "value": "53368c0ada211affd688f49218a5061d6b67c751827da7c1fe0a2ae1aa0680eed48cc57dfe7db4f9164a0fca7439edda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693160, "uuid": "05cf708d-3c98-4e94-961d-b7d82fad145f", "value": "T1E4E4233274EBF5B027D9B262768F57C72F8109ECDBCD4F8E01DAA26C1369A4C9C42165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693160, "uuid": "7048d72b-3fa9-40a5-9320-1db7b3943bdd", "value": "12288:ndn1aSRvasocf/JS/ul7axKIWnmxRvI1ydpk6TLnpBsx:ndnjRS7c3JTOxP66I2p5pI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693160, "uuid": "8abb51da-5169-4815-ab17-e54be3f71664", "value": 714346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693160, "uuid": "560dac26-0f48-4971-a2e7-d2d9d3c9207a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693160, "uuid": "736139da-a104-41dc-ac78-6e8215913962", "value": "Invoice 000388548595999900 02242022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af456449-955e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645699444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699444, "uuid": "9c2f83fe-641e-46a3-8a4f-0271679584be", "comment": "Malware payload (AgentTesla)", "value": "779f7d8730a21e3eeebefc8d47b015ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699444, "uuid": "fd92e2f4-82cd-4bc8-b33c-35880ab1266c", "comment": "Malware payload (AgentTesla)", "value": "5a32205fbb27d401faab7790defab9f0339b8cebb1aa294f3e9ba7e34a6eb86e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699444, "uuid": "e6c33f9b-80ca-420c-929e-e268eec22f0a", "comment": "Malware payload (AgentTesla)", "value": "08f327cbac48ff1022ced38372907d2561325c0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699444, "uuid": "b98e613f-6f30-4a7e-8cc8-95caa8a571c7", "comment": "Malware payload (AgentTesla)", "value": "e4096aac1de3cf9d9cedad5c4182be50568aff0d90a1fab3356740936a22a2357cf1d4f3f3b4490cdc2adc6d03d8e8b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699444, "uuid": "6ce2bc14-9e6e-496c-b24a-72e7c8ad8183", "value": "T1D705CF6035BB30DEF063CAFE9DD8EDB18D6AF13B220E35BA20460F164B49941DE12576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699444, "uuid": "3fe6e9ef-7b48-4f19-a451-7eaa58eab833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699444, "uuid": "27440815-9415-4f34-bb08-f78e52f15126", "value": "12288:GC25f2WOuFuhA/+muX3hGDBIVpawDHPWuaa9AhpA0FvGhXSGFzKFNNliC3YXPMru:af2EcA/ZuhGD0vua2TZNG5mCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645699444, "uuid": "f8b68ce4-8842-4d61-a7fe-49437441c194", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645699444, "uuid": "0d31f8aa-c3af-4b1f-8e9c-7630b4e63f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699444, "uuid": "966bc22c-8b39-4b89-a8ba-53d6bf5f2fce", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1037ab55-9550-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645693164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693164, "uuid": "1ba55408-f8bf-4088-ba28-0fa0e56c1e85", "comment": "Malware payload (AgentTesla)", "value": "5195c6d6d1f6b68d66f13fc1d56a38c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693164, "uuid": "2a7753f0-7a46-487c-941b-cc2565387be1", "comment": "Malware payload (AgentTesla)", "value": "5a4e22f1d50586ec37cf15e182d301be539acfa37d91bf00c774afe6614b5a91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693164, "uuid": "c69c43da-1b34-401a-9aec-d3e206b28a58", "comment": "Malware payload (AgentTesla)", "value": "293f49dd5c28b397ecb00340c234bc274a72366c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693164, "uuid": "2f88c171-9944-40e8-9e6f-b82d02c24f1b", "comment": "Malware payload (AgentTesla)", "value": "5a66984cab055400fdea293bd420ef20b57fc42bd83ebafc5d93481cc015656efb767663a54f441e3fed79517512cef3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693164, "uuid": "f4f3d10e-0294-4dc2-ac76-8ea9a9d85353", "value": "T1F5E4233174EAA170E7E9E232369B47C32B420DEDDBDD8F8F05D852AC13A678D6D42164", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693164, "uuid": "104ff7c0-13aa-4c49-93bd-a1c13cf9562c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693164, "uuid": "16a9f051-760d-4b90-9994-b7c51f277b5b", "value": "12288:AfNyb5dn1uofbaMUgX//SriR7aduIW9mxbJyZ+NLc6JL3PTUs:Afodn7fORgv/jOdLQGyELbPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693164, "uuid": "6c65fb97-49df-497c-b270-32616ba6af18", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693164, "uuid": "1751bb66-e5d8-4830-ac87-708718dc2c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693164, "uuid": "37d61630-cc6c-4c35-bb68-cc7255f326ee", "value": "Invoice 000388548595999900 02242022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb2ec2f-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645688673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688673, "uuid": "dc474642-00c4-48e9-b581-5800349da555", "comment": "Malware payload (AsyncRAT)", "value": "aea1ad86b251201c05171c32333be8fe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688673, "uuid": "10a47b5a-41e4-45b6-acc6-ea6d8a4d1f13", "comment": "Malware payload (AsyncRAT)", "value": "5a5f91915bf0ef55b1fbaf80c89049cc8ea8747b044c2cfe8b75446c00989646", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688673, "uuid": "13639ca1-f38a-4a3c-b60d-03a86adfc5c8", "comment": "Malware payload (AsyncRAT)", "value": "1ace5e5a5e6ee690c1f3366b34e32bc3e9ba5780", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688673, "uuid": "79aa472a-7f47-44e3-aff9-14530d7218f8", "comment": "Malware payload (AsyncRAT)", "value": "3918fe810bae8c05818e30468ec6ffa93b6d4993bfec3b80cd40144bbdf783f8ca84df4cde73e8337aa7af8a9464e1d8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688673, "uuid": "4e3a75ff-13be-427e-b334-19be8f6a894f", "value": "T166E4AE4839AB1F3DF1718BB219C4EC74BAA9FB231C08B37D78512596C6A1B808953777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688673, "uuid": "d83fef77-3ebc-42af-a1ea-88ed2569f6cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688673, "uuid": "d7ffc881-cd30-4a64-b90d-1d5dba176d9f", "value": "12288:gWiWVEXKh7jcK7777777777778YKIjRmR9LlLKLd/fqD89CpmVRtUzxitvCf:IK7777777777778lIARFFMA89iQRtUzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688673, "uuid": "75e28381-f25b-45bb-b60f-28c8fbb36936", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688673, "uuid": "a900246f-e555-4e87-ace6-8fbb28d610ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688673, "uuid": "596ca114-6672-4e3c-b538-5c2cd87b0e5b", "value": "3456787654323456789987654321`1234567898765432123456789098765432123456788765432123456789876543211234567899876543234567887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3368bd54-9595-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1645722858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722858, "uuid": "097c5964-2e11-4a1c-8bfb-04fbe6221d68", "comment": "Malware payload (Tofsee)", "value": "28ab5238e88a228c758dc962bffc378b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722858, "uuid": "1985b285-6e2d-4974-8f87-120ae58ea8c6", "comment": "Malware payload (Tofsee)", "value": "5a7e30f8306b5487f44f8418f635fb52b5d239690342e1c2983f3aceb74f8b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722858, "uuid": "60dc1974-b2a0-4185-b73c-7f2994fe7af9", "comment": "Malware payload (Tofsee)", "value": "d0f4368eef4ea6eda65f992f24a006bc362ee359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722858, "uuid": "51670ff4-b52c-4ed4-b55f-24f05dbe890f", "comment": "Malware payload (Tofsee)", "value": "6ea4e9584d38e95bca81b1ee0f6d0c73b948cba20b52fa870ba903739359b2e164ed29c6bc1dd37452c82fb2b5d94142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722858, "uuid": "31254dd8-d354-42a8-82e2-1dd0a4b316ba", "value": "T10B44ADE17980D435C486F230982BCFA0592DEC61CE645A4772B83F5FBE722D166B921F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722858, "uuid": "f74ad667-7164-43b5-bd91-736675e6f893", "value": "917b0dc587f632b60bbe39ab8c418265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722858, "uuid": "b31c5287-8dc6-4f7f-b73f-2350c4a20ebd", "value": "3072:y4dNeYfd5K7YYiDvwMPuAQ5EVggjcGkNIVqIOM/h36qV0QB/LjF:Xzfd5K7YEL+7ITsqxsDRLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645722858, "uuid": "dec16c46-f1e2-4b1e-b1d1-695c3867ac54", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645722858, "uuid": "182c9c85-f518-4d4b-8c3e-e1862c75351b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722858, "uuid": "0111cc84-f43e-47cc-82a7-e49a9b9c03fb", "value": "28ab5238e88a228c758dc962bffc378b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c57847-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687187, "uuid": "c5367411-8bd2-4bdf-b8a4-6c794362e97b", "comment": "Malware payload (Mirai)", "value": "dfc26742cd8eca8172b6b29544ab4806", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687187, "uuid": "0228fb36-2852-4511-8e64-6100dd6632c3", "comment": "Malware payload (Mirai)", "value": "5ac459cf5c7dbbe78ec001ed79124c8cce2795635bb5c121399f13d79f26e6f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687187, "uuid": "d3b05edd-cb70-4903-bf82-ece186a28503", "comment": "Malware payload (Mirai)", "value": "41a9c8f5f0f257f5978fffba07d4bca2e3dd1089", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687187, "uuid": "8e41b3cf-740a-4ae2-af26-e3e7a954a582", "comment": "Malware payload (Mirai)", "value": "c1670a88e9214ecd0f72e854614e07b95d8e4fce64b01259f2b725a6a5d0ef8b91a63d6d1f94019adbfa4ad888480c2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687187, "uuid": "0008ebd3-3f0c-4afc-b77a-06aa7065d8f5", "value": "T198A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687187, "uuid": "43c6698f-3597-4415-a9ef-b1e813b2f3cf", "value": "3072:VSx+i6mqaObhNfnPNKV+qKmZuqQ4DPwXXtse:y6mRObnfnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687187, "uuid": "7b055208-f35f-4c0c-bf44-b5542b4ded15", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687187, "uuid": "14d22806-7184-452d-b85e-fa3bee96c3cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687187, "uuid": "656fead8-e672-444f-b141-590c651bf192", "value": "dfc26742cd8eca8172b6b29544ab4806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2e5cc4-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694150, "uuid": "e3cd2784-f39d-440a-9278-dfaa1cbf5c67", "comment": "Malware payload (Heodo)", "value": "f15c7f7ec9623f43858cf7b64364bd38", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694150, "uuid": "40b92067-42f7-4b06-8023-5967f11bd5b4", "comment": "Malware payload (Heodo)", "value": "5b4a9d221564417e24846f2f0a179622287f479d2641aecc9723de3f309361fa", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694150, "uuid": "79485b2b-5e00-44c6-ae78-eea7618a9c84", "comment": "Malware payload (Heodo)", "value": "0ea10714a68cdea98b62fed5417ee2198cd088d8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694150, "uuid": "fe2aa5d7-d6ce-4bf9-8b54-d0405472ef8e", "comment": "Malware payload (Heodo)", "value": "6bc106041c4524a62bd47773865be260b415021a675a78c3dc64e3eb54319246b71803073c0460d17da7d81d62918af7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694150, "uuid": "cc09e022-caf8-4ace-8409-26e7c8265cea", "value": "T1EA93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694150, "uuid": "9501f253-28e2-412b-99fa-b2f226b24dc9", "value": "1536:vQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:GDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694150, "uuid": "56c2622d-0516-4771-8321-6eb8f8e3d924", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694150, "uuid": "7e7582fb-3d58-4fef-b41e-92ad1da1aa21", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694150, "uuid": "96bea3fa-a0bf-4105-8208-9505f3be2759", "value": "Medwin Publishers.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1d8ff6-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645694152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694152, "uuid": "93e7b67b-ba11-4d9e-96cc-b4f7dc39fccc", "comment": "Malware payload (SilentBuilder)", "value": "74fcb752783ef95ac9f548c2916e14a0", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694152, "uuid": "41ceccc5-b6a2-4e43-add1-c9f5d468f47c", "comment": "Malware payload (SilentBuilder)", "value": "5bdb533c81de6ca17a3a532eb92c6771703529ae3016f43b6d3aa787f300b4e3", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694152, "uuid": "f11b2dd7-501e-47c5-ba0b-e480ec525cd4", "comment": "Malware payload (SilentBuilder)", "value": "7c4c0deff6f2023bb78906dee97db2cef1484525", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694152, "uuid": "a69f503a-a25c-4bb7-b692-d6e61ce81ead", "comment": "Malware payload (SilentBuilder)", "value": "50ae0af06499c33af32523ca109012a7c59adc3d642fa29edd63d72598c59c71ffb108c1bed8a1e48b5d416b81cb4814", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694152, "uuid": "25fab351-733f-4e98-b45b-9e1b6c48f721", "value": "T105B3BF5AB21EC86DE965873048D747EA2737EC114F6F4B873A49B3227FF89904B1341A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694152, "uuid": "ee78057b-6ebf-4dc6-9492-d0a2f4aae063", "value": "3072:VfKpbdrHYrMue8q7QPX+5xtekEdi8/dgVyVIBk6h2bsllScQjnxw:pKpbdrHYrMue8q7QPX+5xtFEdi8/dgV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694152, "uuid": "a63a75d5-0d44-4e7e-8f2e-dd7f1ef514fd", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694152, "uuid": "46148d51-a94b-4e83-b3e0-8f31700c63f5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694152, "uuid": "37cde89b-9729-4f52-9420-884d7c4572bb", "value": "MES_086.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdb7be5-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645710714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710714, "uuid": "ed705579-2016-4772-b81a-c630aee97dcc", "comment": "Malware payload (AgentTesla)", "value": "f7a49dcba9dc2d5e669f94f96d091e1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710714, "uuid": "b854de61-d52e-4a78-92dc-22bf9bc37a02", "comment": "Malware payload (AgentTesla)", "value": "5c657df373ac931a1c1d21a5a466025313f1db8836e66f4dedb4b32e9de83ddf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710714, "uuid": "0debe9dc-e9c8-475b-8553-ba4884671da9", "comment": "Malware payload (AgentTesla)", "value": "56d57f4d90e7206bb800f3109986d42780d38250", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710714, "uuid": "b70a2760-b0f9-4ff4-b942-42a7d5a62641", "comment": "Malware payload (AgentTesla)", "value": "36df3600f1e4d03c3a0edf804f22e3ea3d3436e3b36920be9bffcb7f819032bb643b1f95bb75979f74ad04d44218bd79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710714, "uuid": "da9d77b7-0326-4c3b-8888-69673a7c7b82", "value": "T14305CF2439EB20DEF063DBFE9ED8FEB18D2AF53A260D71BA64460F164B49941DD01271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710714, "uuid": "b715cd5d-1d68-4410-8e1b-2ed97c903e7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710714, "uuid": "2941b156-31af-46f7-a5b5-1801361bd827", "value": "12288:vC2OwoBU4669w7Tcj2Qj78x0F44oCwhL7OCP8bHhUiO9QNEe6V7KNS9VZBLjEJFF:vQ669w/oh78xGPoVhWC0bOi7E1MNCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710714, "uuid": "bd2b7ba1-32f2-412e-b9cf-79d2dac4e07c", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710714, "uuid": "f05d781b-e864-4e37-9860-d02a23d368f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710714, "uuid": "eef3c6e9-afaa-4d94-ae97-dfae72517fb9", "value": "INQ-18104353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff71c142-9541-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687123, "uuid": "bfca9bd2-b02c-4677-a6d3-8cafe8eec382", "comment": "Malware payload (Mirai)", "value": "7a5bc91d0bde17f5ab2ae580a22c8f1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687123, "uuid": "d4b1e6a5-2f6b-4de9-93ed-451cadac2402", "comment": "Malware payload (Mirai)", "value": "5d20cdb70c5d43c4e2d29399fd3b97b6fc65a97054939c98d2b92afa8e7f2557", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687123, "uuid": "27f0f2e7-fb8a-4a6c-b199-0ebbf3bb9877", "comment": "Malware payload (Mirai)", "value": "20431115f0243bc6002d01302d0b5507ed835b8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687123, "uuid": "fe4944d9-8700-45cf-819a-b0c6e4b9c7ee", "comment": "Malware payload (Mirai)", "value": "2cc64ed030eadd72a750c10503e57b63d36f889cd4ac51d5f4850e8adb06376b83837737786cb28d86cbfb2c614c449a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687123, "uuid": "a6f6eb02-5f88-4fbb-abfc-665d62c80476", "value": "T18DC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687123, "uuid": "4643fb4a-135a-4751-9011-4ce3c1c05d1c", "value": "3072:ekYPUfsgnsb0J2ag/Vf2kDN0dn+mTQOY5NX3cn:9YPUfsgEo2a02kDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687123, "uuid": "38fc9c06-4fff-4b5c-9463-86304e9606a9", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687123, "uuid": "994ef175-fba9-44f7-b539-5ce01e685bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687123, "uuid": "e2482c2f-ec56-427a-9007-b293812f94f1", "value": "7a5bc91d0bde17f5ab2ae580a22c8f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c3a6eb-9573-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645708320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708320, "uuid": "eb6acc4d-689d-40be-9a4f-e88a0a29157b", "comment": "Malware payload", "value": "2375b40431bc19d172e4802dfb6187ed", "object_relation": "md5", "Tag": [ { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708320, "uuid": "c9b25626-eeed-47de-912a-ca4d24072750", "comment": "Malware payload", "value": "5e303fd9317236b55429aedd5c7aa133f3ea9dd2a50402930c50c5fbcc6e27e6", "object_relation": "sha256", "Tag": [ { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708320, "uuid": "11b2cc2c-8d1b-4104-a929-6f71afc1c85f", "comment": "Malware payload", "value": "c59b3c5a107f76a5d7de0a482c48f32c1778b4cd", "object_relation": "sha1", "Tag": [ { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708320, "uuid": "526dffa9-3017-4914-be27-43b62928443c", "comment": "Malware payload", "value": "0c30981a3bd6570546585fd17dfcb3c40344f7b87d8130092e5ff66372da73728112c865abfedff97eea34090f96fdab", "object_relation": "sha3-384", "Tag": [ { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708320, "uuid": "005282a5-42da-4391-b589-0ac42bb7280b", "value": "T1FB1423874991EBBE504D78D216EE1AB2F901F7A4CE5648B0D81A298D53876D0FF288D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708320, "uuid": "f3a96c38-a6ce-4424-885e-f9b46e570f53", "value": "6144:G3+YFPqDPkQ8pO6bPYet/BAt8sbISHP615:W+YFPqDqpO6jnJBAeUIl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645708320, "uuid": "e6f2fbfd-e47f-464a-8fab-8f8ef4c817ba", "value": 200332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645708320, "uuid": "f9f0e3ef-c33b-411a-8921-0ab6445a80fc", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708320, "uuid": "8d8b6e1f-febe-4482-9f32-dde04e899c84", "value": "SWIFT COPY.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c023072a-955f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645699901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699901, "uuid": "b1702524-d8a9-4137-afe9-da8a7d95690c", "comment": "Malware payload (Heodo)", "value": "79eea17df45b98d11fd18d39045ce547", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699901, "uuid": "2cc44b9d-f384-416f-b365-a96cc0c1d0e1", "comment": "Malware payload (Heodo)", "value": "5ef144ee57268c2b7771c2827820a1ba18d59f8b97336135db3d0292a04e9aca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699901, "uuid": "ca2bd522-0f9e-4e95-a50a-9b7a2a964dba", "comment": "Malware payload (Heodo)", "value": "f28797c5e70a8834211082c97468359de16874c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645699901, "uuid": "9b0ab43c-9701-4bc4-9885-d9b2b12e26bc", "comment": "Malware payload (Heodo)", "value": "9858ae47fa148d32e4ba428863bc59f8bbb035510c043ce7210e8dd2117c8350e1c5d05f12e1bd7d38741f2cdc2c740e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699901, "uuid": "518b8852-666c-4a12-ba01-475e2f39db16", "value": "T1CDE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699901, "uuid": "87a7e95b-0c85-43ed-958b-bc732adad16f", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699901, "uuid": "f877f300-18ab-49eb-9822-b01547ea61cb", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKEe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKELzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645699901, "uuid": "0806cf04-fcf0-4e1e-8a39-798e253c3255", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645699901, "uuid": "34185b31-92b9-4331-8c8b-8631f8287d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645699901, "uuid": "98217d8e-b5a8-4f5e-9fa2-56351188cddc", "value": "79eea17df45b98d11fd18d39045ce547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6b0a10-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645694048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694048, "uuid": "442105f4-0db1-4910-bcad-05d5455386d1", "comment": "Malware payload (Formbook)", "value": "0776dffe008dedfb3abaf542ec93f642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694048, "uuid": "c12170c3-03bd-493c-8500-ef3de7593cb7", "comment": "Malware payload (Formbook)", "value": "5f519059102694e9cd3d009fd4dba3384db9697deb6b039e2ad6412390208ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694048, "uuid": "13b8e298-d9d2-480d-a903-92bce59d6201", "comment": "Malware payload (Formbook)", "value": "916e8a930739a0e68b21c069692a3ccb984fea88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694048, "uuid": "5343f680-3305-47b0-882a-adb4546b1852", "comment": "Malware payload (Formbook)", "value": "2914f87fb9e0b879df85c51c8d512b46610ca9b5b0ab5ad836295268ca9d93d01135ac07595fa6688b2ff7a0d4399d3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694048, "uuid": "b146e8ff-3e99-4a08-9920-4d1f849acac4", "value": "T1F46412A331C40867E8C7067602B3E765DB7BD520DE95041B77A42F9B3B234834E1E29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694048, "uuid": "07fb9f20-5c31-4db5-a513-0bc82c036a4a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694048, "uuid": "2cc637f3-513d-4f97-afc4-875f84e8ca55", "value": "6144:TxDw2oZAZFw0QRc36GnISobXmWA8N6/GCncv9HoS33Bh7cOK8iy/gA2J:jQYqGVozO7WIG3QOKLs9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694048, "uuid": "ea486f9c-0b82-4dc5-91bc-50384b575f79", "value": 323370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694048, "uuid": "d9d7697d-5324-4036-afad-ecce6ee538f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694048, "uuid": "2a18df29-e7c3-4d69-888a-0ba82498316e", "value": "Prueba de pago1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2399861-95c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645743311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743311, "uuid": "80fcc595-0276-4ac0-9f10-19ce28a8d8d8", "comment": "Malware payload", "value": "84a9756c991ab1e1227360539f8e672a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743311, "uuid": "5d2a75ce-ca31-4b03-9c2e-be80b126d9a0", "comment": "Malware payload", "value": "5f7836a410e8d10431c710d3024b09e98a3ff37af34a747e2885de78d1304bf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743311, "uuid": "8b657277-aad2-4b11-91f1-d939c4341d14", "comment": "Malware payload", "value": "3866b8c5760ec1a4e3267bdfd0473166522779cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743311, "uuid": "afde9fa9-4a46-4248-8056-08daca2a865f", "comment": "Malware payload", "value": "dc04b798083814408821d920c4fad03d009151950fcc19d7f73fcc9eb59634ec5e1db60f64943d4f1beddd959eb3f6ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743311, "uuid": "86118cc0-3de0-45ed-b489-486222625462", "value": "T1F835BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743311, "uuid": "13f51a95-693f-4ee0-a5ef-4743c337ca2c", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743311, "uuid": "4dd64cfe-0186-4c75-8602-32363983fc9a", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+ujVOe528JO6PC:6iRGcUY0UvDYNFtuB5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645743311, "uuid": "f7d08277-3695-47a7-9bc5-3c32b716505e", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645743311, "uuid": "9eccc91f-5435-41fc-b303-cc55d2c08880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743311, "uuid": "8ac8c17f-f7cb-48ad-b579-061fb09c5f10", "value": "84a9756c991ab1e1227360539f8e672a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18053578-9575-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645709068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709068, "uuid": "4dac7518-a424-4453-9290-cfc6843aa8b4", "comment": "Malware payload (Formbook)", "value": "d51f1d0cfd3d340217a10563e26b874b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709068, "uuid": "125a7031-79fa-4f08-ba7e-48fba513aafe", "comment": "Malware payload (Formbook)", "value": "5f8d69976e4d3c9b6508cd376dcab4971a605d8d1122952ad604f7b48d2ef1e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709068, "uuid": "a71609e8-360a-46f4-9eb5-37f5ed440a92", "comment": "Malware payload (Formbook)", "value": "7a0208d13ecf6943af12a9f49b1f66b10d3ebeda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709068, "uuid": "005b2288-9c51-4617-82b8-a645db7d534a", "comment": "Malware payload (Formbook)", "value": "7ea200678ad130ab14d2fa458b5b0d210c8f6aef06c9210393e8d662703998feb8c36360b340a9eb4d3ac835ebe443c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709068, "uuid": "f601b87a-d3cd-4a41-a05e-52f01564f750", "value": "T16F64136ABBC9CCA3C62B963145D28772E7FDE0B445462693DBB94FBF65320911A0C313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709068, "uuid": "31251c0a-f0d3-4764-9907-ea95559cbb3e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709068, "uuid": "184d8950-2250-4c26-a589-b911366ddc86", "value": "6144:TxDZ+uY3Vi2Ad8nC3aXrPvT0b663EFC7TY6aU3DaQuwgTNN1rxf:z/acTdf3E5dUvYjU3uLw+rN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645709068, "uuid": "fa8d37d2-afc7-4826-91c2-7a3687486c1d", "value": 323436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645709068, "uuid": "f3b2a5c7-14a4-4162-a866-098aab05994f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709068, "uuid": "a23b51d8-07d9-4251-9d74-aa59066e2ee2", "value": "d51f1d0cfd3d340217a10563e26b874b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b175caf-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645682498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682498, "uuid": "93502a01-09c3-4e89-92f8-147ddb777b5c", "comment": "Malware payload (SnakeKeylogger)", "value": "38a60ab5c04bdfa3460f6adbbf4cc6eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682498, "uuid": "9ba557af-9a25-423f-925c-9f83145297c0", "comment": "Malware payload (SnakeKeylogger)", "value": "5ff2763a7af9c5e8d274be89a3df9e75d9a0b281878def38c44085395178f01e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682498, "uuid": "e8ce934c-e425-4c43-b011-711601464bbd", "comment": "Malware payload (SnakeKeylogger)", "value": "b9c0c0aae9d37f5d93a69a304ac974bcbcf1fb55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682498, "uuid": "2bc7f2af-8e26-41cf-be42-c8e80993a90a", "comment": "Malware payload (SnakeKeylogger)", "value": "055627495ea5b77b88f1f8bdcaf325d1f8ba83afee27220e03068e566a27bbac9011d734b2e1b515d1456c85fc574c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682498, "uuid": "5fcf0c41-d7f9-480a-b32d-a7814ecc3328", "value": "T13A75F11134AB20DDF4279EFE9DC998B0DE9AEC7B620D71BA24863F170BB5941CD11632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682498, "uuid": "9db210be-4cdc-4b08-8f25-661b4801da02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682498, "uuid": "b24741a5-6667-4377-85ae-40188eab4b74", "value": "24576:Z6O9iJ9ZGrO/gQsSufLJuc/axYOPCw0IanullDBM/vrgG2XBp4ROLurd:Zx9y9ZUsDshax5PCwjanIBM/DcpqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682498, "uuid": "4ee4162b-9de7-4b9a-9eef-e8d28987b170", "value": 1581568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682498, "uuid": "599c1905-3473-42ee-a468-bfd4c61fe043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682498, "uuid": "b947c5c7-82b8-4093-8d2c-fe4008302190", "value": "Halkbank_Ekstre_20222501_073653_270424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baecad24-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645693021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693021, "uuid": "799c700f-f8b0-4045-bbd5-650c55e5ff39", "comment": "Malware payload (ArkeiStealer)", "value": "bc6ae5e19ac66364dabc951f0b7fc098", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693021, "uuid": "3eda1104-40c5-4748-8f53-11df67e6c519", "comment": "Malware payload (ArkeiStealer)", "value": "6081ec45cfd21e7ef92a44a9a190260ab2178cd87729038cd5005e5d18a9b1e4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693021, "uuid": "7ea661b8-7ea0-4dc1-9bd6-dbc0e8c84ff4", "comment": "Malware payload (ArkeiStealer)", "value": "6592eed275f9b1a054461ce0e48ce705bd275147", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693021, "uuid": "ec6d5517-a278-4ea1-99ed-32f035fc4035", "comment": "Malware payload (ArkeiStealer)", "value": "38796343acfa0fb89e1ceb0a4648f086fec9213df3646f0f634bb29ea09435059cc758c4aad3edf8fc6427d450bcd5a9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693021, "uuid": "6a6b9b03-bafe-4749-a7b7-385108de4fb4", "value": "T1F3749E10BBA0C036F1B756F889B9D3AD792E7AB11B2154CF62D516EA16356E0EC3130F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693021, "uuid": "cbea9969-bcc3-43f6-a73c-129d62765fb7", "value": "4c888f60a1dc578dd3e689d327372255", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693021, "uuid": "4000685c-9408-486c-bc93-18fbdaad9918", "value": "6144:tPZfdf0AXbgU1YM4oQ9ykIsDfQOEAYAG:1oAXUU1YMuUkIsDfnPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693021, "uuid": "6f40065e-84cf-4083-9793-6124d4d9eb33", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693021, "uuid": "763c87be-8f20-4fa5-a084-dc461e32b75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693021, "uuid": "962ced58-1acb-4f65-898e-3e14c6d16152", "value": "bc6ae5e19ac66364dabc951f0b7fc098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da1f6a8-9540-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1645686395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686395, "uuid": "eea0beea-3e08-4740-9988-165d38aafd95", "comment": "Malware payload (CryptBot)", "value": "2283ad65576252b5a4f007cffb8e5d24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686395, "uuid": "20e3dc3d-fc29-40df-aa76-248c1a6be164", "comment": "Malware payload (CryptBot)", "value": "60e6e0f067230326553fef06a25719c538bc8bd9c9a2de543adc3d846e121672", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686395, "uuid": "4333e896-55f9-4606-810a-88405d4ec990", "comment": "Malware payload (CryptBot)", "value": "b5e19334955cd572e8535063a7bd38dd6561d957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686395, "uuid": "9eb62c7a-3457-46cc-921c-b6b3387e271e", "comment": "Malware payload (CryptBot)", "value": "c27afd69a04b050ef5d9db5f43b5d47592dd9d8514ab2aa9ac5cc5338a0ab71713ddf355fdcf77156a48f821d798c64c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686395, "uuid": "3bf2c97b-7693-4acb-b8e3-f960d7109c0c", "value": "T188753374F34F7048E0EA12762CA35F077012D05716D1DAF2AADC6D4AAE7D805E7AA1E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686395, "uuid": "a48f7dbb-c4b0-4bb6-9dd3-1ec0c383636b", "value": "529db757e7e4b7a274b1fba45452e42e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686395, "uuid": "8e8533d1-1cb2-44b2-b54d-da644fa43f69", "value": "49152:ieeauf7eQ10Wt7NI/yotMGhlh4VNcOU7m6wPU:5eP37NfUlSYOU7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686395, "uuid": "225b22d7-da00-4d93-9af0-e00776e1000a", "value": 1663488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686395, "uuid": "c8455b96-e3cd-4edc-b928-b6cf5528b53a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686395, "uuid": "baeff520-36ce-42ed-a4b3-e91ff5609e5a", "value": "2283ad65576252b5a4f007cffb8e5d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be857284-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729105, "uuid": "fad061a1-a642-404c-b873-b13510a47662", "comment": "Malware payload", "value": "7b9cde17426d6d553e6c4969fbaa51a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729105, "uuid": "65d489cc-d881-428f-bac7-e33c30647081", "comment": "Malware payload", "value": "61078d7804eb6203dacc547fc1d9c44184462c29687c9b22b08f2601fbbb989c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729105, "uuid": "57afe445-830c-42f4-8cbd-c00587ec9776", "comment": "Malware payload", "value": "f796022170715d4f3989ba81f09001cde7ba2e8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729105, "uuid": "75706370-4d4e-4251-8cdd-6ee43e621bd6", "comment": "Malware payload", "value": "273b14f85a6586c8699c27cb685078590abe751b3001635605b4c6f2f959e0e607c1f6b84cc89ea24804e40b893dcdba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729105, "uuid": "230d4d24-c441-49e5-bac8-dd47f44cf1a5", "value": "T11B05BE1038AF66DEF0768BFE5DC8A9B18BBAF53A3509F1B91C810ED60751B419E11933", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729105, "uuid": "1c1a69ed-4483-4305-890d-3a1d22e223a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729105, "uuid": "550673b6-f510-4c9a-84cd-6e8999f282b1", "value": "24576:zK9mzAUCo+fpJ7wIespAsUBII7ZssX4Ip:zwmzAq+b7wIeUATBFZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729105, "uuid": "733fe291-797d-463e-a657-3d4d3a062f0c", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729105, "uuid": "aa70b3fa-0ede-40b9-a166-cf818e36fc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729105, "uuid": "e712f9d0-a2f8-483a-bf67-fe34e863f7a9", "value": "7b9cde17426d6d553e6c4969fbaa51a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8fcce9-95ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "d0128172-6a70-410a-9541-06dfbf853cec", "comment": "Malware payload", "value": "b12b3b97a3a5e6f64e2729451171b1a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "cbb466ad-8115-4373-bf8f-246d402e9496", "comment": "Malware payload", "value": "615114dae4677c708fa34defcc4492a8c31370423f999d75dfafc94bc2a25d50", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "5fd76add-a87b-4874-b42e-0af0eaa0814c", "comment": "Malware payload", "value": "d92efd183485f4269205dc8ff84b9b351173ab02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "ad313daf-d315-46a6-b564-08ee71ac690f", "comment": "Malware payload", "value": "5406cdd914457a809f969b80b431776121b226a5e439584b1c9c4bffbee4bc2ad9b15961ed6dcf85c4bde649f3f39fd0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "3b214f54-ccfc-4fb4-bf25-8686cf947735", "value": "T10DE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "4797792c-0c9d-4ba6-b917-d6da3c3a70f9", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "68c60108-398a-4c17-9ca9-f4d7ef9996b7", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XSsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWSa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732487, "uuid": "a942acc7-8254-4db7-b6b9-24a0276b6f3a", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732487, "uuid": "97abd50e-780a-4c2b-8b7a-4ca062f469d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "f8b849c4-d91a-4485-a380-4cfafc2e3363", "value": "emotet_exe_e4_615114dae4677c708fa34defcc4492a8c31370423f999d75dfafc94bc2a25d50_2022-02-24__195442.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27f0f2e-9547-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645689678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689678, "uuid": "fd146444-8028-4931-a523-2f2784c0e794", "comment": "Malware payload (Formbook)", "value": "84c6bff047365ad47b76dbcdde75ca53", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689678, "uuid": "978cc7dd-9910-41d8-8581-b6be95c11328", "comment": "Malware payload (Formbook)", "value": "6152ffed6344204d119c19f21e9115a41ae4eb8d5011f288144c04a651618c59", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689678, "uuid": "d0edb08a-031d-461e-8731-3fb5a520e190", "comment": "Malware payload (Formbook)", "value": "391c4f4150cf8dabb2c15972d4be8c9af292c3a5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689678, "uuid": "d9d07d72-c4ec-4297-bfdb-fd58a0a34ef3", "comment": "Malware payload (Formbook)", "value": "a1e5dc999818c663c26aeb7c56c86ffaf83663c0e5ca9d722a3d026e2922dba687e9199ae72de9dd987dc8b1d1265c5e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689678, "uuid": "445ae03e-a8ff-4ce2-bf17-9970e647632d", "value": "T13F51600E3447B41845373FB1EC1B446EAAA2728BA67980823B08DBD5097C02CEB91CAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689678, "uuid": "be4cb3a6-eb86-4cc7-8aba-ce10bdfe8b20", "value": "48:thu6yKjMw8NmZGYV4ckkMzI0vAcZOavbx4L2vki6mtKOdqqHAhH:C6x8NmxWI0vAehmL2ciIDqcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689678, "uuid": "91ea3f30-5cf6-4f00-af5b-71893c3aa025", "value": 2590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689678, "uuid": "a0298755-7034-4ac7-b294-8246f8513ba0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689678, "uuid": "55206a29-642b-4a55-8130-c96568fbcffc", "value": "\ud55c\ub77c\uc0b0\uc5c5\uac1c\ubc1c (2022-02-24).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a873156c-95b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738087, "uuid": "151a3f2f-7644-4cbe-86a9-93bbb96df4ec", "comment": "Malware payload", "value": "dd262c0d1c2590f9c07364745d429efd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738087, "uuid": "05653667-b0f2-4238-896d-7c082c72bfe7", "comment": "Malware payload", "value": "61600dc3164a22084558ffefdbb0e4cca987d9dc27c72fc4eff563d09131cf2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738087, "uuid": "60c6b0c5-b86c-48b1-91bb-7cbb00ef470c", "comment": "Malware payload", "value": "74d67bb9b987f3bafe1c97f44137820962a2213e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738087, "uuid": "09d0f544-5dd6-4c3c-a9f4-b26d05501972", "comment": "Malware payload", "value": "b85a1ce510657782c3f51b0ffb2fe3e728c88139845c810953c8132b559d0190574c1420d4b739d3ce82b5f433e4b8da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738087, "uuid": "0bfa5a4c-1f79-42f5-8b35-5cb2d9243817", "value": "T15DE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738087, "uuid": "f0553980-6d2c-4480-9121-450aff183aa2", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738087, "uuid": "459b8833-183c-4492-a477-c96785f1ffb4", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XvsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWva1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738087, "uuid": "a1b0c65b-6895-4073-bafb-f32610ca6c14", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738087, "uuid": "aaa1afb4-11e9-4755-b7c1-7b63ca5a5107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738087, "uuid": "ccd34c99-dc70-4e91-ae5c-3a1fcbae440e", "value": "dd262c0d1c2590f9c07364745d429efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c16391-956c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645705525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705525, "uuid": "18f06dd8-5691-4981-a7b5-b4d59d036892", "comment": "Malware payload (Heodo)", "value": "644ebd924255840062b28d0929b8d870", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705525, "uuid": "c3ee1c17-b4a3-469f-98f9-10179194d475", "comment": "Malware payload (Heodo)", "value": "61af9a078c8a2a04dbf46ea0c83fbd05aae179ad1ed593cbeda63fa1e4c3f24b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705525, "uuid": "3ec06971-4fb2-47ba-8fbd-fa1860412ce1", "comment": "Malware payload (Heodo)", "value": "65f0585b23628803c1bcd4ba334cc5773ff599c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705525, "uuid": "d61956c6-3f42-4908-b654-20d8688898cd", "comment": "Malware payload (Heodo)", "value": "e42428f569b2783047ebc8521f0754d09a269c54d49bfaccd664ee28485a68d8a5aeca33a3f840e5a2dc82c45c50e0d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705525, "uuid": "7b71c3c8-a6cd-4220-9ef3-0ff8edd4f6c9", "value": "T16DE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705525, "uuid": "4628ead2-3851-4508-9958-4104d30fe49e", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705525, "uuid": "2e20d64a-6124-4418-8c60-33d64c1ae680", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK+e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK+LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645705525, "uuid": "a683c805-57b1-40f6-b1f9-30e5c841a19b", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645705525, "uuid": "2592eb4d-b167-42da-8f1a-0876ffce6085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705525, "uuid": "73036543-82e2-41e3-a60b-ca6b744810ce", "value": "644ebd924255840062b28d0929b8d870", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ce1a94-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645723429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723429, "uuid": "7304afb5-9a32-44a3-b784-e7120344c850", "comment": "Malware payload (AgentTesla)", "value": "8904f75c37f8b0862b5660ea634b32da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723429, "uuid": "2e0e8ebf-9e17-4bed-b367-5a7dc0c7509d", "comment": "Malware payload (AgentTesla)", "value": "61fe696f1f01753b90b6054fc390025f644a69a8c85a89dc83ac76cae19f79fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723429, "uuid": "3353e363-77dc-4d88-a8d4-e5673c293034", "comment": "Malware payload (AgentTesla)", "value": "0e99d025badb8748e5ba2e8d0ae096565e7f5357", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723429, "uuid": "4a5a556e-fad4-4620-a1b1-9d5bc97db37c", "comment": "Malware payload (AgentTesla)", "value": "bec4c89f08e4f3b6974913f91e1bae1b30746a01804fd0d39e016a3bc0ee48af880b258fb414b3798dc9eb63764c83b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723429, "uuid": "54df8dc5-06fd-41ba-a40a-e670c1e6f718", "value": "T104D46D51BECA6EA1EFBF47B78361DA2D1126736D03A0A6CF6643019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723429, "uuid": "ffdec5e7-d6bc-44ec-a771-62e6dc439d62", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723429, "uuid": "f01f2eea-9224-4b86-8367-27eb49233b7b", "value": "12288:A0Ws7IMsR4yVld8bzbBSre7BY4ZyrE7K3yl8PeVooA/AB2LEJZEAQPUqjC:A0bskX1rBY4ZyrE7K3yl8PeVooA/AB2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723429, "uuid": "c2ee4fac-09ec-435d-a58a-bc05acb9725d", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723429, "uuid": "0d4dfa02-31d4-4cb9-898e-53fcf9b7a64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723429, "uuid": "95520750-3be2-4aa2-87c2-eceecaf83f9d", "value": "New PO.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20e87e3-95c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645743338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743338, "uuid": "935d1767-6c54-4517-aa55-6d589acbd7f3", "comment": "Malware payload", "value": "a3313b768e38dfa197cf6e568f288d4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743338, "uuid": "5e8782d1-c13d-4e77-9c23-27b2f99c21cb", "comment": "Malware payload", "value": "637f57d854a8174ea6eeaed1167ecc76d9e3686f6042a18e83f559de8503ddf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743338, "uuid": "bd378aad-916e-4f7a-ab55-df6afa3a76c4", "comment": "Malware payload", "value": "2f993014f10daf423d5a5ad76b63cad5c8f0b45d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743338, "uuid": "ea575b2b-f7bd-4573-ade8-206aef0031c3", "comment": "Malware payload", "value": "41cad98d2db944d752d173aa649418c037681982751e4d55777ae05c9306f638988013153b72690f2992393ebe5e7395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743338, "uuid": "f4d03285-0e94-463e-8dcd-fada824141cf", "value": "T1E335BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743338, "uuid": "14477365-740f-48c1-bf54-d548c41a90a9", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743338, "uuid": "a288acf3-0649-475b-a8c7-f9a2603ee693", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uUVOe528JO6PC:6iRGcUY0UvDYNFtuY5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645743338, "uuid": "ff37d79a-eddf-4318-b20d-ac8df7904790", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645743338, "uuid": "5ad98834-45db-4c34-83e6-612b1944d179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743338, "uuid": "d4ebe82d-8b4e-45dc-9519-402b6f94396e", "value": "a3313b768e38dfa197cf6e568f288d4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15900b6f-951d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645671268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671268, "uuid": "392a8e40-41f8-4b4a-82c3-c0d57509eacb", "comment": "Malware payload (Heodo)", "value": "2236eb6a3062fff12406626d11e6bcf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671268, "uuid": "fae82fd4-7d4a-4c4f-adf7-a10c14621986", "comment": "Malware payload (Heodo)", "value": "6434781e49efe0bfc160e9fa2d29769da55100e45699faee093efb1eb9097e5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671268, "uuid": "01190f76-ca90-4a74-be41-de56a316dbfe", "comment": "Malware payload (Heodo)", "value": "88a75568016685e47672c3c208202fbb85c736f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671268, "uuid": "9d3a95ea-6475-4de1-a03d-6e2325529757", "comment": "Malware payload (Heodo)", "value": "b14c02357ecbd963f4a3df986f31bac99c62e68432bf95f161a6901ba4992c3fd132757e78bc031d521c04e38a70cf0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671268, "uuid": "08bef68b-3694-4863-8bf0-7f6f840c38ae", "value": "T192E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671268, "uuid": "e5e5d29f-16e2-4248-ab57-f957d5947277", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671268, "uuid": "1374abe5-3261-45f5-9c0a-384df35da89b", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0+hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfGPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645671268, "uuid": "5c154654-0188-43a2-a5d8-7ae07b59a4b8", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645671268, "uuid": "55b1226f-a90a-4dc2-8203-439d2383c462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671268, "uuid": "a19a87c1-3368-434d-b050-d68f73f8ac01", "value": "2236eb6a3062fff12406626d11e6bcf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ead875c-9546-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645689054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689054, "uuid": "8e19de1d-c084-4a76-b556-a14aec38d1e2", "comment": "Malware payload (Formbook)", "value": "9afa54ca6adc21703eafa1444d025fb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689054, "uuid": "bb519a16-059a-409f-88d1-e3391919fb53", "comment": "Malware payload (Formbook)", "value": "64ac85dbe848795a0595a96f00817c5616387c26243081cfe33002ce9d89c4a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689054, "uuid": "d8004676-64bc-4185-a0ea-cd2777367bde", "comment": "Malware payload (Formbook)", "value": "23fc1a8eafc5d8693973ffaffc223cefc1c6cc13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689054, "uuid": "a836a306-ccf8-4f86-b323-fa8159df1d5f", "comment": "Malware payload (Formbook)", "value": "29f35f95d4dd1f23b526efbdc0356dcee7f96dd66c28d419075629459bd84925c59e54a765b43ebcc8f0393fee5338af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689054, "uuid": "c6c4b43d-1f4b-4cf0-b9bd-0266a9f2b990", "value": "T16664224EA1CEA43FE5170E3224F6533EDAF6FA243960344F9B614E66352C5C5CF48691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689054, "uuid": "9ee69af6-8ad8-4cba-88b5-636d8c08f6a7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689054, "uuid": "705ed767-91c8-4f94-b744-6d6e633c0548", "value": "6144:TxDSnoCdzyHDGdpA4+Zsr+Zzw9422AcY83T77qNbJyPYKM3Gmj5sDkQwLT:EoUyqdp3ksW22Ac3ad300T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689054, "uuid": "e7dbd2e2-3844-420f-bfd2-de9295f27cf7", "value": 324669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689054, "uuid": "dfbeced0-c0e3-4fa4-bb41-66f57f03a5c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689054, "uuid": "a141f6c8-bc47-4371-b9ad-4481c600b2eb", "value": "9afa54ca6adc21703eafa1444d025fb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142d13d0-95b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645734402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734402, "uuid": "3163384a-37ee-4945-b5d2-e9a47b77bb3c", "comment": "Malware payload", "value": "10a99eec3cc5e36a83d6d4567b44e31f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734402, "uuid": "abcbee17-749f-4fb8-8837-a8f93490ac39", "comment": "Malware payload", "value": "650ead3c915936ef5647b1e95b9c9e96784fa8db8025a1a7e9d806fc25ed993c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734402, "uuid": "4c4bb1a4-a666-42ea-87df-d3247d32a556", "comment": "Malware payload", "value": "0d56063e3e02538ebf359344e1bf0440de3aaa9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734402, "uuid": "50ed157d-e0c6-47ec-bbc0-c5741038f007", "comment": "Malware payload", "value": "8a862086e62fd0dfeed841ac4aa928490fb6099ee663437e00264bba222617a2aebe49aec5f82c359df11a3b8f20f07c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734402, "uuid": "3c3480f8-9f8f-4e58-b769-e1a23d4421e0", "value": "T1EEE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734402, "uuid": "106b8181-a03b-4d41-88c0-bb33a995917e", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734402, "uuid": "42bbd567-31dd-441f-a0f0-9d8eccbbd0f5", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XlsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWla1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645734402, "uuid": "73e7c439-a090-4bba-b91a-54b3795a26c9", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645734402, "uuid": "6abaf582-3781-4761-9adc-928f786e594b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734402, "uuid": "158a1f59-cf6b-49b0-b5b5-3f40e0c01836", "value": "10a99eec3cc5e36a83d6d4567b44e31f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97871f07-950b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645663756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663756, "uuid": "64c7d309-f3a9-4557-84c7-d1ae9802f59a", "comment": "Malware payload (Heodo)", "value": "e84112d3cfb092546473e9226c491328", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663756, "uuid": "2eeaab1b-908d-471c-960b-b6c4f341f20c", "comment": "Malware payload (Heodo)", "value": "6545936e4e0aa92c465bab4d0f9edc4bb87383d8d5bee33f2c5e8780dcda8f7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663756, "uuid": "b525958f-b900-444b-a4d4-af5994598451", "comment": "Malware payload (Heodo)", "value": "68cddeaa519c461db005bd86b4737287b7e425c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663756, "uuid": "b709403d-caf2-495d-a297-a53112033538", "comment": "Malware payload (Heodo)", "value": "60d4b514d15fc4f1d27429634af88c58359707e4ca356e76de2e7c9ae6a784751c25d8985ffff9fba5e46c6516d5b983", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663756, "uuid": "1a02f612-ca06-4f08-9fe1-b89d474ce0df", "value": "T11BE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663756, "uuid": "dd6ba787-1cf0-4e6c-b87c-1eebdbbc432a", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663756, "uuid": "8a5a2036-8132-4bbb-9731-a6709faa6a34", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKpe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKpLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645663756, "uuid": "d4e9bb32-91d7-41e3-bf9c-54c481cd57ea", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645663756, "uuid": "33d7d212-99d1-4c48-adc0-19508a6138c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663756, "uuid": "e7c53c1a-0b31-4d5d-8a40-c68144e5342d", "value": "e84112d3cfb092546473e9226c491328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8130970-951e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645671944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671944, "uuid": "97d057e1-79f3-4a0f-88e0-ea28313820f3", "comment": "Malware payload", "value": "863a5306f03af525f914712b34213e29", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671944, "uuid": "07452342-3d6c-423e-9a57-670ae5ef35d8", "comment": "Malware payload", "value": "65db26059d390e090df99ed95350a4d9f7d051601e2c2e54e7110a4ab27f194b", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671944, "uuid": "a82d5f79-c6d9-4862-b7ad-d474d7868d6b", "comment": "Malware payload", "value": "ddd9a26d4614766290267794efd2de964fde7980", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671944, "uuid": "0e5ccefb-49a7-4889-b2fe-f2421af4d04f", "comment": "Malware payload", "value": "ddcb53c25792355834a5e319201a690bf8082979d51317f6e0ad2a95ccf8f9953e01974ab0a40ac28866f5dcef41bf5f", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671944, "uuid": "d6e655d6-4519-4a0a-8d13-6f59eeaaaa43", "value": "T1DE51A80AFD47D14C9FB9232BEC978962FF1B801B9DA21048B1DDD2495F2080D96BCB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671944, "uuid": "5a7f10ea-1815-4c0a-8280-261f3abb3d4a", "value": "48:kxjEH8iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBoze:qdGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645671944, "uuid": "9031119a-4096-4d67-bd89-e7789372085d", "value": 3116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645671944, "uuid": "ebc43491-20a1-47c6-b5a3-193b0a489d6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671944, "uuid": "53e09769-3709-47d2-984c-215eac9ccb75", "value": "gj7x5yg4.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d26c89-9594-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645722706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722706, "uuid": "0f9a7721-6b57-446b-8c75-e1ce0fe5d119", "comment": "Malware payload (AgentTesla)", "value": "b7cfb7393bdf5a80ac608ca3bf1596c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722706, "uuid": "4076b79e-8591-4877-83c9-36a1c8e00aba", "comment": "Malware payload (AgentTesla)", "value": "65e58a5f446773f9ff1e6e0073a41f136d3eefcd641b4f04bb67e3e3fabba337", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722706, "uuid": "2e7c6474-3959-461d-9ad1-68211cda654f", "comment": "Malware payload (AgentTesla)", "value": "44cefe7f71edc92708dd9a5bc61ad3e26a7070b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722706, "uuid": "f45bd65e-0d1e-4d7a-9253-d70bdba100d6", "comment": "Malware payload (AgentTesla)", "value": "f3e10a4031332bbad756e3cc87c9de34e05aae46f5df06e8410913ee4bd5a760a27a163782dfbb60361e08aece82d845", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722706, "uuid": "8ab279ce-d37e-41e7-9a11-e7cb72622e61", "value": "T1B265CE0133FC0219F2FF6B7469BA1410AAF7B92667B6D79D0C54A18E1D62B50CE613B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722706, "uuid": "df3859d7-05e2-4e65-a5c7-98d877884d0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722706, "uuid": "8c2546da-2adf-4506-9a58-34ad46eee71b", "value": "24576:1/1pR8XncFEfJUN3cXQw/F57yAYAYthyzGz:1/vyoSWNoQaFVyAfiAzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645722706, "uuid": "6ab18b01-0cda-4880-8175-2f90aa2ff1b1", "value": 1435136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645722706, "uuid": "098d4eae-f6bd-4a85-a9d9-1b95bce546f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722706, "uuid": "f5f7648d-38f5-47e7-894b-6d1f38d36bdd", "value": "002273873653425_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18946521-95b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645734410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734410, "uuid": "b3e77f0a-9af5-4b44-89d2-c2b9a6706763", "comment": "Malware payload", "value": "bcac5e9f43e4ebea7fccd39059082209", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734410, "uuid": "f5e5fa8d-a277-4d9d-9879-fc98b630ce74", "comment": "Malware payload", "value": "6653c125deb96e5d9c0b385cc3e786ff3af8a785ac266cecfcc48da938299ece", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734410, "uuid": "2d4baba6-eede-4441-871c-b7da1b33d938", "comment": "Malware payload", "value": "b84d2aaf509b598685f3d7ed129ffc7a75322ae4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734410, "uuid": "02e4c99a-38f8-4ca1-b589-adb766a059c5", "comment": "Malware payload", "value": "731bd1bc9392f7c0bf7eea151b5709dabf75f670c530eeb5e9eab563b757173abadfa64f155ae984c94389678cd01742", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734410, "uuid": "ffb49c76-96a3-435c-a2da-86e4366992ba", "value": "T167E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734410, "uuid": "84d6b853-1607-42c1-b704-e013f1087309", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734410, "uuid": "fef83260-c356-4e3b-a63a-af291edbb305", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XEsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWEa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645734410, "uuid": "eec5bb67-1638-4538-a3e7-97159fc38faa", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645734410, "uuid": "ebc70d08-5527-452b-96c1-3b1b48b58b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734410, "uuid": "232be50e-9839-4585-88e4-b47d422dc0bc", "value": "bcac5e9f43e4ebea7fccd39059082209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42f5936-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (a310Logger)", "timestamp": 1645688822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688822, "uuid": "04ff1111-0e53-4f92-b925-d78db2a652c0", "comment": "Malware payload (a310Logger)", "value": "a8a61ba5fb7206aef73d98bb9e935d38", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688822, "uuid": "015ecf29-4c85-4850-8f7b-9efd6657b2ca", "comment": "Malware payload (a310Logger)", "value": "668113cf858c18c78e4e5c56b519c54940cc4e528efdc2a2177af6dd780725ff", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688822, "uuid": "437cc3c0-a788-44a0-9680-8b2b1b6d588c", "comment": "Malware payload (a310Logger)", "value": "4b99ed25266e8fc9a79318981954be52a4e5f4a4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688822, "uuid": "17fc2233-13c8-49f2-b588-2d4f3f6c3a49", "comment": "Malware payload (a310Logger)", "value": "2b0d34fc3f47185b2d8106ee6bb65afb218fcd85727590837782297f7c82e525c03a77c9a8eeefde9438958d15dd79b2", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688822, "uuid": "0f82b463-59a3-44da-9779-4c7117f19794", "value": "T19735E1443D6B8F3DF0719B714DC5ECB4BA9CFA232D09B77D7895224AC661B9088423B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688822, "uuid": "876a6965-b186-41b9-9ca5-986ab71cc60e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688822, "uuid": "63984cc9-c8e7-45e8-a255-6046a2f213e1", "value": "24576:woK777777777777LtRw4RaNz2gsATuCr8KomHA21zYBtCh3SW:O777777777777Lt78NqgLTdbQ2NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688822, "uuid": "3d5cfd57-c8f9-463e-a2d4-3b3b7d1924ee", "value": 1124864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688822, "uuid": "2d9038d1-6b31-456e-a196-2794b8d0c4aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688822, "uuid": "f8c1b41a-6e52-491c-a798-adbbb35f1499", "value": "HSBC Payment Advice 10570950722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9edf34-952f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645679171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679171, "uuid": "8308ec4b-dc6a-44a6-83d9-d98cfeb9285a", "comment": "Malware payload (RedLineStealer)", "value": "d0fbe5065e8bce53858e396833b7be2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679171, "uuid": "325b419b-a766-4ba8-a91d-a03adc4b39ff", "comment": "Malware payload (RedLineStealer)", "value": "66c2d16720a324ba29f89aeabfeac44cceb594fae97684f6b903bec8b82fbf49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679171, "uuid": "c42813fa-1ef0-4f5d-8c50-e9fa8badab57", "comment": "Malware payload (RedLineStealer)", "value": "fbaa9dde6a93e15e7a70e010505eeaae6041f4c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679171, "uuid": "c4ff1604-2051-4e17-a153-a546d25e6c86", "comment": "Malware payload (RedLineStealer)", "value": "e19ef97a341156c6c6264eee7b4956dadec706deb80f746957ff96db4663b576f7c2cdd8e5039c439e5fb8a28563424e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679171, "uuid": "e82e355e-6d62-4346-9207-4c5e6741c7f4", "value": "T168B533CABF54E1DDD47B607CDC19680D1FA0A8762D2969046CA304ECB398BA48D53BFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679171, "uuid": "03e95f58-6e0b-4290-9b02-6bb560dd87ae", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679171, "uuid": "4e37e019-6406-4fe6-aff5-ed48df9bd6f5", "value": "49152:G9VXiaWDD0Pd9Wvie7DBJMdVlOIqjrODzqNCU/ao/WNaYdNn:GjXz2D0Od7DYdVsmyaoyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645679171, "uuid": "85228d09-6c42-4d0c-839c-d6e8049425bd", "value": 2390528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645679171, "uuid": "5e2a3692-db6e-41dd-80c2-77c8e5d5e486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679171, "uuid": "ae1d81ab-7cf6-4b32-9bda-06fcb6558da0", "value": "Mega Downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497ce6f4-95b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645734921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734921, "uuid": "a3f3c65e-5923-42bc-bbdc-e47a98a63533", "comment": "Malware payload", "value": "deaf0275fcbf34adbd18e8371ce0f861", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734921, "uuid": "dc91458b-0b38-4b9e-8c31-1056b9c68b67", "comment": "Malware payload", "value": "678208b328939285478da51a94da5ee4a87f7146083326b53a72546a0bd0f12d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734921, "uuid": "28e14ba9-4968-4f01-8519-23e7473c9ef0", "comment": "Malware payload", "value": "e93b1474103a0f9439a92c884ea5587753d50c53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734921, "uuid": "6e8667e1-e08a-402c-9282-4fed4e72c283", "comment": "Malware payload", "value": "60804d0398cb96133775257f14d87fda77e58cc786c3ef9d5f6522a4a96f1132d0d1ea52307fc600e7ece50d8dd6d599", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734921, "uuid": "faf8ac5e-7cfa-4e52-bede-4ad5ecc40e1a", "value": "T11FE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734921, "uuid": "56512f85-ed63-44bb-8a5f-8f0fe6b21620", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734921, "uuid": "bf871ad4-7233-47d8-ae7f-b9fc8a448166", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XGsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWGa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645734921, "uuid": "995513d4-938c-4bd2-8d3c-12fd332ab5ec", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645734921, "uuid": "ad312828-7969-493f-b559-4d6487e08c24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734921, "uuid": "965853a9-46a8-45a9-8b61-edec9419d8cd", "value": "deaf0275fcbf34adbd18e8371ce0f861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8782c645-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645692935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692935, "uuid": "be74203d-5cf7-41e9-b978-d25a68e7ff40", "comment": "Malware payload (ArkeiStealer)", "value": "b0c2eba56f73d378b62b5a35728aef0e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692935, "uuid": "8a4ef782-74d0-4509-a9bc-da89e079f54c", "comment": "Malware payload (ArkeiStealer)", "value": "67b09216b867762a76b904f40e3574c3ffa4bbbc183d954d30442757f6bb73ae", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692935, "uuid": "7ccd4830-dc84-4c23-aba5-3072aa12e71a", "comment": "Malware payload (ArkeiStealer)", "value": "16f926fd8c7502efeaebf0a8796804d92bc28a4a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692935, "uuid": "fe24d10a-d3ac-48d8-b9f2-96ffcb452845", "comment": "Malware payload (ArkeiStealer)", "value": "06060ba55441b78455c78de6d90d9258c802836da6d4703a74e2aa4ef914bd477447df0f78f29858a5f593cacd9f9971", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692935, "uuid": "9127d82b-d63a-457b-8cd6-6cc8b8cfb7f7", "value": "T12554BEF17A51C475C0463531D82ACFE01AFDB861CA641A4772B83F4EFA722D266AD24F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692935, "uuid": "80f533c0-b5f9-4f23-a49d-f4906184dae4", "value": "83a71afa38dc72d24820578696a17db4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692935, "uuid": "182f6bf0-b094-4950-ada8-82fe7f70bd1e", "value": "3072:OTNx+Xnmio5EZuQKwiZtXnz4UYbUsavBj5RVggjcGkNIVqIOM/h3TcLn:KPB5ExKZt3z40sar7ITsqxKcLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692935, "uuid": "7962a872-b63c-4e8b-b756-c18842998d21", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692935, "uuid": "6932e85f-a58d-405c-a8f1-29f7e9aa2035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692935, "uuid": "bdfbffd6-9098-4659-bb59-d33cdd63d184", "value": "b0c2eba56f73d378b62b5a35728aef0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14989324-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "6af6c6fd-32f0-408a-9cf4-71fdd9177def", "comment": "Malware payload (Heodo)", "value": "9d2ca737421fead964e23447da3a8259", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "6774e35d-8716-446a-b2de-fb0ba74b50c2", "comment": "Malware payload (Heodo)", "value": "67b8331b364e06211d00fc85aed7dfae5a9ae0a084a42cf76f8870cc0d3bc289", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "44cb5e60-a3f5-40a8-941b-c482f058266b", "comment": "Malware payload (Heodo)", "value": "40b1feb1d14df1e8ddf7863277d1940109dd00c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "501014bd-3eab-46bc-8da3-14ee24360f47", "comment": "Malware payload (Heodo)", "value": "2ae9e842cbdac373d4e6e81a9196cd46fcac183437f243f637d383215f8d4af0145cc5748650c41eeba4e537e1cc493b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "ee1560b0-cfa6-40e7-a6a9-e1afac1a5f78", "value": "T146C4AD507B81C0BAC35E30B1451B937A62E9A5749F3897C7BBD44B3F6FB80D19938219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "917552fa-ffbf-41f9-a8f3-52c8a8e52025", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "1f295a44-aeeb-45b0-9da5-e4bb575912d4", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XYsD12m1yMu0b:JzpSPdDBQTFIy3mFWYa1/cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697896, "uuid": "e2ff542c-2f4b-40ba-b7c7-f8be49f0d1ea", "value": 552235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697896, "uuid": "9f990f2e-a60e-4e68-93c7-3d5493d05d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "56af73c2-4f2a-4977-abb6-b259e85a9e45", "value": "emotet_exe_e5_67b8331b364e06211d00fc85aed7dfae5a9ae0a084a42cf76f8870cc0d3bc289_2022-02-24__101809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a598d6-95c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645742191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742191, "uuid": "88dbc979-191e-4969-843b-e55d7d01597a", "comment": "Malware payload", "value": "b97131e5da20d15fce8ecbb7540908c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742191, "uuid": "3232aa0f-3300-436c-bf94-a735d1cab58f", "comment": "Malware payload", "value": "682738b929dc2a9a6a97bcd58b8d75d7d7ec4f0c5ea633e0ca58895d30fdf440", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742191, "uuid": "f7ac0a0e-9510-41ab-8c63-620283c353c2", "comment": "Malware payload", "value": "6eeea5e85e66ee27d5986f40b1955cb8017d5b44", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742191, "uuid": "61d4c354-9eb6-4740-b0d6-2953c7ec53fa", "comment": "Malware payload", "value": "0b9d7b9670b81de68d3128a4679f7a66771cffe0610626e5b5d4fadccd04cd3ce3c3dc8d686827d828a75cab5cc07b32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742191, "uuid": "6c3fa216-f8c7-4ac2-add1-6a4aa342b8ee", "value": "T10635BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742191, "uuid": "7940a36e-e65a-463f-886f-86920414343e", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742191, "uuid": "f94c90aa-082a-4477-8117-d3eaacbab142", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uGVOe528JO6PC:6iRGcUY0UvDYNFtuG5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645742191, "uuid": "e13e351a-604c-4fa0-ae66-f6064369474a", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645742191, "uuid": "43148a34-9022-4878-8db7-3c280768a94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742191, "uuid": "204ace0f-ab1b-434c-8e8e-8be3eeda0b64", "value": "EyCqLihrF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d971df0b-9533-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1645681046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681046, "uuid": "eba56505-eb27-484d-be38-8798a26911f3", "comment": "Malware payload (Pony)", "value": "62c766ff6525a05483e9b8ec2f13c050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681046, "uuid": "49f66a71-10ff-43d5-870a-110c591cf67e", "comment": "Malware payload (Pony)", "value": "68b44c46b4512112874ba35dbb4c7ea1e97d900428d0fc9ce0b04aea615d073e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681046, "uuid": "4125a9da-0cc4-4946-b8bd-baf95ee2e514", "comment": "Malware payload (Pony)", "value": "40485d4229762a03b7fca40c8f82d04884936363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645681046, "uuid": "4d209283-9134-43ad-9656-185f06b6a765", "comment": "Malware payload (Pony)", "value": "20403234bdd92e53dfd0a8e15eb9da8b4356e16881a1bd2bab925d6b2848f94196447c326dff30f3bd9a8f1d8baf6552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681046, "uuid": "52f721a1-1515-4e2e-a4d6-d8b316744647", "value": "T164931903F480E0F1D1A22AB177C11771EBF89E697C768D4EEF8D49856DB26977B12042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681046, "uuid": "812eeed8-6fea-4423-b5a5-9c0cba1ff502", "value": "728afd0aeb7539a2a721ececf5f36865", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681046, "uuid": "ffd387e1-30e7-466b-abac-470425df44d4", "value": "1536:x3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEIy9kzZ3:9dOy+ubiDBzv+1H4OgYEIy+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645681046, "uuid": "10f059c2-bfb7-45a9-b597-b907a07cf957", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645681046, "uuid": "9f57000b-f5d4-4ba5-bd7a-4498997b39d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645681046, "uuid": "0e52ec8a-e191-49c1-8eea-3990df2bab79", "value": "68B44C46B4512112874BA35DBB4C7EA1E97D900428D0F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f9fef6-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "f3d070ac-addd-4e53-8e16-f8eba6c540da", "comment": "Malware payload (Heodo)", "value": "f7f82fdca70a07b005dd20de4f5081f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "2d1acab6-c576-4c58-8685-9d7e96d1af6d", "comment": "Malware payload (Heodo)", "value": "691665fea65a07d8fa3668e5dc43cdbc6a6711b7e19a1e6a4789af7be450a347", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "952206d7-f6e7-4fae-a3e7-bd1cc59315db", "comment": "Malware payload (Heodo)", "value": "a4172f899fd624846d11bab1f54afbf3fe291f55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "984231ee-dda5-44db-816a-e775b4be0921", "comment": "Malware payload (Heodo)", "value": "f5f2afb95e91456e76360754c602fef7ba58ef7d1d63668238051618504aef5caf41c335fe4fd092658dd7acb8b4b98c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "597319fb-1305-49e7-9acb-983bcb73cc20", "value": "T1E6E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "d0607932-bc10-4faa-844c-6a67451ac9f5", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "45cc79a3-dd03-493b-9c1b-1c86904fabd8", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKDe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKDLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660939, "uuid": "ae91cd86-3910-4e67-a921-a9e2b691273e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660939, "uuid": "03ba860a-ca76-4691-bd95-0e828049795c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "8e096e5c-7fb9-4d49-8c8d-7ce3c5f583c8", "value": "emotet_exe_e4_691665fea65a07d8fa3668e5dc43cdbc6a6711b7e19a1e6a4789af7be450a347_2022-02-24__000211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046675d7-9541-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1645686702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686702, "uuid": "e534f861-9f5e-4afd-9254-f459df32b516", "comment": "Malware payload (Pony)", "value": "8c1580411a7d21d740f1ed7c243f7060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686702, "uuid": "bb55e81a-515d-426a-992d-a24f038d5a7d", "comment": "Malware payload (Pony)", "value": "69ff8732173d5e24f543bf6190f1a9143a91355b93d5a80f55587f1868ed4968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686702, "uuid": "f9ede63a-8c91-47e9-8db6-1c42cbd95017", "comment": "Malware payload (Pony)", "value": "ac183ebf24df1f2391b42ba861eacca8291301d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686702, "uuid": "9005d14d-97f3-4f1f-b9b1-4ec638a05bd8", "comment": "Malware payload (Pony)", "value": "32c291f62ec09ecb1a1591347d1684f39f9e0ecd6b3298483e0de4daeb08e0d2e370ac826c20bff32fd893d1f4b0fcb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686702, "uuid": "7b2761e8-6947-424f-8c4b-97a9a579e6cf", "value": "T12F931903F480E0F1D1A22AB177C11771EBF89E697C768D4EEF8D89856DB22977B12052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686702, "uuid": "38a86e5c-38a2-4bc2-9f33-ad17a0f80572", "value": "728afd0aeb7539a2a721ececf5f36865", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686702, "uuid": "5997e365-8d4f-4992-b977-5d9be87479ee", "value": "1536:x3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEI/kzZ3:9dOy+ubiDBzv+1H4OgYEIw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686702, "uuid": "bf3dd54a-b964-4252-99c2-fc7e07d3b6f4", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686702, "uuid": "1aa636a0-2fae-464c-8461-cf271db79d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686702, "uuid": "7bc79da5-35ee-4229-b542-979634648615", "value": "69FF8732173D5E24F543BF6190F1A9143A91355B93D5A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a22b9d-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "5d2efade-bf5f-4f04-8f87-955bd0c001c5", "comment": "Malware payload", "value": "7229cb8c1094f44d21b55c1ebf66467b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "bfd1767d-3df9-4bcb-9d1f-195cbb035b7e", "comment": "Malware payload", "value": "6a1973abbcaac7e3ccdc749098ed7af24dea19e5c7efa45a6fc88fd166b2ff3d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "f462f380-266d-4e35-ae63-45bb9b1a7f64", "comment": "Malware payload", "value": "e8082400afa94c0f2b2d045ab12888e9e291b82c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "c865a4d3-2826-4931-83e3-6b3f09829ae2", "comment": "Malware payload", "value": "8d27ce07b7333d960f3a96600b7ab9b51a91c74ecc7df652dabbf93e5a7a01572e5193824fa63bd9d845aaecc1cf7958", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "cf43cca7-33e4-48bd-af45-6b5de2082a04", "value": "T16535BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "af0a9f77-13d4-4479-9905-1483a81bbb38", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "867b484e-8188-4b8b-be46-48febf5b80f7", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uRVOe528JO6PC:6iRGcUY0UvDYNFtuT5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738718, "uuid": "901c51be-1bda-452b-9f95-cff36f9bf5d8", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738718, "uuid": "d04676a4-9b0a-4abb-a2ca-43c1bffbc7d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "10b0daa6-9acc-41c4-bc4d-05e72854d5c5", "value": "emotet_exe_e5_6a1973abbcaac7e3ccdc749098ed7af24dea19e5c7efa45a6fc88fd166b2ff3d_2022-02-24__213828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f81ec66-9550-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645693163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693163, "uuid": "8e8b8dd9-83a3-4b1e-b27c-f8ae3e379c77", "comment": "Malware payload (Formbook)", "value": "5265cdb801f41e79548c97537eaf5f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693163, "uuid": "8885305b-b39c-4143-9f8f-e21394ce1ab6", "comment": "Malware payload (Formbook)", "value": "6a89b5f89e4b2f1abc1407e26b6b8dc7855d153a6c7eab878106f9fe93eb876b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693163, "uuid": "90c067f8-3127-4b17-9d2f-8bf58900e9df", "comment": "Malware payload (Formbook)", "value": "f0b15f7385a1f81d36aaf617958a2d742400dd31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693163, "uuid": "378ff0cc-0096-48e8-b54f-ece9dc9265d6", "comment": "Malware payload (Formbook)", "value": "173c408d5c8fa7bcf17e8f94fd2d3e4d2e1eb83766d1e8a2a8270cc1514ba5f8993d2fc4232bcb74c8b54dd29c9cd547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693163, "uuid": "955609fe-7774-49a4-b15f-6f1777be3fdb", "value": "T1C8F43331AAB04632C99EE6769E1913004271BA0DF97F9C026FE9464B5052BC44FEDE7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693163, "uuid": "8acee402-43c0-48ab-811f-db9cf5d31fde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693163, "uuid": "7628a642-a892-4f97-9b2a-100bfa30a709", "value": "12288:psFvGA2pPWSfpwA7MiEGtK0hbs9JInDVuXnIhoQGqWcBNdTgDWdKfe:pI2pnCA7rK0ps9JY2K/l/BNdTgwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693163, "uuid": "b69b169d-7203-4630-bd41-c1a17e1d3c91", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693163, "uuid": "97ebf0ea-18c7-4fb4-8d6f-a62d0c41566a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693163, "uuid": "843fa333-be4a-4568-b928-4de8662495ba", "value": "5265cdb801f41e79548c97537eaf5f7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b740459f-9562-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645701175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701175, "uuid": "962f053b-86dd-4322-a843-0ba309c54245", "comment": "Malware payload (NanoCore)", "value": "5c814f840eb7cc1f5100397e8ed177bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701175, "uuid": "4ecfa31e-c920-41fd-ab64-e040acfffcff", "comment": "Malware payload (NanoCore)", "value": "6ac1a2cf42770c687037eff47a6cb035bfede0b0e0da968775b442fb4e39530b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701175, "uuid": "b258f135-9a3a-47a2-ad90-952bd3baa8a1", "comment": "Malware payload (NanoCore)", "value": "3fbb563d0708ab8b7c9ec97e31bd56e380e8772d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701175, "uuid": "e9037b44-8b07-47bc-a8ed-469d76e4d82f", "comment": "Malware payload (NanoCore)", "value": "8106b099f9a026fcc4c0d6f88ac239b9be38cc709904ca32b19c940a612991c212f905a517efa696e2fd0e4d9b7b3e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701175, "uuid": "e844f8b0-4b4d-469c-a535-f4b4001cf33b", "value": "T1FA05CF1034AB60DEF063DAFE9ED8FDB1CD2AF53B660E31BA20460F564B09941DE12576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701175, "uuid": "1ca3fb1e-11db-465b-b65d-7cb54bef7d24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701175, "uuid": "f18b3e79-137f-4278-a937-6ee6c3de3fff", "value": "12288:EMvKdD/LkYNNvP93wsWksEBDX4/P90VHLEWv9F1wbk1rBZd55dyBSBmRVQdYFEJ7:QbL7NvPlX3I9mHLFBrvd5nyBw8mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645701175, "uuid": "ea97b789-ec98-4b45-8125-25027e377929", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645701175, "uuid": "ab5207d2-590e-4408-8050-e8bf12d7e823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701175, "uuid": "e65b4b63-9f6b-452e-ade7-86b08c56953d", "value": "plugmanzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03c30f1-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645698184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645698184, "uuid": "a224bd86-986b-4d6c-8bc0-db1350d0bd2d", "comment": "Malware payload (Heodo)", "value": "0a25ea1a089364ec40db60664eb164f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645698184, "uuid": "76c92672-29f4-4732-87f0-80697c513f01", "comment": "Malware payload (Heodo)", "value": "6aec2cb3f1301c3b2092d2b68af039c2a0b6c1b872dd05b17021caa473dd2756", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645698184, "uuid": "df16b298-2ce7-400a-8245-b67608a5bcda", "comment": "Malware payload (Heodo)", "value": "9c611577948e6e83681bba70d30bc8c99aae058d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645698184, "uuid": "69d9e98d-4d9e-4393-9ed1-64c834b1ba25", "comment": "Malware payload (Heodo)", "value": "06c219c728dc7c67d993ab59a64550949637b5138c70e3379916fb4378a803ff81b2379e2086003e8dcaae8053310294", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645698184, "uuid": "70444f2f-b2b8-4b05-95fe-f0975e39da84", "value": "T1FCE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645698184, "uuid": "104dea7e-a7c3-47b0-8844-1561ca8906dc", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645698184, "uuid": "8db66a78-e9bd-4559-afc8-abf2a843bee1", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0uhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf+PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645698184, "uuid": "14a96997-7f55-45ea-9635-3890e7ff5e09", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645698184, "uuid": "d94a2b95-cd6f-44da-bb32-6861d09517ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645698184, "uuid": "877ff2b9-da2e-43e3-a917-9c9e07f91533", "value": "0a25ea1a089364ec40db60664eb164f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d39b165-9556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645695951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695951, "uuid": "3b4f2808-1abb-4eb1-9a9e-07630c1aaa5f", "comment": "Malware payload (Heodo)", "value": "edea9a57fcb42e9831f3a0ca9993bddd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695951, "uuid": "f15c3d7c-d508-411a-a549-23890cb97ff2", "comment": "Malware payload (Heodo)", "value": "6b4af4453203d531c1b71b17699939aee7c487e39d218b40405e114ec7330232", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695951, "uuid": "c7149077-c7c6-485d-a3f6-e638fa234daf", "comment": "Malware payload (Heodo)", "value": "c4523d237b7658feef0d98f3bdf37bf97e66c52a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645695951, "uuid": "b359d50a-16f7-4e3a-b529-94270069395f", "comment": "Malware payload (Heodo)", "value": "dd30d8c3196a668d849d6a5ccf25552234365d90a9725c52fcfaaf7c65a8c0a5cbfd9ba2643a4fea9bcd9f23b10d2839", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695951, "uuid": "10e9daad-3963-4b03-a81a-b258bfe2b627", "value": "T17CE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695951, "uuid": "c3ab3b81-6809-47a2-af05-fbbe918928c5", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695951, "uuid": "2519dd63-5074-473b-8fb4-5e066f4404cf", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKle/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKlLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645695951, "uuid": "27f25539-1f4f-45da-97a6-8e5b0b6c7ee5", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645695951, "uuid": "671ef6f4-7bbc-419a-9aa3-92cfa1b5891b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645695951, "uuid": "2a2f28f5-3332-4d37-b2e6-4809cd366894", "value": "VUaes1hP3pJrQng.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2105b7a9-95c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645744302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744302, "uuid": "b0c52f2d-647b-4473-b017-75b1e1904697", "comment": "Malware payload", "value": "8a24f37b53b98e85a8fc7f6d7ee9d24f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744302, "uuid": "9a4ec65d-73ac-46cc-aef6-7ec6e759e953", "comment": "Malware payload", "value": "6bb1d1d82641554c75a20add41f7fcd1f3c1e8e84b8d2dc9faa87683db7897d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744302, "uuid": "affa66f6-3ded-4fcf-be70-e8e11a03db55", "comment": "Malware payload", "value": "e83c133fa27fb73086c1c7fea0121b41c5ed66b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744302, "uuid": "434b4eb2-ee2f-48d6-8b2b-ffbcbd7239d3", "comment": "Malware payload", "value": "d2b2d8bfd7325fb8f1345e854e7913cea196c876b2f991ccd3db4901aaf76db348528b4b7cb66939f65b88e3b6039e92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744302, "uuid": "b1c5afa3-561b-4b82-b642-349920ebf21e", "value": "T14735BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744302, "uuid": "1796d364-5ae2-4d0f-bcd6-5c6e67b21395", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744302, "uuid": "25c4f2f4-f8b6-44e0-9b70-d15ae969d609", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uxVOe528JO6PC:6iRGcUY0UvDYNFtuz5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645744302, "uuid": "2a8c8795-b25f-414d-a9c3-0c18fe7c444d", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645744302, "uuid": "0d0c8b58-6779-416b-bc65-ba1918e766a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744302, "uuid": "de448741-593c-4929-89fe-3116802d1d0a", "value": "8a24f37b53b98e85a8fc7f6d7ee9d24f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8c737a-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1645688190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688190, "uuid": "3c95d2a7-a989-43aa-9dc0-d5524f13f316", "comment": "Malware payload (Socelars)", "value": "529a4f3ad6c48f4409949ea3218f0219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688190, "uuid": "dbbe39f5-0570-4ed7-9648-174b18c2139e", "comment": "Malware payload (Socelars)", "value": "6c0c4f980c449d50a1d28f35f124c59d81af1c8515e08925dfd141c76f714e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688190, "uuid": "856a26c0-4280-4f05-a3e0-127d9c514a4b", "comment": "Malware payload (Socelars)", "value": "8490b913ee3255289de8ce0ebd0aa599d8dddbb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688190, "uuid": "0488defb-c7a8-4284-a5b5-ee12762eac75", "comment": "Malware payload (Socelars)", "value": "15013cf1190a3ce1aeef7698260cc8223f820d6f9877bb3cd9d1c096c5c82c34641c2a140a434b6321664479aec2d8f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688190, "uuid": "1579092a-da60-478f-805e-698cc96b86cf", "value": "T18F658E16E6829036F8D7087292BE1ABE8D2CAE51031850D7D3C47B695BF15E33F326D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688190, "uuid": "38beb85d-31dc-4f39-bb20-d8a17a8ee488", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688190, "uuid": "d430151c-c552-43e6-9e32-af7ac8f693c1", "value": "24576:SOpDAMk2izEnuE9qHx8vLKQW5jssUZsMkvvnXQXYpvC9Kxs:Zp7eL+ev+EvnXQXY5pxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688190, "uuid": "a066ed82-b642-4ec5-959d-a5656101a3e9", "value": 1526272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688190, "uuid": "02dfe835-d3b4-4b10-b59a-54255f954131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688190, "uuid": "e4248718-47b4-4b8d-a7e0-c1f458e3d649", "value": "529a4f3ad6c48f4409949ea3218f0219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cbf718-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645723322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723322, "uuid": "175f8938-3652-43e7-96f2-bc25c89ea34b", "comment": "Malware payload (AgentTesla)", "value": "573ec5f357291a93b254ca32390d4782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723322, "uuid": "c6f54daa-0d25-4f60-9a88-d7830906fb5e", "comment": "Malware payload (AgentTesla)", "value": "6c150a42451298a43599d22fec5e2639104967219bd10470648f2af7ba03e0ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723322, "uuid": "2026fd73-076d-468d-adae-8a31c07d51c6", "comment": "Malware payload (AgentTesla)", "value": "312406f00bce721739bdccb97cba451f275229de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723322, "uuid": "47288745-8ee3-4aab-9892-175c39973d44", "comment": "Malware payload (AgentTesla)", "value": "69bd52d57db92021b982125266d5d2c5303b9facb5e4bdefb02d2ff62985c5bed1897e0d9e3bca25fa6bfcd78f24b961", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723322, "uuid": "9506b869-d731-44d9-99dc-9d59cca6d16b", "value": "T11B1412623681C71AF668003D0BFE12246FA9EF354465A64F0DE2774D9D3DA5DB0E832B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723322, "uuid": "803180f4-4459-41f4-b561-2b97a36d0d84", "value": "3072:4fB2moDleqfdkbJ0dX/BnYB5YZeK/OmAiDu0A5pazzbjhswjLjce5sI8UeMZzdFV:MAmtBJ4P1YkMmAzmJswjP5le0oej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723322, "uuid": "47922256-73b5-4e38-a81b-cb2ae63f60fe", "value": 191080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723322, "uuid": "b39f6e43-e3e7-49a3-9057-df0df7b7b5f4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723322, "uuid": "347372f2-fa8c-421d-8c6b-7c8d0b53542b", "value": "Swift MT103.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210013ae-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "44d5362b-6ec5-4ebf-bbb5-dc85c63c3010", "comment": "Malware payload", "value": "086cb3f0f472a9cc335ec26b3373f2e0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "e011c53d-4d80-4aca-afe0-35a5f7fb168b", "comment": "Malware payload", "value": "6c3d47fdf31ecd5ca56f549c06f7ca8241c27eddf633dd16e17eb510f9599d44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "cd30408f-093c-43c4-a49f-5e9adb5c8439", "comment": "Malware payload", "value": "06ec62ac3b72d67dde79a2740322863e3dda18d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "9277c3bc-d591-425b-836b-282fb1ae0ad5", "comment": "Malware payload", "value": "865602c18aefa7c48eb4c11179e945677a396dd69236f0122a5b5c1763050903a4e3d1cd7998d6246ecb07b556968c64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "bb695d2b-65c7-45f6-8176-243a97b12e27", "value": "T15035BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "6662b6fc-119c-4600-ad0d-c81532cd106c", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "2074db29-f662-48db-acd8-957b1803e314", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uMVOe528JO6PC:6iRGcUY0UvDYNFtuQ5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738719, "uuid": "a1057c76-f6a2-4846-a7c4-d9674fc6fabc", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738719, "uuid": "450d4a7d-2224-46c2-8053-d8971d790333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "dbd526d9-f5b8-468f-8f84-cac1c677ad43", "value": "emotet_exe_e5_6c3d47fdf31ecd5ca56f549c06f7ca8241c27eddf633dd16e17eb510f9599d44_2022-02-24__213830.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5003150e-95c3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645742663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742663, "uuid": "1e9018fe-8fe2-4083-815b-726a3897eae1", "comment": "Malware payload", "value": "b4b397413ca8c29092e1b42036cf0b2d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742663, "uuid": "5fb28105-9fbf-47a7-b80c-76dbcfc5b59c", "comment": "Malware payload", "value": "6c7fce92c74fa2c35cfda44965c9cd267fd12cca209c131ec689f46f34ff26e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742663, "uuid": "6e81ad26-75eb-43d0-ba50-95c251209882", "comment": "Malware payload", "value": "91360f81a57704d94fd4240b4e0087213603f787", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645742663, "uuid": "3faa1323-4f95-4412-8bdc-7241b63f0e99", "comment": "Malware payload", "value": "61a2127ad83db71d713925f9526b3cabd73ec397f5419636d9f1c1aa47b7f6104243b4f2af5ee42b41528eb37c299486", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742663, "uuid": "ea6d4c75-d2fa-402f-bdad-8e8ae75233f9", "value": "T10893025E932E44BADBF60034B10C95D76E0F9D070009E98904E5B69A5F7A5DA4F2ECFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742663, "uuid": "742616ec-9207-42f9-a446-0489265600a2", "value": "1536:lNrCX2N5nyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xX0sw:l142byVEoBo6hKb4llGsQjbxBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645742663, "uuid": "422f4d74-999c-42d2-bb33-d4f068459177", "value": 93381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645742663, "uuid": "e60e0c8e-5d52-4c9e-8321-7a688d896f83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645742663, "uuid": "69a862bf-dfda-4174-968c-e9e442cf9840", "value": "Contract - 2022-02-24_1712.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a8380f-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687689, "uuid": "44df1664-1739-4ce2-87ed-7f5a23d1d2a4", "comment": "Malware payload (Gafgyt)", "value": "992df781765a9c0042e37734527be12d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687689, "uuid": "c0fe3188-a451-4b20-9afc-e03acb99411f", "comment": "Malware payload (Gafgyt)", "value": "6ccedffe30ce30b7abd5787ce7b24ed939b519c4faaeda2df2cf68f48a8e5cc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687689, "uuid": "33a19f76-962d-4720-a44b-73e3b7a55724", "comment": "Malware payload (Gafgyt)", "value": "b94911929f4c597c4c319694abe3b9359c206439", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687689, "uuid": "a2c1ecee-b6d7-474b-8923-89ec0b29b902", "comment": "Malware payload (Gafgyt)", "value": "fd8b45d8dd3b9a99bbba1a60f99a98b0dac0f209857098b5963395e1dbc5fcd25cc0a9d7c53c3a07c25b7c1d4337028c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687689, "uuid": "5af521f1-6f52-4582-95c1-06f47768495b", "value": "T186E33B09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687689, "uuid": "932f78fe-9270-4bbd-a0f2-b65c1bb9e98c", "value": "3072:Fn7aKpF4LSV9OdAKoxXcynnFEM/9ND4bwN/YxzqmpwfvRQfZn:57aKpF4eVZKoFcynneM/97mpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687689, "uuid": "20ca828b-7768-4c11-8637-14f05d0b86b3", "value": 150378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687689, "uuid": "df9295d2-c97a-4390-940e-737c6ef9f3a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687689, "uuid": "57fe3d22-dae6-47ee-9b4b-c881a75eda09", "value": "992df781765a9c0042e37734527be12d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f0c07c-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645692885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692885, "uuid": "53bf6b12-cd40-453e-b533-357df51aac43", "comment": "Malware payload", "value": "79e9b2168ca3e2bef4fc853cc68bc5c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692885, "uuid": "cc765010-b59b-4b3d-b17e-37585692885b", "comment": "Malware payload", "value": "6cf8fbf9bebe452e9221aa717b0ee224a0ec6bfda7269bd745bb736b7b2fdf8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692885, "uuid": "98bdd463-7612-4ad1-b9f6-973c2f5f7bb8", "comment": "Malware payload", "value": "aab394550921bb99c38f68f2838215e4a498f3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692885, "uuid": "5dffee35-9e98-4e05-8a0b-ecc27a6dc726", "comment": "Malware payload", "value": "5e6da4a07cc749466c2b3c89db204d47987bf9b0a3afc1da10af4f0ffcff7352286b89f18a4dd78ef1f70c097a6f84c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692885, "uuid": "97478c99-0ffc-4da6-a03e-32b335ea9521", "value": "T13885CE7C266E5E4CF79494BCB1758EFF27A2BC2F00A774F7901CA1D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692885, "uuid": "caf7cb7a-0fac-430e-8a9b-4baa5a9465fd", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692885, "uuid": "278d30d8-d655-496a-b018-5b2155a39370", "value": "49152:XpEuW1sPapJLiNnscG9EONjeSpsZ5Ruh4U:XpEdtLiNZG93jfpSP1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692885, "uuid": "e8b3184e-62a2-4267-9a39-4b1c5be30382", "value": 1786232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692885, "uuid": "63a3ffe8-80ec-4e8f-97e2-bb4452d44e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692885, "uuid": "271f8713-d0d1-484e-9cc2-5056934a94f6", "value": "79e9b2168ca3e2bef4fc853cc68bc5c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa7ba09-95aa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732193, "uuid": "914e9c52-10c0-46f5-9757-b89c918ea8ba", "comment": "Malware payload", "value": "e2aeddbb79eba4e974e2dd9a1bbe7379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732193, "uuid": "226303c3-0d5c-4a9d-bcce-5a1a5cca1985", "comment": "Malware payload", "value": "6d385a63f4dea0328bde44e6d9d34251bb32f6d74a0078e2a11c0ac21b5e5a55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732193, "uuid": "f0bfca11-dcaa-4d06-934f-dd07e2d52f20", "comment": "Malware payload", "value": "d9f5382f9208bba09f81f0b816cda6d0ecb5ee31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732193, "uuid": "259b59dd-8cee-4394-b263-b530a6d543a3", "comment": "Malware payload", "value": "a61139935b0c27942181b376bd4a3f7724fa537eb8374dbd2784e5295b9362149f2089c3fb929e65b6301d378c5f0f18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732193, "uuid": "c350bcbe-2304-421b-98c0-7815d57b238a", "value": "T16DE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732193, "uuid": "3d39c57f-181e-43e1-b0e8-d4688eae7e9d", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732193, "uuid": "03519aee-0447-4782-97f1-67c96189c64d", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XysD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWya1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732193, "uuid": "bcb65fe3-7e63-4fc2-a1c0-6110666ff8b8", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732193, "uuid": "3ea8aaab-0eb2-4c63-9ffa-d359089ca351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732193, "uuid": "90432fc3-5102-4e37-94e0-9f4c06141c13", "value": "e2aeddbb79eba4e974e2dd9a1bbe7379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48d2c0e-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645693064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693064, "uuid": "06becaff-1d9e-4543-aea1-1e57a88926e9", "comment": "Malware payload", "value": "0deb6344f96835aa1c3c449a8aa6155f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693064, "uuid": "18bac365-eeed-4c55-964b-770a1ecc55a5", "comment": "Malware payload", "value": "6d4c168f49ca87591cf39b6b7a9cdd681393f784d20b147efb57c44a46272ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693064, "uuid": "cd5cebf8-13d7-4be8-9ad5-ab610c88f500", "comment": "Malware payload", "value": "b8947909752f50aed8fd443bdc839aadd212a66d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693064, "uuid": "662f2675-a3e4-4db6-98ef-7ffe7b16abb1", "comment": "Malware payload", "value": "3723f87f24e001c2e632adf6aebedf34facf916ebc04a52b835dfa64c15e6cd8907fd7d158daebb65c75b120da2c7c6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693064, "uuid": "81c6eeff-7f26-4cfc-bbb2-f6d017db986f", "value": "T18DA47B2F487F223A85BCDB9199C4CE1FF892C5923537A91D29D61AD906167F230D223F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693064, "uuid": "adc52ef9-f612-4663-86ec-7065705478eb", "value": "6144:74SSpjUe88dxoBaBqcuFg0baJx/3LYN37dIBwlOkAtOZAKQZQXNARm9oTmtMA:opjbBBwbaJt3LcrOwlhAtOZHdUMoTmtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693064, "uuid": "bc613d6a-a3cc-49a3-a7a3-6766dea6eecd", "value": 457238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693064, "uuid": "7aa939af-7b98-46c5-bfb9-9cde4c731718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693064, "uuid": "872c910b-a9b7-4c62-98db-5bff2ca0930a", "value": "0deb6344f96835aa1c3c449a8aa6155f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6895ed1c-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694171, "uuid": "29b03368-1ee3-4a53-9530-58fa373c7998", "comment": "Malware payload (Heodo)", "value": "7d8755798c6ec328e6b314ea80e33c01", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694171, "uuid": "7ed5c56e-88e1-4464-80b4-6f6bfa151fc6", "comment": "Malware payload (Heodo)", "value": "6df08ab0949c3bba7c2e9b58e250db6ae7d333be318fc0e1b0649837283cd67c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694171, "uuid": "80886191-f9de-45bd-843f-d40fe1244418", "comment": "Malware payload (Heodo)", "value": "a64b98274fa63049d04423b65728c011cf15f1c8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694171, "uuid": "d71bb795-3c34-41e2-b29e-953df8eeb89e", "comment": "Malware payload (Heodo)", "value": "bce153c9277140dbe20113392e3cac8fcc3d66fa33f72cc064dc8dbbdf8d6a33672fefef637d99c4ac84c1fb4edd1ee5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694171, "uuid": "6262ce08-9602-485e-8362-dcf157c986d3", "value": "T1CE93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694171, "uuid": "7f562eda-8e84-4a12-9972-5b872d66e40c", "value": "1536:TQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:6DpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694171, "uuid": "e59b6cf1-7cc4-47d2-89f7-f6235121f4d0", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694171, "uuid": "d2e28847-a671-4e5e-841d-c622379e77d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694171, "uuid": "336385bd-f089-4ba9-95f3-4684ca87ba3a", "value": "Opast Publishing Group_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845a799e-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "94e77b06-aa9f-443c-95f9-a6454f0baa05", "comment": "Malware payload (Heodo)", "value": "be6ca90d0f9a4f60bcf4e2468ef6a896", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "79ef3278-ee53-490f-afde-d3b87c55f58f", "comment": "Malware payload (Heodo)", "value": "6e38af94187e860fcd9b8b41339587629b30bba01e341e42f1e6da2b5f6c75a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "ca1bafc2-1f8a-4522-871e-4d2bb76f655d", "comment": "Malware payload (Heodo)", "value": "04f4e1f4163b3c34f3492fd54be232deb3b453e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "0403cff0-ff01-4944-9bfa-b19d0fc25a25", "comment": "Malware payload (Heodo)", "value": "4b5d3e518b105a80136e9a7a8321845b9c27d92e1bf3672464d147dbf68add73e89590add718d30bc2b8027d1f638efa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "15c29160-61bb-40c5-af60-96e9ea9de4f8", "value": "T135E4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "11bd83b6-cc3a-4cc6-bbea-6d218e616d54", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "548929d8-5951-4e9c-9d09-7838744ca247", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuK4KDYjX3rUXY:ygHpbVy9730YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710539, "uuid": "6da39c1c-9f62-4552-b26c-82e2e02e73a3", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710539, "uuid": "8f98f6e5-f024-4c82-bed4-3275603ff22e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "a8204c0f-0fbc-4ccc-a93c-f6f19a139350", "value": "emotet_exe_e4_6e38af94187e860fcd9b8b41339587629b30bba01e341e42f1e6da2b5f6c75a1_2022-02-24__134852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65944b34-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694166, "uuid": "8cc2d982-3c42-430b-a308-47cc9376f41f", "comment": "Malware payload (Heodo)", "value": "064a6f1eff61b5e9480cd166b9b8eb14", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694166, "uuid": "7a38a849-d420-4573-96c0-51b6258bf390", "comment": "Malware payload (Heodo)", "value": "6e5df084111cb6ffea2fa778eacc345652e3c6e52d43289ae3c319c2098054dd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694166, "uuid": "9126d0cf-2093-4e56-b647-74a768a35f08", "comment": "Malware payload (Heodo)", "value": "7f8cc3a85a505a83306ff6dacfbf667b483b6439", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694166, "uuid": "4fec9c61-5464-41a7-bb4b-98f623f0dec9", "comment": "Malware payload (Heodo)", "value": "d905566ded5b966b2bc3bd487d10ba0ab3b29ed96a8c9b940fef5cb6a50959e21d028c556552a4801b660726b469a226", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694166, "uuid": "b6ed366d-9e53-4494-92fa-ee593d11fdd6", "value": "T1A393022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694166, "uuid": "d1574736-a480-4f28-a5d7-3c31fe1544c1", "value": "1536:vQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:GDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694166, "uuid": "ff22acec-8ec3-48c5-a179-4de68dd75074", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694166, "uuid": "17cf11a0-f856-45ba-bb95-9dffc93020da", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694166, "uuid": "d3f35e6d-992a-4149-a7fa-b503437b7e42", "value": "opastonline.com_5.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f70272-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694147, "uuid": "524891df-e55c-4495-853d-c22c0c40fc32", "comment": "Malware payload (Heodo)", "value": "d801bda7cc90690d5b72c55756e549fd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694147, "uuid": "4c2388e9-0319-4746-98a6-afa3dc1d45f7", "comment": "Malware payload (Heodo)", "value": "6e708b06f5eb6a02406429493f2c766fa852f43fb12337244f1f995da002505d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694147, "uuid": "552f724c-3dfd-48aa-b633-8e98b2804699", "comment": "Malware payload (Heodo)", "value": "5b214041019978f6bd832b879ed40b5a2b2491fb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694147, "uuid": "38e6053b-cd1b-4bcb-94b8-759f638cb260", "comment": "Malware payload (Heodo)", "value": "69c540f141afae05bd9c2ee392016512ac1991120430e07cf1ce52e3442ba1be5e2f10376f6c6fc0a8f3f0a0a18cc946", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694147, "uuid": "fcdd984f-ddbe-4b3d-b9fc-f4366951688b", "value": "T1EA93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694147, "uuid": "b5b10f82-55bd-4702-988b-4c9ac894fade", "value": "1536:TQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:6DpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694147, "uuid": "fec62c60-14b1-4842-afc4-aeded4e94e9f", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694147, "uuid": "4ba52223-5e7f-4f57-8929-36c9deb6fa86", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694147, "uuid": "52c3c43f-ead7-44ee-a47c-0dccf5030166", "value": "Medwin Publishers_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67405d6a-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694169, "uuid": "660e93b4-f834-4e37-ac10-ad65574d049f", "comment": "Malware payload (Heodo)", "value": "942a62b5fc9434932fea0a8d5ca27d79", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694169, "uuid": "2b3678b7-5912-4e19-93e7-f85e26f6266f", "comment": "Malware payload (Heodo)", "value": "6f377dc858bc33275495df88a8f54a548dd5d87aeb0a1bfb608c57412599c42f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694169, "uuid": "436a3a4a-4c69-465d-b122-4a2d84823a51", "comment": "Malware payload (Heodo)", "value": "1caae558937a9c69e7185167a7646b9abe28282f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694169, "uuid": "4375b2b9-d736-4dac-ad26-73deec7348ce", "comment": "Malware payload (Heodo)", "value": "3b8239937369c3b7dbe75bd96687706bb43014636b8e7bd1de7b0e3c10c90403d61a878020dadfabc2abe4b554f5a7ce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694169, "uuid": "c5882b37-97f4-4aba-8005-b6e59b435d2f", "value": "T1BD93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694169, "uuid": "e0ed301c-7f93-4d02-9186-d83e3dbdae2f", "value": "1536:zQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:aDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694169, "uuid": "98f276ef-7f4a-4c86-90e8-006f10dd29c1", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694169, "uuid": "1583505f-0e38-4ef8-90d6-e3ab7fe88177", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694169, "uuid": "a497c51a-3ee9-474e-9aad-b118867e1c62", "value": "Opast Publishing Group_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77429359-9561-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645700638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700638, "uuid": "005b0314-fc95-4291-bd1c-e62394203fbe", "comment": "Malware payload (Heodo)", "value": "0649b180bdda980ef186c15256720bdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700638, "uuid": "d61af59b-f601-4597-acdc-de10426547a3", "comment": "Malware payload (Heodo)", "value": "6fa812050867f674a5a1298ffd7f519e64722298bab1c611ff7425cb8720f71d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700638, "uuid": "fc031cc2-fbb1-4959-9820-a045da071dbb", "comment": "Malware payload (Heodo)", "value": "27c77f3fe3a45bc17de05ba70dc30df71c8e80a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700638, "uuid": "63295ad5-1815-4e4b-8655-1bf128f6ab2f", "comment": "Malware payload (Heodo)", "value": "5d71eb34c3a53d5750c3910b9f55192e8ee5070a267268c6cc3862c9edacbd22915a17e07c7863fbe9015fb7fdc85129", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700638, "uuid": "f18b6c53-637e-4a66-9b16-c8859cb65e75", "value": "T1EEE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700638, "uuid": "56f477ce-15c0-4924-aad9-32d39f41e4a3", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700638, "uuid": "3213d908-448c-4399-aff1-edce01664098", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK4e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK4LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645700638, "uuid": "c8ab145d-52a1-4dc0-9d99-0df40244b0fe", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645700638, "uuid": "4603ddfb-d590-4494-abe7-d451416d5900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700638, "uuid": "21612cca-2174-4c5e-94ac-68e8c1272920", "value": "0649b180bdda980ef186c15256720bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2107ad05-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "012ab0d5-262f-447f-b166-cf666cf1eccb", "comment": "Malware payload", "value": "d5f914ec3480b79ec100757b1fd1e6b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "d7c55673-5201-4fe2-9427-2930c942feec", "comment": "Malware payload", "value": "713cf1344469521d4e5d0695676b68ccd57a1bf897f2138ff49264f710fd2e38", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "9aff458f-af79-42b7-946a-3646959f7c86", "comment": "Malware payload", "value": "b76800ef13cc2088a0ed8ae0e250e7deae9efe6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "ada44cf0-bcbc-4c33-8580-79890503d943", "comment": "Malware payload", "value": "d8a37d006ac222bf30f2e26f815eff9be35321e2345b6aac4aba2d1a0b9c38f76660d7f75438c93a03cf114113d457ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "86de546c-0b09-4e03-8c9d-0a0969f86914", "value": "T16035BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "86ebcabd-52b4-454e-896c-0c6eb7e6d079", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "5b744499-38c5-4949-888d-843d9f611872", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+unVOe528JO6PC:6iRGcUY0UvDYNFtul5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738719, "uuid": "2d55ae54-97ae-494c-b23f-e581b0a676d8", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738719, "uuid": "e6bac08c-2fb1-4e73-8bb3-1eaa8306ff8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "61b63e45-cbf5-46cf-aaf9-8b943f8c9f5e", "value": "emotet_exe_e5_713cf1344469521d4e5d0695676b68ccd57a1bf897f2138ff49264f710fd2e38_2022-02-24__213830.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb95b3e-9595-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645723008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723008, "uuid": "c116a47f-a3e9-4d56-a067-7266aa5daf32", "comment": "Malware payload", "value": "1436db99beb6ca9788fc5e369cc8cdb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723008, "uuid": "4f0bef9b-e6ca-42eb-91d6-ac92d77e2f8f", "comment": "Malware payload", "value": "7146b418cdd99ac478a67e603bffb10c10f1c32745da1fd60c931f54f1f114a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723008, "uuid": "f9a65df3-5d1b-459a-bdc8-d3746474441a", "comment": "Malware payload", "value": "4f3a97f90b64607a765d109f01b8044b74b703c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723008, "uuid": "822c12fa-266c-46df-82bc-3b498d3a10fe", "comment": "Malware payload", "value": "9bfaa6dfe9bf8690a4449a34574dee3581031f3e0fee7315704c056164c415b0bb185b2ca8986306d8d7c3970c7f7953", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723008, "uuid": "7cf1af17-4979-4903-81cc-49bfead14a38", "value": "T158159E42F2A1C532D01B21389D1B9669D919BEF47D5CF84B3BE43F0D6E3624A3819DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723008, "uuid": "5b2348f3-b192-4ff2-ba55-5337dcc4c1fa", "value": "1c02903d270a37655f586f4aa8bf43c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723008, "uuid": "5ca5d509-8963-45b0-a634-758f514d58b2", "value": "12288:Cwkcdx+EleOmksXHxvkAhNSpCsJHr3A5W2S2x3pxjsppdTc:CBoxpeOmBBtQRJHrw5W2d3/j+pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723008, "uuid": "01d2ff4b-ed4e-46c0-ab70-9ff8fb813d7f", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723008, "uuid": "7b5c1154-38be-4e56-a8d0-1037a14da12a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723008, "uuid": "1dcddea2-97fa-418a-acd8-cfef7ab9b6b7", "value": "1436db99beb6ca9788fc5e369cc8cdb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a6cada-958d-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645719402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645719402, "uuid": "9b509ef2-3dcf-4221-b062-6cb27706b2c8", "comment": "Malware payload (Quakbot)", "value": "e05920a6529835d3e0912c02ad899f3a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645719402, "uuid": "a3008c3b-d1e7-4f90-a490-5bb1cb7cf5ed", "comment": "Malware payload (Quakbot)", "value": "71805df6272036ba19ea6d4b91c03e9f7e11e2ab67e54724c0dba959c5392467", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645719402, "uuid": "3ab22fb5-9552-4736-a5bf-b52df33b87e3", "comment": "Malware payload (Quakbot)", "value": "db5b6a35001e95f59f38bb396c03e1cc90daddfc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645719402, "uuid": "f8964936-7ba3-476f-80c0-1c2ed93981cc", "comment": "Malware payload (Quakbot)", "value": "90c6288b3a7f04c03b4aa49281f991f10a934388e7b8892a526a252b4b80d1dba0191e366b07f1d07190575eb2f430b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645719402, "uuid": "fb63fa35-d36f-4b2e-adf1-697afde98ce1", "value": "T1E144021DA15CBB8EC75D203AD3085EF5ED0E12CD6A40F52B46C0BB9847FA5C34B8DA99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645719402, "uuid": "6ec9d9ed-2bcd-44cb-b806-f88fbf990f4a", "value": "6144:sxafQTxwGF4p24e6RoPmj6M7R6SFENKq4Wnev:CacxGgF62PFNJnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645719402, "uuid": "79e58b82-43de-444c-a11a-8ac5603e4614", "value": 272601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645719402, "uuid": "625bc110-a21f-4e7b-b919-3b92534af232", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645719402, "uuid": "9c29db9a-6fc9-49a9-800b-b450b5fd7dc4", "value": "Payment-38984423-Feb-24.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c7ae03-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "fc6db65f-5e82-4db5-ab76-04af95bb959c", "comment": "Malware payload (Heodo)", "value": "14be536697f76b0f4801cdaff0c8c737", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "d33e71e3-b00e-4d4f-8a1f-1eeb117e1954", "comment": "Malware payload (Heodo)", "value": "719064a16bd8852ac4fd6e18d826d0247d073e14e0a27807e5318d97b4e7f3fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "6af837ce-4077-4fdc-93d1-a0c17ff5eacd", "comment": "Malware payload (Heodo)", "value": "0e1d7b5533003bc2041ebe1cbf54abf4ea87629e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "60307e89-1704-4864-9d62-3592801974e1", "comment": "Malware payload (Heodo)", "value": "9f51d79933e0d618a3eee60c788f5d0c86c3d2b70595da594850928bca40dbda994e7dbbd586d82e5a3007144a3b51f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "bc840187-847c-4ed4-a19d-0b5f68646920", "value": "T11DE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "c140a51d-8d15-445d-b7a3-061c43c03a04", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "ff94c288-d995-4ad5-b7b8-5e6ba208ec0c", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKje/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKjLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660941, "uuid": "99d99a4e-7af6-43bd-8c4d-d531717a24fc", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660941, "uuid": "0c39a52e-3c28-4a45-8215-d17032b98d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "66394688-c389-490e-9234-e3a10acb4970", "value": "emotet_exe_e4_719064a16bd8852ac4fd6e18d826d0247d073e14e0a27807e5318d97b4e7f3fc_2022-02-24__000211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049408d5-9546-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645688849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688849, "uuid": "8aa08ddc-7f02-4a0c-acfd-23d974fc2584", "comment": "Malware payload (Formbook)", "value": "b25c74d7f2ef3ea2a0820c084fc42dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688849, "uuid": "89a098e7-1b75-4513-959c-b6a75f5ee5e7", "comment": "Malware payload (Formbook)", "value": "7191931408ece83ce499285083f19076953603a6779a27dec000aaa88dadaba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688849, "uuid": "23888a4e-bde1-411d-9693-6613bf2cd365", "comment": "Malware payload (Formbook)", "value": "4e120b6402a655036e16ffe775ebca88032fcbfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688849, "uuid": "21400db0-8747-42a0-9971-035722758d6f", "comment": "Malware payload (Formbook)", "value": "2c218a731f05cde9a9455437db2629a2746b9c7ef7585920edb0fec638562fec0fe3ba67c69d5656ca701d84bdb6328b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688849, "uuid": "8e670768-d6f5-4886-ac89-d5e6a21417d9", "value": "T16864236AF5F8E5FBE94301BA08EB4B66E37FA4746701075B0BA1ECFE4902101427E5D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688849, "uuid": "0002cbcb-1f27-4065-ae20-21ec86283d7e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688849, "uuid": "7cdcc355-3d8e-4a33-9e6a-fa995eb05543", "value": "6144:TxDM6UZoVc4TejqjjqnTL3H6tn/DSdxJcrqidTpWIgaSlB1jUEs7:OyVbTecjqTbH65WdxerqcrC7s7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688849, "uuid": "90068964-d563-4fc7-9c87-659823109478", "value": 328664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688849, "uuid": "82309920-d9c1-4829-93b6-65bc1cab5253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688849, "uuid": "e488576e-1fcd-48f6-abda-112a40f4e148", "value": "Order-EM71565373-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ad3e2d-9575-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645709063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709063, "uuid": "493ab68f-bcbc-4972-8adb-808dd9577b60", "comment": "Malware payload (Heodo)", "value": "a0bee193313cb096118de9b0a03761a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709063, "uuid": "4a862683-43dc-4cdf-834b-054b49c0218b", "comment": "Malware payload (Heodo)", "value": "71d987e3a3c9a7d6970374447cdcbcfc0340e5ae25ac22b2f71c70a97c175a21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709063, "uuid": "38a4b085-fee4-40fe-a525-f816c0748ce0", "comment": "Malware payload (Heodo)", "value": "ee6a143350071a164f98c9ce83a99a5ea2b9c696", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709063, "uuid": "ca64d388-58f2-41d8-b576-c25301ed4eaa", "comment": "Malware payload (Heodo)", "value": "129155fd2d0a84ca6bb56dd2c83d616041f9668f26dea98b5a6e743bd8de0bdac64622af9476385579cde7f86c4f6e9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709063, "uuid": "c0f35c76-0bfc-43a2-b24e-371c81f85b25", "value": "T161E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709063, "uuid": "eeaae9d6-0e6c-4608-9673-ab26875920b4", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709063, "uuid": "5cb12a14-faca-4e96-83f7-6ed3048be8e0", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XasD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWaa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645709063, "uuid": "78259ac1-84f5-4a48-a2cf-a1cbd076c7be", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645709063, "uuid": "6ee7aee4-bb6d-4e9d-bc99-ef9a89eb6585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709063, "uuid": "47f6979b-db62-4115-9155-c43686a5b9f0", "value": "a0bee193313cb096118de9b0a03761a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82efae76-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645723421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723421, "uuid": "5df4e213-dbc7-4b30-aa14-a7e89122b9a7", "comment": "Malware payload (Formbook)", "value": "13c5269b2937526632effedac603e772", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723421, "uuid": "8ed690dd-6f27-4dc4-9151-39abe35f2d23", "comment": "Malware payload (Formbook)", "value": "71ddf6c36f5d392f8219595aff3cbaa98aac7e018b753ae82c665d1e6243f9fc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723421, "uuid": "93775ae3-b3f9-4cd6-9253-a5e14f5a2654", "comment": "Malware payload (Formbook)", "value": "3e5f1e46b4fa97b412f76877b4be11983ca9fd6c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723421, "uuid": "4f399295-d5a9-4fda-8f03-f8fa209ae299", "comment": "Malware payload (Formbook)", "value": "1cb121942805e65625c8d72287310bf72d04e07ec25d91f35e8040c2bfc62cdc19f1d2e84e58c45ca4f5628fb27b136f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723421, "uuid": "fa8f6195-dee1-4a4c-b6b8-dc7138295641", "value": "T10A45C05677C426F1D2BFC27AC6A24A38E67374124360A78F639043991EE3352573BB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723421, "uuid": "94daf225-69ef-4db8-b141-7c90d074c1b3", "value": "95866651b7f95c626ef9a4c17f1bbf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723421, "uuid": "7399bb6a-bb16-4fe9-9bab-68d0db154d47", "value": "24576:YPJnab4teR33QeSWA5J+mWhb5+eX1tA6qBsuRZbGz7shgvT:EJnab4eFhb51qFDG7shGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723421, "uuid": "7785c266-65de-4cef-92e9-567b21edb832", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723421, "uuid": "3a4d8335-dd85-4473-94d1-8d6987980d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723421, "uuid": "29ca92dd-b2ea-4bd5-8e4d-258912142226", "value": "Quotation Sample_20222402-098-VP-882.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2050fa22-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "decf8ab6-cd48-44e9-8f7d-6592b88aff89", "comment": "Malware payload", "value": "881aefe9d12781baeb26dbeb64590710", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "c698aaf4-5447-4115-a458-ec308fee24b7", "comment": "Malware payload", "value": "7207af7a343794b220d4715a1e1cf63cc9c58169aff8fb46b48e47f8ae2ecbc4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "afd4fe28-0e09-45a6-a46f-7388621def75", "comment": "Malware payload", "value": "1335b08dfbeab7196fbc05940b9506f5c2ad04f7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "06101b0d-0002-41ef-821f-1e46920f1756", "comment": "Malware payload", "value": "90cffb6223c6282bab73e48682da741697a6cd6615b800b3ac47d6282d6b6df64a5593f7bc3ed11cf7ca64e40464b164", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "0810838c-7cad-4bcc-ab43-384133b3950b", "value": "T1BC35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "1686c954-7542-4606-868e-5ab53a5359ba", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "926cac1a-5766-4f8f-98da-614fb7131a92", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+utVOe528JO6PC:6iRGcUY0UvDYNFtu/5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738718, "uuid": "67125917-0824-416a-9118-18396b66b6f9", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738718, "uuid": "ebb71235-177b-4821-8729-86c8a5ce584e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "24cdb87f-6eba-460a-a6eb-a7393fdade40", "value": "emotet_exe_e5_7207af7a343794b220d4715a1e1cf63cc9c58169aff8fb46b48e47f8ae2ecbc4_2022-02-24__213827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb53c25d-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645693102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693102, "uuid": "1c5e3b94-b74c-4288-ad9a-02d94def6d34", "comment": "Malware payload (Loki)", "value": "957b33c87aa194d91555ca3920aafec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693102, "uuid": "8a312cb4-aa87-4d97-b4b0-802715895aa1", "comment": "Malware payload (Loki)", "value": "720a9b41aa3fc632a07dc0fa3c376ea608898049e6bdb761010695331c0d0b34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693102, "uuid": "963668c1-c8e6-44ab-8827-387a9d925721", "comment": "Malware payload (Loki)", "value": "57a021bcc96626b9b9092c7fcca18cce5e3a27d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693102, "uuid": "4159935c-5040-4465-892c-17e51ca90da2", "comment": "Malware payload (Loki)", "value": "50bd14c892b30225e8f6ddadb8299d654c55bde7dabc2c7f0fcd57f14af04bbbfddf471a9583d507b0a1908516722256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693102, "uuid": "c733fa32-9e73-40a8-a0a5-fd6f00da2db0", "value": "T17264236831D97DB3C0994930953EB6B6C37DF0963A2A0503D7701F596E29890EF0A6DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693102, "uuid": "d7b22157-221b-4ea9-9169-91848f4d0b12", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693102, "uuid": "d557227d-c255-4c93-8be5-f4446df7decb", "value": "6144:TxDr7lNyeuJwQHSqrfX8ueUxjkdKKOUW5w1tLxAcG57U:17lAmQHSqr/nbNKOU9DtAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693102, "uuid": "ff4f3254-b724-4ad8-9346-a3797517ffdc", "value": 314681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693102, "uuid": "9c5f4a78-fdf9-43e9-9f85-f24b41f66229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693102, "uuid": "2a8fa699-7cc0-46ed-bddf-3e73472b25ec", "value": "957b33c87aa194d91555ca3920aafec8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e904e10e-9549-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645690521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690521, "uuid": "85c8ebb9-0ca1-4c13-9b45-c647260f00ed", "comment": "Malware payload (AveMariaRAT)", "value": "c156024977cc6792d401d52b36687a19", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690521, "uuid": "56307a7c-853b-4721-b143-311929bc7c16", "comment": "Malware payload (AveMariaRAT)", "value": "7391303e2231d2f0143f8b0e86df253054e461a52279139fb800180d32271dbb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690521, "uuid": "519783b5-0a3d-41a6-9f00-374a961e11bd", "comment": "Malware payload (AveMariaRAT)", "value": "f6294b2acf0f15453697f16597de734da8a9d92f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690521, "uuid": "cea916ce-6d2c-4b02-b51b-db1e9f1f86f1", "comment": "Malware payload (AveMariaRAT)", "value": "720372e8df736df89dfa7e98a0ee197306c250ab210a4149f77602d0388e477e722ee6c72b26cd8ffb51bf18d5ea2c0c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690521, "uuid": "575cb0a9-03dc-4a07-ad88-9be646e83ed5", "value": "T15A159D62F191C132D12B26389C57D2699825BEF03D5CE8477BE43F0D3E3A2893919DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690521, "uuid": "563bba56-31e7-49ed-b47b-cae96c017287", "value": "1c02903d270a37655f586f4aa8bf43c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690521, "uuid": "78f125c9-0ed7-478d-bce7-46024c4ff5e6", "value": "12288:Cwkcdx+EleOmksXHxvkAhNSpCsJHr3A5WlIS2x3pxjsppdTc:CBoxpeOmBBtQRJHrw5W2d3/j+pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645690521, "uuid": "482cad21-58b2-4b34-ac6a-e5c14e38ca5d", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645690521, "uuid": "27ef08af-a746-4d4b-83e7-f98aeb214bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690521, "uuid": "e9c9dc5d-9054-4b05-8cf7-df6c52f7c65a", "value": "New_Shipment_Order#2356783933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40a2cbc-953e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645685761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685761, "uuid": "e484035d-c3eb-4f7c-910b-5c219643b0bc", "comment": "Malware payload (Mirai)", "value": "9cef4453520fb3726add1a411fff35c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685761, "uuid": "1d311ef4-18ca-4918-b211-ae7961a2dc25", "comment": "Malware payload (Mirai)", "value": "7427ab778fa729202a480f65f167f44410c6569e55d199232cedff1c4970cee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685761, "uuid": "5bc9e3d2-961f-4ad2-8ebb-d50c807e21df", "comment": "Malware payload (Mirai)", "value": "7b6079a711f0925f57d5fdb1b1806ec014641882", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685761, "uuid": "db9056f9-8902-4955-aced-162db92d30e6", "comment": "Malware payload (Mirai)", "value": "01eeaecc973b18a1120b64151e1776b2bb68931858aa38f240133107fc65a8b26b24be787b620504150986c4e39b9f67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685761, "uuid": "fd5782da-4a0a-4cc5-84fd-41a2752a3c85", "value": "T148E2F19C2F4A1EB6E0B396305688C7502E761751E6D78C450F9F9A837CCE8763801CDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685761, "uuid": "218c0ad0-c8ad-43e1-b3f2-c4a41e057a24", "value": "768:/SlP48v2nFvjRtY4w1PiUv3R3EZOfNJgGlzDpbuR1JC:/Mw8v2nVjRe4AaAfnVJuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685761, "uuid": "48239b3e-7b3a-4648-8a1d-ccdb5556c9bc", "value": 33816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685761, "uuid": "3b120bfe-bdee-45f8-8e13-b6a00972dc62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685761, "uuid": "5dc93ee1-ceb0-4bb2-9243-f27afae16de7", "value": "9cef4453520fb3726add1a411fff35c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff23a30-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694157, "uuid": "96b49964-0336-4c3c-9cff-eb81db93a351", "comment": "Malware payload (Heodo)", "value": "4c05d9ad1eddfece9e16c9e26b65a2f0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694157, "uuid": "d389bd85-d49d-4df3-bc21-43f8fe8d9ffd", "comment": "Malware payload (Heodo)", "value": "74365907073646915fdd888784af85031f8f467cce15e5502780315b99a6229e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694157, "uuid": "d03cdb2f-3de3-4710-b4bc-b1760ce75b61", "comment": "Malware payload (Heodo)", "value": "6762e7efc2b4a2e23d898934fad036a60a9c5ac2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694157, "uuid": "2e0076fe-7941-4d1f-b16c-bcd717fc78c2", "comment": "Malware payload (Heodo)", "value": "865da907d9d908da8e9f3336575731b11dd74bd56ff23ebd391980b55821bc6c9f7748da3178b748028bf6474de2654c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694157, "uuid": "224d1bba-bf16-4278-b429-d45972ec92cf", "value": "T17CA4E0067490C90BC66903360CE683E26337FC512F76935732C9BB2E7EF76916E92685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694157, "uuid": "8b533f53-c42b-4bf7-9f4c-72f8c5259fbc", "value": "12288:r947a/JjsLZjXYc7X0/aXCKli04OaZ1XrI7hFA:HurYc7E/i004OSM7hFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694157, "uuid": "053119d7-b378-4463-bf24-a91ae4656b0a", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694157, "uuid": "210e9f6a-711d-4b29-91f0-62af2e90f4bd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694157, "uuid": "cabd2f0a-d831-484c-8958-7e3bfc7c03e9", "value": "OPAST GROUP LLC.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef913744-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645688814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688814, "uuid": "77806bec-a5a6-48bb-9fde-7646d65c96d5", "comment": "Malware payload (Formbook)", "value": "80d1a583077b96da617c7e4e6ed77303", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688814, "uuid": "1052019f-498b-4119-9d50-d7f619b408ca", "comment": "Malware payload (Formbook)", "value": "74b0f2384ab42a60f4e80f1b3f491989daf0571bc2a753b29dc8ceb30fd3b165", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688814, "uuid": "5c1e9179-a4cc-4398-be37-9ef70867cfcc", "comment": "Malware payload (Formbook)", "value": "967114d03f625148fab24e99ae318d31f6a13701", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688814, "uuid": "e9c6c75a-fb7f-423d-9f5c-9d424c36fef9", "comment": "Malware payload (Formbook)", "value": "00d8428968e002ace068490871d2f1ffbe0f1ccad03b713cc2a8d4bd16b7a72bad7de9a9e918973c34e976a72b344b75", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688814, "uuid": "99868636-b577-4403-8a25-6f55d739bde0", "value": "T12EE49DE0ED64E88DC109A1F0D79E8FD5C2646D492B952CB923EBB71D017210DCCDEAE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688814, "uuid": "6804e60c-ea21-40a6-9f5d-211db7000b97", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688814, "uuid": "e11c0692-7217-4312-9ae4-2820a63253b7", "value": "6144:UxDRajtorgEOwmA4gp5JC/Ms5GagWARBaEQfUaoDO2SvmcjA6TO4:2Bv8AVpmezWAXcUjDOtvfNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688814, "uuid": "c326cc45-1d8c-42d6-89f9-080f528eeb39", "value": 696707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688814, "uuid": "09b0d636-e271-4d85-be1a-41877117d778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688814, "uuid": "249e04eb-9b89-4fcb-994d-a511335b6286", "value": "DHL_1155Q9040 receipt document, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e796df-9553-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645694668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694668, "uuid": "18cad70f-bfb4-437a-b0a2-fd5033c761ea", "comment": "Malware payload (Formbook)", "value": "902eeb8a6ef49a70b876acc5271a836b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694668, "uuid": "4c1acc4e-ccb2-4445-80cf-30a4a2f67bd9", "comment": "Malware payload (Formbook)", "value": "74fb9fa54f5d916b0fc8d25a2e43c3d29917fdbbb404abb63721df0e724232ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694668, "uuid": "8fa52d97-a10d-4c46-bdc3-77cad3ca16c6", "comment": "Malware payload (Formbook)", "value": "03f426e7b29d0e514f70b99823415f575c784628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694668, "uuid": "9cc7f1aa-a6a7-4539-8900-8d16d5c57c8f", "comment": "Malware payload (Formbook)", "value": "5a47b505f454c9dcd34c12605ef48c1dad6586cd19e435247b922dbd71206d6e12186bac1c3520e8d2085cdf1a31a068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694668, "uuid": "6e1c3846-21c5-4ee5-acd2-0322a2655905", "value": "T12EB4D48BA1D194C8D8CD4C716B28F2F52A75A4BF481589482EFABF7C8673F5B135B024", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694668, "uuid": "d9617994-dfb4-48ae-a168-45ca439a4596", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694668, "uuid": "435bd945-a712-4d5f-a8bc-5e7d83ab50dd", "value": "6144:wxDSPqJkuKoHsHFsf2cDaVjxbXgaSO+kiTiOXu3rFXlaK73U6/2T6:ZjdossfmQaSjTi4ubFXlpkh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694668, "uuid": "586507c9-fded-43d4-bf78-6836b2d01990", "value": 507055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694668, "uuid": "66ff8210-5b12-4c13-b9d4-5f4971867633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694668, "uuid": "76271201-130d-4f43-874b-8fb2b6923338", "value": "RFQ#0005009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63edf998-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694163, "uuid": "76110881-b853-493c-a094-343304ddc5c7", "comment": "Malware payload (Heodo)", "value": "b44e7e957bf3f0a3a3b31f32c6d745b3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694163, "uuid": "85e98de3-4c2d-4f10-b9e9-f288ad9146cd", "comment": "Malware payload (Heodo)", "value": "753649ef0d05efa591910eee890caa154f84f4c3c9383dcfe81845dbdab96052", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694163, "uuid": "576d2105-f5b8-46de-a4c6-444b55424ea0", "comment": "Malware payload (Heodo)", "value": "f01e2161064185bc77dbff6635f6b9d9c42ae3fd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694163, "uuid": "e9265b33-42d7-4c12-b6a4-1f0838d2786a", "comment": "Malware payload (Heodo)", "value": "c33a0b7194568026b48e4c07d7a0254007fdb636c214a20b895031740b124f1f40c96f4da0342838d79eea4beb47f037", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694163, "uuid": "6207f656-82d2-4ce5-9c65-851abd2d4475", "value": "T1BF93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694163, "uuid": "6a21480f-436a-438a-a563-c86002aae134", "value": "1536:DQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:qDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694163, "uuid": "7b79c4a6-a7d5-4fdd-ae7a-47cbe667a93d", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694163, "uuid": "c8203102-510b-4e10-83a5-7e2276430901", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694163, "uuid": "6d1ef0c8-9046-4591-a4dd-1edb510d13c1", "value": "opastonline.com_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52feb832-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696282, "uuid": "5c4779b3-a299-4605-948c-4c71a18c7aa9", "comment": "Malware payload (Heodo)", "value": "d1ddd0f60f4466ed8381a9afec6c6ab8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696282, "uuid": "949ec20c-d3ad-43fd-9a05-4ca6d333d0ae", "comment": "Malware payload (Heodo)", "value": "757df90228eeef2cff0031f5171d4fd7aa56ed9455a7aa444402791ac135457f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696282, "uuid": "a6d7f09a-76d3-4c28-89c0-fb6c5607c790", "comment": "Malware payload (Heodo)", "value": "4e7613ebbea8dd9266be6db843db4f10c61c216e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696282, "uuid": "3c1c5df3-68c0-45c0-b498-01814b4b2c12", "comment": "Malware payload (Heodo)", "value": "25c3ff2b766770c88c4cc3433c2ab5da30f8a8c4334453cb35c79d68f183008327b273dd15a571ebb3ba84fe13276ca4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696282, "uuid": "bd98a930-0639-45e3-83ff-bb9308bef1e7", "value": "T126E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696282, "uuid": "1637b153-c05e-46db-8ea6-d89a0d69e040", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696282, "uuid": "4e9bd6fa-8c5f-412a-86b7-d260fa4fcbe5", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKLe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKLLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696282, "uuid": "f7e7a094-f999-4f8c-af41-4492234b0a9d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696282, "uuid": "d1421ced-b4fa-4161-98f2-c3e653d0b28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696282, "uuid": "71467c23-2b8c-4b4f-8fb6-3818d71eec14", "value": "klj7HiM3FcL8X83kS3JgE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b223db-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "f9afee5d-30b2-4bb2-980f-c0feee0202ce", "comment": "Malware payload (Heodo)", "value": "e1ff7f96ac32e72392f7ccf0d38d7f7c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "d91d8082-fde6-4401-94f7-9800e2aa80f6", "comment": "Malware payload (Heodo)", "value": "75b78eabbbcce8e6ebc8c52f54d5fea7a800852392196afaa8262e800c9e4bbb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "0b6a098b-7501-4108-bcd9-a00278e900d1", "comment": "Malware payload (Heodo)", "value": "a3367cf1f3c5986e241d85aaa2a9d67c9818ddee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "44f8eff7-c8c2-4f23-86f6-18aee293ed63", "comment": "Malware payload (Heodo)", "value": "f25dc9d0a8781b99827001a8e7b186cc98e256b2da7123916468eb2eab1ce6a426009a3c6574970a1c50f6de6742f59d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "55c4dab9-12e9-4f2b-84d8-bb7e3440b856", "value": "T1ACE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "8890b6d6-e304-460e-9601-13662f7b18ee", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "d82dc077-6b60-40b9-80be-7676840fd88f", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XosD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWoa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697894, "uuid": "b71679da-ff9e-4b2c-b33a-089f12d1328e", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697894, "uuid": "5069dc22-6edd-4b7d-9bfb-8bff66d5972f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "a3ae9711-aca4-48ae-b6a4-eb90d5725161", "value": "emotet_exe_e5_75b78eabbbcce8e6ebc8c52f54d5fea7a800852392196afaa8262e800c9e4bbb_2022-02-24__101808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44a079e-9573-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645708498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708498, "uuid": "33e5f6af-a28f-4aae-8c7c-cef43bd883f1", "comment": "Malware payload", "value": "ea2beca35afdf256d1d20834bf481ffd", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708498, "uuid": "2ad48943-a283-4b17-912e-81a01f48b0e6", "comment": "Malware payload", "value": "75ca9199537946203b31149a12a00a26b11011854f175918b4d896b744d74f1f", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708498, "uuid": "fc607a5b-fb39-4359-85fb-a740dedf449d", "comment": "Malware payload", "value": "d09b1d6e6398be484c6bc08661d7cf56d316eacb", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708498, "uuid": "88fe1ed8-9e9d-409b-b991-3ce493350860", "comment": "Malware payload", "value": "b11c51265151c9d732f8523c9ae7987846520c27b1f969234c7d25d5f4deac2b210cea74748cf449065e7163b89cc3dc", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708498, "uuid": "829ab833-aebc-4cd1-a925-d3d892cf559c", "value": "T1D6832C567D388552D115C73B8A9381F802BBAF0188B6D10BB4DEBF1E77F3B51A621325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708498, "uuid": "b7a707aa-a829-47fa-b7da-7f8b5470ebcd", "value": "384:8lFCXYR+ohoTxw0GxMn69Vhe7bKnK603Rgm33i66s07wwwwwwwwwwwwwwwwwwwwT:8fCW+UL0uMuKbKV0533pTQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645708498, "uuid": "dd98ac29-2530-44e7-ae44-794748e4fd72", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645708498, "uuid": "3ef74d6b-1bb2-4a0b-864e-ea63c9a3ec1f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708498, "uuid": "dfc3d22e-7294-451a-8683-29fad107113f", "value": "ENQ50856010003.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c23233a-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645682661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682661, "uuid": "d734c954-07a4-4ab2-a251-515e73164faa", "comment": "Malware payload (Heodo)", "value": "7d0d7ba289161c436052460a7beb0e8c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682661, "uuid": "7aece03c-311a-4f0c-9ed9-bd9c8fc6a762", "comment": "Malware payload (Heodo)", "value": "76949ab86384d39f45952d84cd8acab920bdcfa5eeab5191c8d3732ec44375a9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682661, "uuid": "54e1653f-d107-4c87-8d71-31441c7557bf", "comment": "Malware payload (Heodo)", "value": "2e72c81319588d2e1cf2885c8d7ffed3f8c06146", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682661, "uuid": "bcabda75-d742-4d98-942d-dced97194b16", "comment": "Malware payload (Heodo)", "value": "41cd855bed80ad799a5a9a5885ef6fcaa326c073d87047eb8cec180b0a334fcf60c5f34b884579bf25424ec0e9ff368e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682661, "uuid": "00f6a611-d728-4a0a-afee-92f715ad1218", "value": "T11993022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682661, "uuid": "dd01d722-9c32-45d3-b951-92804ad602c6", "value": "1536:PQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:mDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682661, "uuid": "79051656-a8f7-43bc-a72a-95b8b27f7d78", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682661, "uuid": "82dfb560-0305-4d6b-bd7d-ddf29a594dcf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682661, "uuid": "c9094858-f1df-41c9-82bb-45597b717e1f", "value": "2022-24-02_1017.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec94820-9511-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645666318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666318, "uuid": "7520c55d-704b-42e2-98e9-7dc7cbe2aaa5", "comment": "Malware payload (Heodo)", "value": "3a2bcd6bfdec2975fcf4d3eed7268b53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666318, "uuid": "07392a08-a058-4991-8f1a-143d8f0d1b6b", "comment": "Malware payload (Heodo)", "value": "77678a7e00445765aa6d00e5018e11180d1886c239cd62dbe9eeb9e076d29ca5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666318, "uuid": "9607cadf-46ac-4267-81ba-9495e684220b", "comment": "Malware payload (Heodo)", "value": "9756c99a0dfc617c824c9d1fdcca9b0ac554cbc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666318, "uuid": "64d932ce-cdb0-4c89-9ef3-96e05db2b344", "comment": "Malware payload (Heodo)", "value": "4750b3ac18b6b48664748167ff59ce31c5caf54f4213ed2a567c781956873b6a715c485d432383f6af6dd423dcdc0619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666318, "uuid": "22d05250-4c26-43aa-b181-d63f127b05b9", "value": "T194E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666318, "uuid": "e9350eac-1bc8-4879-858c-497454240f77", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666318, "uuid": "72c6327e-efe2-440e-96d4-27055362175f", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKCe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKCLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645666318, "uuid": "ac766755-68d8-43e7-80de-09c936b9c968", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645666318, "uuid": "a4c79b00-0bd0-424f-9865-30b885dbe870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666318, "uuid": "4ab9ece7-763c-4d85-95a6-e67779c4d9c5", "value": "3a2bcd6bfdec2975fcf4d3eed7268b53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccae576-959c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645726149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726149, "uuid": "a1b76067-faf1-4db7-88bc-ec1b4508f725", "comment": "Malware payload (Formbook)", "value": "922b85fda90aeb6b6b23aa0d1847794f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726149, "uuid": "6f050fb4-803c-4388-921b-a854e879623a", "comment": "Malware payload (Formbook)", "value": "7791cb00900b2cedf11970c8f42064656b58c61721b9c230fc0ab15af40479d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726149, "uuid": "33b6c8cc-1213-418c-a3f0-9b70008371c5", "comment": "Malware payload (Formbook)", "value": "a414b5d924f7ee2bf1de38cdd04fdbe62a04c411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726149, "uuid": "d1e27de1-f44a-4a65-bedb-f274d9315281", "comment": "Malware payload (Formbook)", "value": "20bb5e4516d0e50e88fd1a9d5f9fb48af3bad0b96e6420875e35431f1c4a4a2405dae9ce8bb66d55a396e41e461f28e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726149, "uuid": "cbf1d6a9-8825-49af-a193-44aab0b14f59", "value": "T14374230C24C4DCB7F54182B959F769D9E37FDA082260255F7F38DFB529220A74638B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726149, "uuid": "cae8848d-edf5-419d-9d0c-c50680f7cd7d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726149, "uuid": "f8b7c892-da47-40e5-b644-2ed742a21fed", "value": "6144:TxD5l3BStMDjg4TN0mV56EuL80ohoxjyGHNFRG9vI7:NcSYqOGHuLTk8jNHNzG9vI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726149, "uuid": "9ad31fb0-e7fc-4b59-bd8c-7a4405790296", "value": 345212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726149, "uuid": "9c4e0661-87db-4286-bb67-b62fd1a7d355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726149, "uuid": "1b487f93-80a1-49cc-a54d-324243fc983b", "value": "922b85fda90aeb6b6b23aa0d1847794f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0951e995-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "8bb9c1fd-6539-40dd-b730-37a2c40c3739", "comment": "Malware payload (Heodo)", "value": "05caa9e880cf159687cc253ea0c13341", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "a79472c6-e24f-418b-a2b0-fc08ff2488fd", "comment": "Malware payload (Heodo)", "value": "77d1b2ac50adda7b1537cfb19caec55fcde807d8f46b2969ca415a36cb89c653", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "aec5b3d1-f7e9-4fce-b9e3-3b5d8771f65c", "comment": "Malware payload (Heodo)", "value": "fb0cc2c460b19cb9ad172d67c72432b3983271eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "33023c53-7fc8-4983-800f-e79546de8fb1", "comment": "Malware payload (Heodo)", "value": "2f1df88b2bec5a7ed96e62f99394a0247eb1467253ed9b03de33358d812e5c33c818520a4b1ef7e678430dc6be0ca412", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "4956a038-4377-48bb-9eaf-d2226fe505ce", "value": "T118E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "dbc2d0ef-09e2-4811-a957-8618fb32a3b3", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "1f8adeda-e410-4801-9361-b2cf7d0a66e3", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKwe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKwLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660940, "uuid": "4c161f50-72f6-4a8b-b30e-03882352e144", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660940, "uuid": "7163f911-87ba-4409-bfea-a5367f1345ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "2afac0d2-4924-4ead-972e-1b818a499c83", "value": "emotet_exe_e4_77d1b2ac50adda7b1537cfb19caec55fcde807d8f46b2969ca415a36cb89c653_2022-02-24__000213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bacdc7c-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694176, "uuid": "6b34b7ea-2679-4d5a-8fb5-c7840ee21eed", "comment": "Malware payload (Heodo)", "value": "2b4827a12f9fb849b8568478ce727afe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694176, "uuid": "e6b2a81a-9ca5-4b26-8c30-7d3a1c07824a", "comment": "Malware payload (Heodo)", "value": "77d7040e2bfb7390e9aedcacd2aefd5c397b34d69f2a8d6277ba424516ec5993", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694176, "uuid": "1b27e487-1f27-4894-ad14-73dff5ff1a37", "comment": "Malware payload (Heodo)", "value": "c44f6eda13e6fae4a4fb2d847b62ccbbb54d121d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694176, "uuid": "ef7f611b-d433-4607-8602-bb1856b09624", "comment": "Malware payload (Heodo)", "value": "3f428341ff128a34f9baca48b78b36c2e486cb0291484a3b9838fb6afa35f7c6670d3d415b2ce52728fbe58555ab8a1b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694176, "uuid": "2937deaa-0ad1-45bd-981d-0990d06aaa3f", "value": "T11493022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694176, "uuid": "3984d389-8e7d-4fc2-8a50-ebabcdae07a3", "value": "1536:jQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:KDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694176, "uuid": "b633a9fb-caea-4ed9-9d5d-5f0756f497cb", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694176, "uuid": "43f5a7f8-1a7b-462d-bc13-96ceb6093979", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694176, "uuid": "e89cb5c2-9d25-4798-bd6b-ba32ac1d6a6f", "value": "Opast Publishing Group.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d2e10d-95a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645730353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645730353, "uuid": "15c54762-d915-4ad7-9306-6c68403c53d7", "comment": "Malware payload", "value": "06b0995f7eeca1b735f9fd015f24f5df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645730353, "uuid": "8c78a0a0-0b5b-45c4-99ee-28f3b952e10e", "comment": "Malware payload", "value": "788f243c7272debc26bf6d13bad89b2ecdf2e62d95c494f14afe89415e7b7435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645730353, "uuid": "e4ec193d-b490-4360-85cc-07ab57f912dc", "comment": "Malware payload", "value": "9390bf3a566d731f4158e431ecefe2cbd8d6829e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645730353, "uuid": "4a66a658-0467-4093-b915-3b7349d0f5fd", "comment": "Malware payload", "value": "3a3b9fab81f7a5eb1b10477b212d3cc5fae27b179ff328be6ee25bfe90ec80e40904932496e1bd656342484012eff78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645730353, "uuid": "d75986f9-28fa-4a47-8dd5-6b2b7c5b3562", "value": "T1E0F41213B3C30031F4614A358C668044AD6779B919F550A62FFDEB4E4FBA7C69C7AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645730353, "uuid": "d892452e-8464-4051-9451-d2ce132f2b68", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645730353, "uuid": "60e55b04-7fcf-421b-97ba-1d9b3d07a45e", "value": "12288:uaHc64b888888888888W88888888888UjscV7TdjL47zdU5imIrvx33rD+zG/oBT:F869IW7uvmQvTtezG/aYFkJR30F6rp8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645730353, "uuid": "db3c5ed8-4fba-453d-b455-9aca3a4d7acf", "value": 765139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645730353, "uuid": "b0ed7d4f-20dd-4c9c-a8c2-ccdcdbc8f906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645730353, "uuid": "02a0ad59-6519-4d4b-a6bb-361663cf2b95", "value": "Amidst 4.4 _ 4.5 Beta 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f93843-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660961, "uuid": "e9e2254a-4051-471a-8a5e-49d126b3c1b3", "comment": "Malware payload (Heodo)", "value": "391433c4c8651c53f2d7d334b2688968", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660961, "uuid": "f66531c5-70ed-4d75-b4ee-7f8c1edfe05e", "comment": "Malware payload (Heodo)", "value": "78cee53883f56a99d71b463feb66c0a02e0c51931a5ea98e32514fe887b7dde7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660961, "uuid": "886a14e7-5c53-4453-86ad-3f494df7cc69", "comment": "Malware payload (Heodo)", "value": "81e64d8c89810d69468d1031eab0169fe2c5c2ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660961, "uuid": "36e1984a-a6e5-4e9b-a3c0-f134d21e1c8f", "comment": "Malware payload (Heodo)", "value": "1f118f07981e4cf0498e3a7404a443a23f8655074d9fde938a2d78a5e05504f7fe78e0c194917609fa7fcbe74886856d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660961, "uuid": "8c36e65b-4121-417f-8ec7-63804fee8e22", "value": "T1DDE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660961, "uuid": "a7541109-ce2d-4a65-9da6-3c2f36619e4e", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660961, "uuid": "1a3e7f3e-c61b-46ea-b422-a27412aa672f", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA08hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf8PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660961, "uuid": "9caaa48d-5ac6-4cc8-b7a0-ef52497d4f85", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660961, "uuid": "3d3ef16a-2ea6-4391-bd9c-dd1002120776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660961, "uuid": "c6004002-8721-470f-b773-33502e3aac3e", "value": "emotet_exe_e5_78cee53883f56a99d71b463feb66c0a02e0c51931a5ea98e32514fe887b7dde7_2022-02-24__000234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807f305b-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645688628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688628, "uuid": "e2766754-ac82-4853-afe2-52c5597fff6f", "comment": "Malware payload (Loki)", "value": "c87732f1d1dcd72b3e7e6dece4ca5a21", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688628, "uuid": "8fb1031f-1431-4890-9c13-54783430b988", "comment": "Malware payload (Loki)", "value": "79660821fcde2e816b3c2a11dd92d6cef9eee54e59ed2f115a634ff6ab39c3af", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688628, "uuid": "24b518dd-06e7-4b3e-9867-aae11db5cc21", "comment": "Malware payload (Loki)", "value": "9c6dfe317a3e9d83e3286970ba4603b3c2ba71e4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688628, "uuid": "ae10d9b3-2fd9-47be-a3dd-8b6229d463db", "comment": "Malware payload (Loki)", "value": "750a6d427341c7fcc123beb05a8448b4e732d8e493f91782996101a775dd78debb262347aba0fd2e2a46e5ab34beb41f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688628, "uuid": "6d0685a2-216d-4a41-9177-4a149330d30d", "value": "T1E1141266FF85586FFC5B6B326EB0B6CA9D91CE1F00421DAD2254358B4CB846EE0D319C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688628, "uuid": "27110f4a-2058-4cf9-9b61-4a6fb83ff4ed", "value": "3072:TWMXR0wOkzCjGPNvbr6uewlcI0WYlPXw+kyOO4qFk2AaIDAtSvFVNsFlbA7oTH:/XR0dkzCjGXlcFPaHO/k0wNVKbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688628, "uuid": "2e0d63e9-0ddb-4000-a542-09681547fa5c", "value": 190456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688628, "uuid": "1140addb-7a4a-4433-ae94-10690fcc6305", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688628, "uuid": "a12819a1-23a4-4ab3-9c38-d51e81430d93", "value": "PO4415821356.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7cb0f3-954a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645690770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690770, "uuid": "64220abb-ffb5-4e1d-8563-fce7e6e4bbce", "comment": "Malware payload (Formbook)", "value": "da75710d466d2544bc8f4442b1ce57eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690770, "uuid": "14a6659f-9288-47e8-9c99-9c8d58a9ea46", "comment": "Malware payload (Formbook)", "value": "79e8144ee4e2e97695849928e162288fc282de48ff4caea48314f9cb56477917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690770, "uuid": "d9f69778-0b49-4779-b08d-c1da2ebf4527", "comment": "Malware payload (Formbook)", "value": "8356ff061e4864bfe114fb9e65bed20c267c78e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690770, "uuid": "fcfc6564-5232-430b-8370-d87b16941645", "comment": "Malware payload (Formbook)", "value": "99f8b3b5e99c31bd54f80a74554c3e2e6f50ea5e92d47fefae02730bcef5a089acac277d6b5b10cd6171d1ee2dfc4c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690770, "uuid": "4889d40a-93ae-43c5-bdb6-511bbd242db3", "value": "T18164239D70D49CBBF61112313577F1F5F3BDE1841273274B8BA00FE9A0229E66628759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690770, "uuid": "20039419-b10a-4d7f-b593-2721f8c8f127", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690770, "uuid": "cc5b6175-2e1d-410d-a1be-9ff11115442f", "value": "6144:TxD3m22lVTV6BSLia0bfMUB8uEqLjLQ7LYAbesH/pAK+eRBYBD:Vm246BSLTkfN8ubLj4Uy/pAKaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645690770, "uuid": "7a8e9965-56c7-484a-aa10-1d9cd7f160f3", "value": 320817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645690770, "uuid": "4c88065a-4a37-43e0-a427-13c3f45d44a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690770, "uuid": "52e6f3bf-4c26-40ea-86dd-d04ded7946db", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b29457-95aa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732199, "uuid": "6f4d5c76-8124-4906-8a25-582cc82db2de", "comment": "Malware payload", "value": "9470c7ec3a4eb273bdd72c207de4ddb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732199, "uuid": "a1f03cd8-f3b9-464b-ae90-de0e93d6f4c1", "comment": "Malware payload", "value": "7a22f13fcb3e95959e72cd4d68f929919861322a6c3ee7c55581bc6c81a86208", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732199, "uuid": "41328afe-bea2-4190-8c89-f12ec5c18ae0", "comment": "Malware payload", "value": "ebfff5551dab22400fa9c3440b6642e6186841ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732199, "uuid": "e638bff8-e4f9-4fa6-b264-c508537ae92e", "comment": "Malware payload", "value": "c84d40041b6b94d33d611a2b397710286c0eba3a4f13b4c741c58671f8084f9370702658438be0963a5d4a8bafcb9531", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732199, "uuid": "145ced00-55a3-4fee-8109-441a83070163", "value": "T191E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732199, "uuid": "230c7f5f-e933-4c2b-9ce8-17e3937301a3", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732199, "uuid": "c9da0029-643d-4ec9-9b9d-994d5fb18e50", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XPsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWPa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732199, "uuid": "9c063239-6244-4548-ac87-6ef5eb215906", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732199, "uuid": "fcfb4e9c-a042-4e58-abc2-805dd8adc1fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732199, "uuid": "1015bc92-9da2-407a-9d4d-12fd329227fd", "value": "9470c7ec3a4eb273bdd72c207de4ddb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e745456d-9524-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645674627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645674627, "uuid": "10e5df8a-b27f-4286-ab41-9f674d24c838", "comment": "Malware payload (AsyncRAT)", "value": "d69e9c17762ff1259ab5f63bd64a5180", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645674627, "uuid": "e2df95a3-6082-4af3-87a7-83ca5e2e0536", "comment": "Malware payload (AsyncRAT)", "value": "7a2dd67cfef70965f9adfa25a338bc846d31a2243dfea864c4775fdcb7d878ec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645674627, "uuid": "9ade7182-db41-4146-988d-9e72aafe31dc", "comment": "Malware payload (AsyncRAT)", "value": "11a4c0ea16195ba84c4ab01ceb9edd13ac965101", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645674627, "uuid": "cfb458f6-3f9a-4776-8a7f-e81f1e935c36", "comment": "Malware payload (AsyncRAT)", "value": "df3ba24d4ccda767ec5f7167b353d3b6e0cec2e5f2750fdb172bc458027e398faf14164a407dcc584f38ddaa30e87e4d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645674627, "uuid": "8b782be4-98ca-4976-82ac-96992791c92a", "value": "T154D4BE2038BF20DDF063DAFE9EC8EDB1DD6AF53A260E75BA20421F164B49951DD12132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645674627, "uuid": "66fc854a-58c7-4fec-b863-cac442533842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645674627, "uuid": "1987e310-3e60-4f39-abd7-6ee8041b23f9", "value": "12288:xy8fAI/mLOwsSVOTETJH0Mgz65qfEw777I+33hgzqRnXEJgYZBk:sSHjmOT0Hi/f977I+BgeRnXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645674627, "uuid": "5498c524-fbcb-464f-9f53-1fddcd2336f9", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645674627, "uuid": "ac4e204a-5923-4bf4-b0d9-d3aa21cbe00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645674627, "uuid": "8cfd8840-8667-4f8f-87c5-080b2070cb2a", "value": "New Quotation For The Bugsshpere.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176d4f89-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "448e2b3f-8d23-4a1b-9af8-a2731557cddd", "comment": "Malware payload (Heodo)", "value": "3d02c5b0a71ead685bda39caf14e7d0e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "38f19642-6535-4918-b949-a3b905be4a88", "comment": "Malware payload (Heodo)", "value": "7a3c653e0ff5385cdca9f32320d496fdd841aa438ed4c804764b0ca85c18eaf3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "f0e89d17-3a1b-4124-928c-207003c167f6", "comment": "Malware payload (Heodo)", "value": "d03c95dd5020310c00b399b86a20ea97364157da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660964, "uuid": "668efd65-9531-41af-bb31-a48852a91414", "comment": "Malware payload (Heodo)", "value": "5f466e5ed333e9170229de4a07c22ef9af76cd702e32216e6348d3a5800c34e08c60570ac1d2bad2d435c6adddf1f8dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "70f6996d-b2b4-4440-b4b7-250de99ca07c", "value": "T1AAE4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "03fd1fc3-e21e-4985-b6de-86383cb14a25", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "ee0fadad-dc8c-435b-a138-47f9e95c0b95", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0XhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfFPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660964, "uuid": "e6968272-22d9-413d-b1d4-c464b5f025f5", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660964, "uuid": "d599c9fd-5d08-46a3-a759-e7f17891995b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660964, "uuid": "30efda16-c22c-44cf-8418-5c59880798a9", "value": "emotet_exe_e5_7a3c653e0ff5385cdca9f32320d496fdd841aa438ed4c804764b0ca85c18eaf3_2022-02-24__000239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5590f57-9553-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694783, "uuid": "d68562cf-b9fb-4238-8f07-00636e389dfe", "comment": "Malware payload (Heodo)", "value": "ce195b641dac4796e2426ad241ef8266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694783, "uuid": "94063409-10de-44b0-8cfc-2c490724a3ab", "comment": "Malware payload (Heodo)", "value": "7a9bb48cb2432d9798062d40d1eec163f0dcea0cf8dd0cb1fc34fa4568ce9182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694783, "uuid": "cbb1528b-8d59-49f2-a386-71dac800bbd9", "comment": "Malware payload (Heodo)", "value": "70dc2858cd37bd7403d6423fa72046db7337a545", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694783, "uuid": "8de5f002-c798-4aef-8884-886bdc290fb4", "comment": "Malware payload (Heodo)", "value": "8938f27bee253a8793f898cf7961a04156d5459cfbf6db0e804fc276455bd1cb7974eecf7820e7c5ab2b809848ab2c21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694783, "uuid": "84066c71-8397-4131-8791-19bf213b4985", "value": "T143E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694783, "uuid": "30c28622-19ee-4188-bc54-5068b5b71fd2", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694783, "uuid": "6e0df4b0-273e-4443-b582-3fcc25cf6f4c", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0UhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf4PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694783, "uuid": "406c8b61-4450-48bf-a7fa-38741733134f", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694783, "uuid": "e28831b5-14c2-4f68-b60f-c646541f1ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694783, "uuid": "a6fd3fdf-6f63-44c4-a8c8-88a2bb628525", "value": "ce195b641dac4796e2426ad241ef8266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c47b77d-954c-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1645691654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691654, "uuid": "a9310c2d-50a5-44df-b83c-c41cff9b6ee3", "comment": "Malware payload (STRRAT)", "value": "6db8b2bc470191fed3efd4937f1be0ba", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691654, "uuid": "2063704f-50aa-4d86-ad3f-e78ae6c36b9a", "comment": "Malware payload (STRRAT)", "value": "7aabe909ac93d7930bc1195f092cd2f0fb7ca8dbbb543e4a3d442f6bb13121a0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691654, "uuid": "6d32a97a-7008-44bc-9b2e-84eb53de300f", "comment": "Malware payload (STRRAT)", "value": "d051d2771e38e57334e06f41823bfc76818025cf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691654, "uuid": "278859e3-bcc2-4750-a09e-b827df8b1b47", "comment": "Malware payload (STRRAT)", "value": "ae639215569af26358265c34987d1756605bc0a31809d91c37543a4b9edf37acadb5b09142b10ed9cb3c180d50845ae8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691654, "uuid": "6398e196-b2bc-4324-aa91-13fd662a065a", "value": "T144F3F05EBE9EC4A4E4534672E11482B39A8D44DED10FE11B29FC0D062EB4DAD1B0B9DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691654, "uuid": "9ce320f7-5798-4eb9-9d24-2373c5310bbb", "value": "3072:C0pUMJ0fFxiguPPoPo+DryqZz8ClQGUVBZGAeREuoNmHzD:cG0cN+7Z1qVBZGhEuoNw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691654, "uuid": "a35a6ded-e3f3-4a37-968c-a4acf76fb2b3", "value": 164866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691654, "uuid": "67125078-fe95-4605-b97c-fd7ff19d33a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691654, "uuid": "b913adf6-3d98-44c4-913e-5fbf3da40fac", "value": "24.02.22_11.07_Telefax.unbekannt.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b9d423-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "d1ecaafb-acf2-49f3-a566-ba06396f7193", "comment": "Malware payload (Heodo)", "value": "804fb42148f85a045044f033cab9317a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "ded842c5-1969-412b-a7cf-5b17f4f7e859", "comment": "Malware payload (Heodo)", "value": "7ca1a258d2920d36eba238d9466b4fd7aaf4d4f0435a332cad298aeffd5f5fbd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "fb86aa99-6175-48ad-af70-3dcac1d6c009", "comment": "Malware payload (Heodo)", "value": "987042211cc50b4b907eacc10af035fd5ba1cb7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "f41c99ea-61c2-40c0-8174-aa998bddf69a", "comment": "Malware payload (Heodo)", "value": "15cae8d17d0af1cd555b3f969f546d1be6e138370f487f292b917873e55630a28a3c51073ccb36fec56bf756430966ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "f95a79ea-746f-464f-81c5-2766aad07a6e", "value": "T1CBE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "7d0a3808-43f4-4900-95a5-756c7cf14624", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "28df69ca-f01c-4b1d-a0d9-0561ae1314cf", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKQe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKQLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660939, "uuid": "9eb41c44-bd81-4a17-afce-cce3c746bff8", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660939, "uuid": "dea9b576-868e-49ac-b530-598235c65b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "0ae02363-3bca-4261-9869-8ee96728fdd9", "value": "emotet_exe_e4_7ca1a258d2920d36eba238d9466b4fd7aaf4d4f0435a332cad298aeffd5f5fbd_2022-02-24__000210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad5a418-957b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645711677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711677, "uuid": "8fd1813c-efda-4235-adec-7c693e9eeccd", "comment": "Malware payload (Formbook)", "value": "70e6da64a74ab8f3ac128bd8f118245c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711677, "uuid": "be46bf66-6963-4476-87c2-4c235b11fd0c", "comment": "Malware payload (Formbook)", "value": "7cbcb3673ac17b5a30811a25124f022b36c9069d5a507c670dada3016844e91d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711677, "uuid": "5d22de27-d2dc-475e-8f93-9d86917a0f47", "comment": "Malware payload (Formbook)", "value": "f712f45745d653c6f75e303469f43f6f1834d2ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711677, "uuid": "604bfa07-f005-4047-8089-9e2a0afe68f6", "comment": "Malware payload (Formbook)", "value": "750cf5a528e26485fe8c7623aea8173c273bab2d3c73f21922c933065c12a1817ed133d7411b5fcd9a798be0c5cc246f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711677, "uuid": "0ea3e01c-33fd-4655-9e86-db7098a2c7e0", "value": "T1AE7423A961C24C7AE84686F54BF3C1BE92B7E60C301217836B682FDEAD615D5D53C3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711677, "uuid": "2cb8c80e-ba58-42fc-97e3-13d1da60a93d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711677, "uuid": "30ff5985-96d1-4a36-91c4-341039ac8759", "value": "6144:TxDfLcKOjYnZT/gIisIuJB6PcGo92n9AXRyYiDyednY3dO+3DyYmoWGPsprRz:qzj2gJsV2n+YyednAlDyYmojPspt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711677, "uuid": "ca6246bc-d908-44ea-ab83-f1061377590c", "value": 340738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711677, "uuid": "5936e383-90b3-440a-87eb-9909e7f39a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711677, "uuid": "691d067a-0ada-4879-a861-82ce2a857ae3", "value": "top566543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4499ac-9530-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645679626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679626, "uuid": "d6bde1d5-d5e9-40c0-bb46-a755e4ce33cf", "comment": "Malware payload", "value": "73984f17b0131ee81b53b779cb89f3a3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679626, "uuid": "c1c815f8-6d22-4621-a293-705a3e3c3b78", "comment": "Malware payload", "value": "7d3af31f3ce3dd8fd33212d07c2f40f533abb8b9a37d237c862751581042c432", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679626, "uuid": "6815c121-d690-4e8b-9697-8a708f5734f4", "comment": "Malware payload", "value": "5ec19911df40249e9d2584a3f18941711534ec63", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679626, "uuid": "5e7b5064-efe3-456c-837e-98521353611c", "comment": "Malware payload", "value": "15712f63a4dd551128c2e312275a98d84f5070351763d493571cd113e8d85d5f1ebc79d2d8fcde574bd8aa2de5f41b1f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679626, "uuid": "d9532457-6ea7-43a6-b8ba-a9482e0a4305", "value": "T104C6015BF3D8D99EC4F3A332497A1225175A4C219BA397972A14B33C28F39E44B4DBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679626, "uuid": "5cd5a949-793c-449e-a13e-50bf42c48cb9", "value": "196608:vUO4omdPNFDYIjgczq1I5u+z06m+oyy5Llh9tKlB02SGSBSSWSdjJ:vUObmdgGgctM+o6m+M5LlTY3SL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645679626, "uuid": "4ec72ed6-ba4a-475e-ae93-c1ad522bce51", "value": 12503494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645679626, "uuid": "f0241afb-87e6-479f-9d49-9c3b44a8fca0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679626, "uuid": "b8e949ed-02ef-42ec-b20a-fc802b5f8706", "value": "Easy Photo Editor_1.0.0_apkcombo.com.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25edc36d-9575-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645709092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709092, "uuid": "cb549c4c-73b7-47b9-baa8-b7afa082541e", "comment": "Malware payload (Heodo)", "value": "cc82db50788f0157f95cc2b7c1efb02b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709092, "uuid": "7f5e7ed7-78ee-4f91-813a-039382e55100", "comment": "Malware payload (Heodo)", "value": "7d5b223f0004eaf69af03024ae16ef01721142306bf61737579183b23354fe64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709092, "uuid": "40ee2d85-d56f-43b7-ac8a-02daeb275596", "comment": "Malware payload (Heodo)", "value": "7f9179884d10a1fe6b696dca06cd3ce80139880b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709092, "uuid": "416d7b0b-1b9a-4ddf-9723-2b2baba2e18b", "comment": "Malware payload (Heodo)", "value": "570158cc1746fd65cc0494bfd5b334408e7acb3724da78cd9bb84b4bcd49cd9ceaf45ecd87e24441ddb35b26ab82639d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709092, "uuid": "62052eaf-e32e-4b44-9348-b2b94bb1a207", "value": "T1EFE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709092, "uuid": "b3981d91-8b3a-4f79-8b79-1a31dc7c978a", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709092, "uuid": "46ebd0b3-6c36-49e5-bf55-219968c8a49b", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XxsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWxa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645709092, "uuid": "0d0cb91c-c65d-4825-a10f-d24d4f2e8565", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645709092, "uuid": "d986030c-7f53-4247-91e2-7e36bbac5602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709092, "uuid": "9a435a4a-8109-4eda-be38-3de2db0a565e", "value": "cc82db50788f0157f95cc2b7c1efb02b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974242c2-95cc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645746648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645746648, "uuid": "d93dd8d4-5db6-46c4-803a-a6f13dd1e097", "comment": "Malware payload", "value": "e4cb534b646b3b6bfbc21f22f96d133a", "object_relation": "md5", "Tag": [ { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645746648, "uuid": "c51e00be-0e8a-47f1-895b-23f81f124a45", "comment": "Malware payload", "value": "7d77b1b0a14dfcf616d25f4eec511b2f1e1d9d586c3ad0544a1793c972879f39", "object_relation": "sha256", "Tag": [ { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645746648, "uuid": "1e9a711b-d185-46a4-8873-b15544d2c8bf", "comment": "Malware payload", "value": "f7eabec191a123251a60e6cd7bc33e0d0858bbca", "object_relation": "sha1", "Tag": [ { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645746648, "uuid": "3ab3147e-dfb9-4bf2-a799-d49ab4ea4a11", "comment": "Malware payload", "value": "80d22054db19a8a6a6c43e2a5dc248fbfb7e6841e586d3575386035dad15505a13c2b58b28fbc79bb1d9d7a8e6304544", "object_relation": "sha3-384", "Tag": [ { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645746648, "uuid": "aa85aefb-7c73-4385-b9ae-017aa166472b", "value": "T1CB544B0027EC8B9AF2FE4BB8D4B01265C3B1B466B83EDB4E6D4465DD2923740D945BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645746648, "uuid": "8aa91061-5088-4444-b972-9dc3a04952c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645746648, "uuid": "b8286a14-a8e5-4c04-add5-465e46284e3b", "value": "6144:Hf+BLtABPDOZJc9VjFe6UlwYONlYeJalA1D04n7:SZqA6UlwYylYe91DH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645746648, "uuid": "8b6bd4f2-b740-4484-8a33-54acfd403034", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645746648, "uuid": "bc9fd6a6-cc5f-4ff9-92c0-f5427ab7a9ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645746648, "uuid": "7b0b949a-d863-42ac-96b2-0d1ed1a5dd19", "value": "bBXuJ48w.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8665ea8f-9548-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645689926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689926, "uuid": "694d3f0e-f782-44e9-a5e8-f17c2feb368a", "comment": "Malware payload", "value": "92131671c46da1ba29b85e06bd4b94f5", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689926, "uuid": "6f4a47c4-afe4-492b-94a6-015687ff3076", "comment": "Malware payload", "value": "7e12537a47472bc0bde759d99780faf2fb7b20410255da7e8901eef6d2c0cc14", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689926, "uuid": "dc194d05-cc38-4ec8-866c-135133143b22", "comment": "Malware payload", "value": "ae2cf3b1cebd62a8adcc162ae71f0215f416bc74", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689926, "uuid": "b4f5d576-cd19-42ab-933b-d800f6a62d47", "comment": "Malware payload", "value": "d7ce9cb9bba6886696cde7a09a90adf73839648c1b3673c152452fe6848379ecb99cc294729209b0953ce8d272a7fada", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689926, "uuid": "57148432-bdf1-4efc-b564-11b327d59ac6", "value": "T19E13BF18C112210AC273293EC83889E55997DC57A12644DFD5EABE4B1B64EDB3B4EBCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689926, "uuid": "d5292728-15b1-4b9e-8b22-aafc82b27988", "value": "768:L+JsRD4S0JS00SneSnjS0yS03S0IMS0bS02SxD/PoVK5Z1lDVn3QFTy1xqwVwxyc:L+JWp75eAGANf7dzm1/K8NytsR62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689926, "uuid": "947d0479-597c-4d3f-8c83-cd28490698b4", "value": 42622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689926, "uuid": "89f95066-0086-4ffd-b70e-bf8040acbe02", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689926, "uuid": "f9ef9e4e-28d4-4a99-ae60-aeb21fb515b4", "value": "List#RFQ.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae66ae0-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694175, "uuid": "51c1f747-be21-4c87-8043-6e78442f22e8", "comment": "Malware payload (Heodo)", "value": "7fdac02515108681629b69403457e570", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694175, "uuid": "18c47839-76b2-4160-b9d1-cd29ea302313", "comment": "Malware payload (Heodo)", "value": "7e2a1c312c5589dab6c35eb0cf3097e8b7fca1d3dc73f0866d38ffbcb368a321", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694175, "uuid": "637d108b-e857-48de-bde3-060e4a70e383", "comment": "Malware payload (Heodo)", "value": "d7a39ff397301beb1134fbca18f8452f7667347f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694175, "uuid": "e0c92d02-b91c-4a8d-b69a-499bb253969e", "comment": "Malware payload (Heodo)", "value": "bf19ad933a425c90dc34475cedc3219ab14aafb73f570a4653f3bf0354c5033cbece8bd4dabe77226711fdc200352fea", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694175, "uuid": "6e1b0aa4-abaa-4d59-9c60-4a5a31f51180", "value": "T123A4E0067490C90BC66903360CE683E26337FC512F76935732C9BB2E7EFB6916E92645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694175, "uuid": "26feb687-7dc0-4558-ad78-7b28e1420cb8", "value": "12288:c947a/JjsLZjXYc7X0/aXCKli04OaZ1XcwjhFQ:WurYc7E/i004OSZjhFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694175, "uuid": "af6a476c-e8f8-43aa-a9d5-18a345d54ed9", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694175, "uuid": "1de8551c-a8a5-4f42-8276-9871924808c9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694175, "uuid": "ffe0fdad-31b9-4a6f-9272-23397e44c5fd", "value": "Opast Publishing Group.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf371245-954c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645691739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691739, "uuid": "a70135d7-24c8-49a8-8a45-4893e7f8f051", "comment": "Malware payload (Loki)", "value": "ab49bf1e27687e6ecaab5d01d92b7ef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691739, "uuid": "8477b97a-c41a-4f12-8089-3cf18a21c05e", "comment": "Malware payload (Loki)", "value": "7e42b66bea4d38d0d771507ea3b8fee250f2b8d39e553794ec3d831a439d0bab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691739, "uuid": "a223d80e-99d6-4b17-9f62-4acabf354750", "comment": "Malware payload (Loki)", "value": "33ae314c7e8b1131308bf8b45e2c1d8d26bba1dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691739, "uuid": "ecc12389-76de-4aca-a36d-35a0e42e9a70", "comment": "Malware payload (Loki)", "value": "6ff44e2becf4e03e9773e16289e972b581f69cda6ccc9490f228faa4cf66f8be01950714e86900d5404eba9819c3a5c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691739, "uuid": "a3f229a1-7567-4b84-85c9-cdc8425ab857", "value": "T12C6423A763D894FFCBE64F70877B6258D77A60043921118F9720AF1AAD285E3BB07453", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691739, "uuid": "18494753-50f0-40e5-9a42-a7f452e3a7bb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691739, "uuid": "b5f6283e-3b54-44a4-bad1-36494991fccb", "value": "6144:TxDfzO7DqTd6cMEHstMjZlDXAGTsGGKiu+F+MGMwkgdeQYTsZiyURbEt:9C7GTjIQZlbAJXrZWBETRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691739, "uuid": "92a10e32-829d-4002-a313-c11ef8f81916", "value": 316964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691739, "uuid": "c68de7ba-f7cb-4441-8c27-a3a186e5d4c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691739, "uuid": "b0ba6d01-665c-41a8-bd4e-e08b48aa1eb8", "value": "ab49bf1e27687e6ecaab5d01d92b7ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc8f15e-9550-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645693297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693297, "uuid": "b1965f14-2dea-47f5-9065-5ade7a1bf208", "comment": "Malware payload", "value": "049bccde1ace69a1e4e38a3dd3dd798a", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693297, "uuid": "472dcc32-9850-42cc-90bf-bd5fe995525d", "comment": "Malware payload", "value": "7ea20fdb8ecf698093ff02757db174479d2a569a14dc7d82966a6b50dad160f3", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693297, "uuid": "2df4105a-7c8f-46a3-8ab0-7bd02f1cd301", "comment": "Malware payload", "value": "557c56b81b496a75cb68640f664aa9218d476ea4", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693297, "uuid": "d121eb1c-ee58-4b7e-8a29-6d4e6d9b8eb8", "comment": "Malware payload", "value": "15ee90d68a84df53bfbfce9bc712bec0418221a71434265a06b3f258da3469d820bf253bb6061482fd96012b777dbd16", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693297, "uuid": "c5471594-99a9-44c1-bc41-c1dc60aa61d5", "value": "T1108107AD034FDAFDA153BC84D9C95A53EFA546260A2CE6C0CFA0BEF6281157CD4F1884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693297, "uuid": "9a14e018-7d48-4b81-821e-60a34ef4278c", "value": "96:Oq0H5w5o9R6kGuROJorB7RCsfXMIU8IBnzoPqT6Y4U+2PFxe:OqAvfBGuRfN7RDUIU8Itoe4jcF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693297, "uuid": "e60f8959-8a08-418a-812d-4276d1c6478a", "value": 4047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693297, "uuid": "2388398c-e619-4092-8c8b-96ecde8e439e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693297, "uuid": "1c0065fc-c7b9-449f-8200-464ffb6bba3c", "value": "atto_80.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14281e34-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "6a4810ef-e1f1-4da6-b960-257528321356", "comment": "Malware payload (Heodo)", "value": "e5312f345ba8ec58c6e50c5fcd1636c7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "1487a7f5-2e05-45c3-ae72-39b09ec3d19b", "comment": "Malware payload (Heodo)", "value": "7ea9dc1b52434c6898592a27be3d70f8b198615a26a07f4eba310f9f362ad46b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "988a72c6-de97-4915-b3c1-ab4fdc818319", "comment": "Malware payload (Heodo)", "value": "939b80216e98d9954de5894bf7a6bb2598f927f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "85c4e36d-e267-4264-acf1-32d66a5692a8", "comment": "Malware payload (Heodo)", "value": "d6605efa8d1da862cf7d0248b8d0dfe7f98cfb5509ddbf68d6963e10c18eca05870390faafcb64b0a232f38bcf891a2b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "ee795d2d-dd90-4a27-85c4-a9cacc428627", "value": "T121E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "bde957fd-d758-4ad8-9d18-18a98d8411ff", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "11936f23-205c-41c4-b324-808d907909c5", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XKsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWKa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697895, "uuid": "2e0986e3-2b78-43c6-b2e5-3410e98b00b2", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697895, "uuid": "68e3a490-f2e8-41ce-81af-bfa75103a5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "210015cc-2bbc-40d8-a8c6-f2eea92da4bd", "value": "emotet_exe_e5_7ea9dc1b52434c6898592a27be3d70f8b198615a26a07f4eba310f9f362ad46b_2022-02-24__101810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e916c795-9581-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645714573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714573, "uuid": "b1b95c26-6fee-4b78-88f9-1622ede0098f", "comment": "Malware payload (AgentTesla)", "value": "9e7284edaf2e782a0d158362d5c6ab3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714573, "uuid": "31a3717f-b37a-4c2a-9419-46da8a3824f1", "comment": "Malware payload (AgentTesla)", "value": "7eb10b133b336c0482643df264edc82307c58e1232c898a1bc149b260e1cc69d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714573, "uuid": "9bf6ffc0-4081-4efc-ac5c-09caa9f24206", "comment": "Malware payload (AgentTesla)", "value": "8d8866491cc017d768b486494e0ceaac0c2ea349", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714573, "uuid": "ac6cd84e-680f-4205-97be-a2294bc87277", "comment": "Malware payload (AgentTesla)", "value": "4ee7abe42a54896506fcde45fa9f751ced4c1b0e298ab66d52b3387beb3f0330fbed04dc7c4644c9e28a03fab1da3fa9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714573, "uuid": "69b3e87e-a033-4b02-aef7-22def0403cb7", "value": "T1E005BE1024AF26CEF1768BFE5DD8A9B08BBAF53A3519F1B91C814EC60751B41ED01A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714573, "uuid": "ef4a832b-7317-4030-85ff-55ec5e01be3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714573, "uuid": "8f82a236-16b6-45f9-8c9a-a3a567210c19", "value": "12288:VBA9EJgYYz0vfXGiWyyiJIwwvYS7KtdtWspNHwxPOf4SjNnirstzt0xnrMuUEH:m9TkIh+tdtPTHMJ2wr0zyxrMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645714573, "uuid": "5d5847c0-178b-4cb5-a926-f9c4068ff77e", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645714573, "uuid": "6ec220e6-81f2-404d-88d9-1655ef8f93f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714573, "uuid": "db2851ff-982c-402c-8a5c-15c828caf44f", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21545f7b-9550-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645693193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693193, "uuid": "5b8b3c0e-07ac-4499-bbe7-022176997b78", "comment": "Malware payload (AgentTesla)", "value": "486afe7d857e5a649cf8c1d5f7437436", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693193, "uuid": "9115876d-b0ad-41d1-90da-01f38a13a4cb", "comment": "Malware payload (AgentTesla)", "value": "7eebc4f2ec92557e283772ccc07186c3b41062034a51b8c82ee0d0f21891eb37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693193, "uuid": "10878c03-af3a-427a-a5b6-9fde96fd2656", "comment": "Malware payload (AgentTesla)", "value": "e8c1eb18e8c3c2d1ea7b2b225f0f456240dabe77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693193, "uuid": "94043c02-c2cf-4faa-a7b2-c46fb9e0fba1", "comment": "Malware payload (AgentTesla)", "value": "590a74813b1b5b4ecf50a96b7596818176262b252c05b93e83537fa4308bab451556f3e83496b03307406935e772949a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693193, "uuid": "45164cf8-f5eb-40ff-8801-b1ee5f9dd521", "value": "T12E05CE2038EF60DDF0739AFE9ED8F9B58D6AF63A261D35BA10850F170781A40DD52636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693193, "uuid": "866d2da0-da9a-4067-932d-d4ac0969bd47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693193, "uuid": "b696d192-627f-4ab7-9fae-737c197b2d72", "value": "12288:0EJgYYz0LqtUoeLl3MFXhN1GnbsL1MJKI2+RZKIkUI6pzJGebNhsIEhDxA:09Uoc3qxrcbsZMJLX0TUHfGebNsdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693193, "uuid": "40907a13-6583-4439-9ed5-7cd47cf3a1fb", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693193, "uuid": "a708d2cd-02f3-41db-b1cb-caed48f50f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693193, "uuid": "5a9c78dc-0da4-4adf-981d-b2816eddecd5", "value": "486afe7d857e5a649cf8c1d5f7437436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a6b63c-9518-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645669200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645669200, "uuid": "5eec5b70-2673-4e33-ba0b-611e7c2c40ae", "comment": "Malware payload (Mirai)", "value": "3e8e90c58f7853ef8f79367305a2106a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645669200, "uuid": "68037432-ea19-4915-b777-3e84dba91d7e", "comment": "Malware payload (Mirai)", "value": "7fdb5e66e25c18347e1f86ff775037be196ec23d277c80da48f926a98c216c9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645669200, "uuid": "e8c4e8bd-dd5f-4b2c-b2ac-f7b5ab4a8e1a", "comment": "Malware payload (Mirai)", "value": "22ae2a81745abd0c843e866ac3db51024078f322", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645669200, "uuid": "6f2f7468-06f2-477f-bb63-68dc267413f8", "comment": "Malware payload (Mirai)", "value": "e0d2e2deeb7e80c525e05550c4b5554eb15d9098863306723e05be93c7e2f94a3e3d600105d643d4deda5169140d832f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645669200, "uuid": "3ffc5553-4394-4935-843b-cca6fc09bd6f", "value": "T165C33B46EA408F13C4D61776BADF42453323A754E3DB73064A28AFB43F86BAE0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645669200, "uuid": "399a7b25-5dac-41e3-9380-e11ace94eabf", "value": "3072:0XjoIzBv30BtGZK8k9yL89dUvoK1xDvuNPoM/9b9nq52:0joIzBv0OW9yL89dbK1FuNAM/9b1q52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645669200, "uuid": "1f4d8e33-dcba-407a-86e5-f3c1eae217b1", "value": 129575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645669200, "uuid": "b96fac6b-246c-4995-8d78-3e54726b9108", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645669200, "uuid": "3a07521b-de8a-4032-aee6-f5a7784d480f", "value": "3e8e90c58f7853ef8f79367305a2106a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e4ebd6-953e-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645685496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685496, "uuid": "4765f213-6918-4196-af07-096a6e5453c7", "comment": "Malware payload (ArkeiStealer)", "value": "df65411cf8f715ce792d65df9ddf4c4c", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685496, "uuid": "c541a47f-6ce6-4592-a99a-a1c70b732424", "comment": "Malware payload (ArkeiStealer)", "value": "81a449523d14d85d9ae787847e8d00c5b408c7f7153231cb9c80b3e7914be9fa", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685496, "uuid": "6c27e48c-873d-4f8a-81fb-4252e8547842", "comment": "Malware payload (ArkeiStealer)", "value": "31fc8b4cd3e84fd355e62faa00773fd3c160ad03", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685496, "uuid": "82b73ba8-12cb-46ce-be5c-5ec327c3d1ab", "comment": "Malware payload (ArkeiStealer)", "value": "43a9c87d1369c5e26a70540d9ae3b33d42668f3d6ed7d0ec3b2ac7245d3369d95e5eaba715f7b99ccef9e649c3a89194", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685496, "uuid": "9ba6c050-ed1b-4c69-94d5-748343f6ae33", "value": "T1EE54BEF07980C431C046F6305426CFE4466EBCA5DA985A4373B43E5F6AF32D2A5B9A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685496, "uuid": "d676b2b4-9128-4a84-814e-91af6ba062a4", "value": "917b0dc587f632b60bbe39ab8c418265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685496, "uuid": "79fbb1a4-0b33-420f-a010-4286037744ac", "value": "6144:+JNY37PqVXFBbKfx0lVkmM+7ITsqxEZzy:+vQ7PkXT0MV57uEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685496, "uuid": "34c0f430-35f3-41c9-a8d5-e182b59a4958", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685496, "uuid": "3eca16f5-507d-48e5-85e2-e8efccb738c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685496, "uuid": "61a9fd12-9997-4b25-b796-c292ff180e7c", "value": "CALC1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0244a72c-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1645688416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688416, "uuid": "d1c461e9-23ee-4c9d-93fc-07d3bb3cdd08", "comment": "Malware payload (Socelars)", "value": "319aa553383517c3163ed5ac53dea0e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688416, "uuid": "32ca688e-cb27-4c3a-8b86-f8c69d42e534", "comment": "Malware payload (Socelars)", "value": "81c2edbc5e2ab198652b7f10120adf9d53c18abd2656aed50b494b84c1480fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688416, "uuid": "6ff0b74c-90f8-4d21-928f-043a8d497d00", "comment": "Malware payload (Socelars)", "value": "c29c7cd482801a41b39b077b85314eb9d3d7a203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688416, "uuid": "2d534327-9c34-4938-85a2-00cc7d12cbcc", "comment": "Malware payload (Socelars)", "value": "2395562c15f205355240bd5f022f858e0597a55c87f28d638626a019719dade4901aa1115cfa2974262ce399d0028ad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688416, "uuid": "eeae6925-8924-48d3-a5c0-6646980ddd5d", "value": "T14A658E16E6829036F8D7087292BE1ABE8D2CAE51031850D7D3C47B695BF15E33F326D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688416, "uuid": "9cfb8c30-5b22-4341-b65f-ca80db44d7d9", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688416, "uuid": "f3aeb979-9e86-4606-9621-247851bbc9e6", "value": "24576:yOpDAMk2izEnuE9qHx8vLKQW5jssUZsMkvvnXQhYpjC9Kxs:5p7eL+ev+EvnXQhYdpxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688416, "uuid": "c854d429-1366-4587-8312-a81f4a671aff", "value": 1526272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688416, "uuid": "6b7d1a92-7ffa-4400-858e-a289505f790e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688416, "uuid": "051ed29a-f8cc-4dc4-98d3-d4bd0b7ee75e", "value": "319aa553383517c3163ed5ac53dea0e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742fe26a-9561-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645700633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700633, "uuid": "c41bec1c-2e7b-42ff-a62c-175b850ccc6e", "comment": "Malware payload (Heodo)", "value": "3bb07c790b31d436689807d24329c677", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700633, "uuid": "c8ae0aa7-f2d3-4caa-800e-539106d27498", "comment": "Malware payload (Heodo)", "value": "81d4039025aa0ca25e967eb89dfcecad7b5b3f1108cc15260e1e826de20b1d94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700633, "uuid": "177fe32a-703a-4f95-942d-7d2708ab5ab1", "comment": "Malware payload (Heodo)", "value": "d589eb66a3b51987416ce13f198429510b8fa562", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700633, "uuid": "15fc901a-706a-4e6d-847d-003c8870f3ca", "comment": "Malware payload (Heodo)", "value": "6104ecafeccb6e6878dba6aab8c382dbd399b6803af8802d83e235d1096f6083e8f5d076cbd67039d492e6ee103cee9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700633, "uuid": "cda633b7-9b88-4ee4-a610-b20505284f1d", "value": "T16FE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700633, "uuid": "da8e7d69-d3e2-47c7-a7a0-fffb410a2247", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700633, "uuid": "8e33f8ee-35f7-4b11-9f98-755db8be2d60", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKoe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKoLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645700633, "uuid": "55408480-cea7-466e-931c-3c78566cd3be", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645700633, "uuid": "0310c000-6a0a-4439-9ee5-3ec63410482b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700633, "uuid": "d6538737-012b-4322-bf14-83148c19eb43", "value": "3bb07c790b31d436689807d24329c677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7211f388-9536-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1645682161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682161, "uuid": "71598a7b-1be9-46c4-9eea-77e4b22ed987", "comment": "Malware payload (CoinMiner)", "value": "6755d5cc3565a018189303a4f7a237a3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682161, "uuid": "1700592b-7361-42d1-bb1e-afae8276600c", "comment": "Malware payload (CoinMiner)", "value": "82346f3a4b7e84f746f6242ff70265b1467ffdcd01954f71806f86c2989a9819", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682161, "uuid": "93823ac8-2737-456a-a50e-8695f69cca7e", "comment": "Malware payload (CoinMiner)", "value": "a364b7678ec9ad89a2a072995f564c12fed45af0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682161, "uuid": "c9ef73a2-d5a1-4111-b689-d5aa7ac7b1b0", "comment": "Malware payload (CoinMiner)", "value": "e37f4ce1f9108959c94144525329ffc35cebfd561351baa0d4e97e2f328c630d3d99d21b309bdb2265ca1a4b074348aa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682161, "uuid": "d7a3c6ee-6682-4fa8-ad04-c42ca2a71427", "value": "T109E36D2578D1C472E66214313AB4D7F0896DFD315F60999723841BBE8E301F29AA9F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682161, "uuid": "478c5f47-f9be-4d17-8d53-2b64e7934eaf", "value": "80b869d1c156457b41f293ad8b5c0300", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682161, "uuid": "6181cbf8-2433-4006-aaa2-f2a60c4f62a6", "value": "3072:R4rJOzXxyCsL9IlaUCJ8dYed7a/CZNAxWJ4uPgkt1ML4/wBbsu0:28zXxyCsxIla78draQAxW4uPgzBs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682161, "uuid": "13d86319-af5a-4428-beaf-d3526c9c431c", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682161, "uuid": "276a6467-c86c-47ba-80fd-0c50fb8c630d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682161, "uuid": "8e738301-2acd-43b8-89b5-53eb54716794", "value": "82346F3A4B7E84F746F6242FF70265B1467FFDCD01954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2b4770-957a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645711198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711198, "uuid": "38cec8f6-2be6-4992-aaef-2c70cd8f386e", "comment": "Malware payload (Formbook)", "value": "63e73fe914c68e9b5df621de7f917864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711198, "uuid": "8c9ce950-7c3d-48f6-a20a-469f5238e033", "comment": "Malware payload (Formbook)", "value": "82c24935270870bb35719f35c29075f8bf02894bf81ba28e66983aa2247472a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711198, "uuid": "4e30afb4-338d-4159-ad41-df2a194fb071", "comment": "Malware payload (Formbook)", "value": "8ccc87486036ca608079227976594ff0dfb17b0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711198, "uuid": "58b07309-5681-4110-93ea-b67c89589710", "comment": "Malware payload (Formbook)", "value": "3900f1e7c375f695881be446438e229e4f3224d26a24df31d730c455ba3475ea4a991387b0c668c5cc48a5afd375edb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711198, "uuid": "069605b0-d6f0-4234-833b-dfed07a264d3", "value": "T1E315AF22F291C532D42B16344D1B86699D29BDB03D2CF84B3BE43F4D7E3664A3919E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711198, "uuid": "eaa0d370-5ea5-4e8c-a8c5-33c524f3ee47", "value": "1c02903d270a37655f586f4aa8bf43c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711198, "uuid": "876a2484-e1a3-496c-a3bc-3cc2e86e4a0c", "value": "12288:Cwkcdx+EleOmksXHxvkAhNSpCsJHr3A5WyS2x3pxjsppdTc:CBoxpeOmBBtQRJHrw5Wyd3/j+pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711198, "uuid": "d735a8c5-b51e-4e17-ab8f-90f81a2faddd", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711198, "uuid": "4fb39e93-a8d8-4b1f-9d6b-e613de19360d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711198, "uuid": "dac381ba-53e5-422f-ac4b-f4b2da498249", "value": "swift.0292981716.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3c4c1f-9575-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645709159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709159, "uuid": "279c7538-b798-46d1-8d89-a6c36653023d", "comment": "Malware payload", "value": "3acbdcab0ef2f6a50bfc9521c8bc3763", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709159, "uuid": "63922f38-e04f-4ced-b2dc-dbccc5d72072", "comment": "Malware payload", "value": "84ba2acb9feb07cc8e2179192638e042ce119901391c6c3188ed32f53ce449e9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709159, "uuid": "e11630e7-08d3-49d6-994a-5339adff7695", "comment": "Malware payload", "value": "00af009d41eec73aa80e06c465ab96b4fa6e5c6a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645709159, "uuid": "6598080b-1b85-40fd-9aa7-777aa72e3c6e", "comment": "Malware payload", "value": "b39cd6805bdb835e5e91b0eb7e39c96ab97427e4c2f802619c46e1789154625d999e989415fc03636aca8de72fc1df9d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709159, "uuid": "33ed78fd-bdbf-4f66-bc18-6aa90a1a73f5", "value": "T144D6338BE70DA4AFD8BA15328A75032506576D654283C7EB3E0DB22C4BBB5C05F59FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709159, "uuid": "99ae2cf2-055e-4159-b5d7-1949392b1120", "value": "196608:fq0m0OnjW/aAAtKW7ok6BSpGT30HeUyJ6acWLHAHQ+rFbFFFKpQuKn/kdxOHC7f:y00CAR72x3JJ4W7EFaQj/kDOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645709159, "uuid": "f267daca-c1fc-4208-8d51-3af90583a411", "value": 13743374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645709159, "uuid": "204ce5c2-2184-4292-90f5-9530ed31616e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645709159, "uuid": "355b01ae-3fda-4989-8b0d-c801d280f2ce", "value": "84BA2ACB9FEB07CC8E2179192638E042CE119901391C6C3188ED32F53CE449E9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9913343-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729096, "uuid": "e4f664be-7773-47c5-a641-7e59846bbf0e", "comment": "Malware payload", "value": "4649987c0ada337aa15792e8c47b4dd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729096, "uuid": "03ff994b-4b3b-4f21-b564-1a4df5aba4fd", "comment": "Malware payload", "value": "854cd37397575bbbb983b6921669ea855a438e81ecc51fd02bb03c16c35d26f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729096, "uuid": "f11f07a4-112b-40d6-b385-636685853288", "comment": "Malware payload", "value": "5747d1c41f972b53c125e7a250cb8c958698fbea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729096, "uuid": "69add416-432a-4d3b-9a91-18a744a10f70", "comment": "Malware payload", "value": "350a109782d20dea854c223e0ce789dc6bb1217a440d49d98cdcbf100b9d90b9f5ed783bb8e5c4370ee222c2475f5359", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729096, "uuid": "156346b4-6a91-4727-9aba-0887d99a734d", "value": "T120F4122272296E33CE2C05F9B481395447F4506624A3E7D58CC7B2CB22E6FD9AD41EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729096, "uuid": "ac0590eb-9aa0-4c3b-9336-9275682f6471", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729096, "uuid": "c2a672c2-c96a-4d81-8f28-53c684a6561d", "value": "12288:RxVDz/HpSXoLNCI2ZNOMey+lonaiFi6cKu8/BGhzVUgLOeYQaTkpS6Y1vCnRtnW2:V7pSmmfTaUiP4GZw7QaTkpS6acRtWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729096, "uuid": "7aea4ecd-c64b-4e17-80bb-c5a545ed3d24", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729096, "uuid": "74dfca7c-944b-4f4c-90ed-b6019ec6991f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729096, "uuid": "df9a9626-51d5-4c72-bc42-759b3989d642", "value": "4649987c0ada337aa15792e8c47b4dd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314fb7ad-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645688065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688065, "uuid": "30bd3b62-5fa4-483c-afd4-7bf7aebb238a", "comment": "Malware payload (SnakeKeylogger)", "value": "53efe74817ba065e55a2bbdac6cf8d0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688065, "uuid": "17516fed-5a54-475c-ada6-ce59c40c4f23", "comment": "Malware payload (SnakeKeylogger)", "value": "85b6da839c821baebbc2644c94fa6328c119644559d6db4fb80f831ae2e4d564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688065, "uuid": "c77cda39-9642-4fe0-be46-9dff5c8a9918", "comment": "Malware payload (SnakeKeylogger)", "value": "6faac0912dc92a24fa36f7283b405590f5078a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688065, "uuid": "1f0f1bfc-4191-4336-8971-3dbb02dbfd92", "comment": "Malware payload (SnakeKeylogger)", "value": "37b1bef35933d239779eee24e8ef3005fdc0c6e012dbe4ffe9d39b76666fe869f5b3643135e5e43abf2a99bd9e8f73f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688065, "uuid": "f32c165f-640b-488f-a0e4-7a8dbdc1ffc9", "value": "T1A3F4AE5631EF1052D7B3EBF10BE8ACBF8A6AF173161E753931812B068766E40DA42375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688065, "uuid": "e291a9c7-765b-4ba0-b959-0c48efb92323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688065, "uuid": "1ee634c9-8ec1-45c2-b440-086eef34bb33", "value": "12288:F5Vko2wa3z07Umk35Lw2SjPJL6UB8DbNQAew7plNGr3CawIvwTnyJhk:kwawImkJk2STJCVQQ7plN7awNnwhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688065, "uuid": "dcf4222a-3677-4dcf-a37e-820e08e247ff", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688065, "uuid": "2e49cde3-0211-4f7b-8f62-5517ad1ec4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688065, "uuid": "5402e19e-efb3-4333-8ab1-888289a5caad", "value": "53efe74817ba065e55a2bbdac6cf8d0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160df612-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660961, "uuid": "251111f7-3335-4c79-942e-2972e672aa0a", "comment": "Malware payload (Heodo)", "value": "235ffecbbb0c2bc4e97483c551704826", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660961, "uuid": "d8feba28-4274-4ebb-8472-8b331cb74c62", "comment": "Malware payload (Heodo)", "value": "8652092d6a89ebfc12e72c02b96c0250a802c8f1cd2d36451129b4bd4412151e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660961, "uuid": "07984861-1116-4504-8f1d-cf711113729a", "comment": "Malware payload (Heodo)", "value": "4a13e2c5faf43c814cb699360b4965b7a2d1e175", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660961, "uuid": "427977ef-4ab3-4a2f-9fb5-3c620db6dd86", "comment": "Malware payload (Heodo)", "value": "47eecf2fa4c8e3ee2dfd5ba13043d596eb483e93e88f59142b54bc57f660b2ad940c5b357f233ee88b42ff3579d3de01", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660961, "uuid": "16c7604a-4315-4fa2-a9bc-0d49fa71dc8f", "value": "T144E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660961, "uuid": "92bd674a-cc69-4f73-93b4-0eb51322f5bd", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660961, "uuid": "bdfd3f34-4509-4991-ba4c-04bfe5d2f9a6", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0BhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfPPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660961, "uuid": "762a98ce-249f-4d1e-853f-a079cc061e65", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660961, "uuid": "e7bb6fcb-9756-47b2-8cc5-31b1a7a46c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660961, "uuid": "20f92efe-a216-4f19-aa15-a09f3e2d8126", "value": "emotet_exe_e5_8652092d6a89ebfc12e72c02b96c0250a802c8f1cd2d36451129b4bd4412151e_2022-02-24__000234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71226640-954e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645692467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692467, "uuid": "4677f701-5132-4342-9972-5bca52892250", "comment": "Malware payload (Formbook)", "value": "702069fc1de8da9ae25174ef87572c93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692467, "uuid": "cc1eb808-59f4-4826-af24-487482bbef92", "comment": "Malware payload (Formbook)", "value": "8699ab95036f58c0853c87c8e15b01c4a27c5a955923fdd7b11b4c1761567f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692467, "uuid": "2500281b-d35f-4814-bbf6-a4150c60b855", "comment": "Malware payload (Formbook)", "value": "313449d010b8acbb5bdc1b22ccfc0a4175248965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692467, "uuid": "15b85118-05d7-4383-846f-eb51fd869a72", "comment": "Malware payload (Formbook)", "value": "04bd2100f507a4b59477b8a823a97a187aedf7ce02e73b416248123d273c242b074bf42d06bd991805ccc2cb0808d3e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692467, "uuid": "0761e121-071b-482a-8059-7fe852db33b8", "value": "T1A0741292A2C499FAEC6607B459338F24A3FF7F5A54B2638B53A53B391633383121D147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692467, "uuid": "ca6b3a95-be4b-4fe9-9bf9-4fd375055913", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692467, "uuid": "82a216c8-660d-40ab-86d7-b0d85f31e1d9", "value": "6144:KxDaK2Wbxc3lWJaVoUwG8z5YmdmG9X0phUSeA4POh2H6zhMAPFv/zmBFSF8F:pMSlWJaVg8mQG9kphEnazh5PFv/NCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692467, "uuid": "fce496f0-f4e7-40de-8a12-7c0b0bf99b17", "value": 357083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692467, "uuid": "918fb754-e96a-4545-918e-16a327858642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692467, "uuid": "a9ca1199-008f-485e-a918-2944c1c4411d", "value": "JP181213001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be115d9-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645682446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682446, "uuid": "58defd12-af66-4579-9200-7ed42bd15534", "comment": "Malware payload (AgentTesla)", "value": "c95e8ac9d93ca88ea5dd22b61a8a45b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682446, "uuid": "b9e11d1b-7326-41ad-bb5a-e422a535eca3", "comment": "Malware payload (AgentTesla)", "value": "86ba2bdf9df35beef974c7b2cbcc6f27c2f44b3bb112785e8cbc553ded311942", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682446, "uuid": "c56701e5-9434-4131-8050-f1b6d26b4e2a", "comment": "Malware payload (AgentTesla)", "value": "4242daf5fb11887f65f22ca1b679fd7ab19bd0cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682446, "uuid": "c6581e89-8c15-4a49-b7fa-e8423c3266ec", "comment": "Malware payload (AgentTesla)", "value": "5f0027b16eab88f5dff0a1a6d50961a33f0429d06f0f40e9548cf5c08fbfd1e94ed8174e4dc2bd6326ba50163e708264", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682446, "uuid": "dc67fa8c-d339-4bbb-aa1f-fdee4ea912ad", "value": "T10B05CF2135BB20DDF0638BFE9EC8FDB19D6AF53B220E35BA20460F464B49941DE52536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682446, "uuid": "f8be2a15-eb93-48e8-8493-fc63f08afedf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682446, "uuid": "5deb46c1-82b7-4d3c-9b64-46bbf5a1757c", "value": "24576:d74OPsDYxfSHFRv97JrRJ/t574D31HCl:RPsUf6FRv5JZ5ORO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682446, "uuid": "cd7e8d8e-3fc2-4b66-89d0-96db0ed87602", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682446, "uuid": "22438e5a-f019-4698-ad9b-8ab0ce291872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682446, "uuid": "05168943-6e01-45da-a91a-0009643598b2", "value": "MDE-I-220224.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe6f2b4-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645723443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723443, "uuid": "01de9e0f-e162-4dfd-91f6-e9708debeece", "comment": "Malware payload (Formbook)", "value": "107d304dff1ddf6dc37168e571be4c4a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723443, "uuid": "19343d49-518e-4b90-be53-990e4fe8120f", "comment": "Malware payload (Formbook)", "value": "86be858b525fae5c54cef3d4c19f775bef2e9e9eb2513212d08451b4f8fd7ccf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723443, "uuid": "b52b6a5c-37d7-45d5-b4db-5c92834993c0", "comment": "Malware payload (Formbook)", "value": "bba7c7e6b4cb113b8f8652d67ce3592901b18a74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723443, "uuid": "d22cdd82-419e-4dc8-876b-3f27eb6b4c78", "comment": "Malware payload (Formbook)", "value": "d1a0d2eff8f7ac380c4977a8bd196951e7ff526ec0e7d5683da558227d353f1a74ee0f927d661fab8e13c7644648b985", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723443, "uuid": "480e791e-a88a-4f9e-98cd-37eccf408a03", "value": "T14B51CE242BF94708FAB6AE7AFE77F6219A35B815E932CF0D0040444E1866601F570F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723443, "uuid": "11153223-5673-4974-900b-1936bd47025c", "value": "48:8W/9ROQBdYn2fuOKFs1En26FW3h4b1thgoHdTjaC:8w3OQBdWN9eU26w6DhgWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723443, "uuid": "2c533968-1d3d-4000-8cdc-1132c853e4a9", "value": 2985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723443, "uuid": "9e021d48-ca0a-4b45-878f-7cc870de9f0b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723443, "uuid": "a0f60e95-f230-445d-a574-b0a9c8dffc89", "value": "NEW ORDER GMN PO#W79271 227093-200.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b61b6a1-957c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645712054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712054, "uuid": "8b2f5b99-8895-48d9-9115-e60d24088a35", "comment": "Malware payload (Formbook)", "value": "92368293117f7e140cb6a37690dd4325", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712054, "uuid": "1fde8cf5-efe8-40b5-87d0-25be2fa2e7e6", "comment": "Malware payload (Formbook)", "value": "883847cdc1e20bf50e6a900d80e67f09bcef7b6ccbf9fa95cea21b05e72463c9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712054, "uuid": "d7264aab-8807-456b-96d3-9613b034630e", "comment": "Malware payload (Formbook)", "value": "b7f26a3a4e74133bdcb533da2701a15aeed35280", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712054, "uuid": "a4b8576a-5898-4544-b3b5-936592b0e1e1", "comment": "Malware payload (Formbook)", "value": "51bba2e6581872b1cb3085fa066bd3648747b2bf0921791d16816e260e109cd1c6fbe2b57c227b6acf8ee233d8a451f1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712054, "uuid": "4285b9f0-a958-4e2b-a9fa-6d91ccd2470e", "value": "T144F423BD9224F9AC6E79135A10957F0E4531F6886027A102DF693292FEB4F7470FE29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712054, "uuid": "52f635b8-a250-4383-b849-4721f1f4cc16", "value": "12288:j46UVQpC5keU26/PA60Y9ntA7o+rpsK6u09C3hAJWXBWGT7/MEq8cjjLnxiblnBe:zUVyCOP/0Ytt9UeKXQCq6BWGvXMjjUpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645712054, "uuid": "c8fc7211-dacd-4149-a35f-08769bc9af16", "value": 756030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645712054, "uuid": "88f1d783-b062-473c-a2e5-faf483e96208", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712054, "uuid": "1bb367a1-6ee2-4e97-8bb3-04a41a88c115", "value": "RFI von Aeris Impulsmoebel #RFI-9090.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f241f3-957d-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645712628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712628, "uuid": "e9bcd4e1-cd3f-4a93-ae2f-9f3f8160ec0f", "comment": "Malware payload (AveMariaRAT)", "value": "2fdb6735625580225f617386d721560d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712628, "uuid": "d890d226-1083-4836-aaf6-1c6f293481bd", "comment": "Malware payload (AveMariaRAT)", "value": "885ccbb351bc8b6d463201afb558fabe763c536a5853ef762db311b5e0c8e50f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712628, "uuid": "4b6aa639-86da-4330-bbeb-937299b402b6", "comment": "Malware payload (AveMariaRAT)", "value": "eb78588d2584d8f4cc44537ad14de2a58e31f638", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712628, "uuid": "018a1f10-5ca3-472d-bb09-46736a70d39f", "comment": "Malware payload (AveMariaRAT)", "value": "4e4dc6a1bfb6acdb75e3dd5453a51229e4b1bb30f2d2006e8c7ea37097bb6bb337a56ed3fcb17d9ec0ef75b0e180f30f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712628, "uuid": "8500f0ff-d9ba-42ba-b385-06f118e10060", "value": "T139F4AD1038AF6ADDF0768FFE1DD8A5B18ABAE43A3619F1B918855FD60741B01DD01A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712628, "uuid": "846b6cf6-69b1-46c9-9a1e-69d93933d48b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712628, "uuid": "046b7e90-c955-4638-8e03-ba2cdc87ec44", "value": "12288:FhSNEJgYYz0OQnOaviRpXrX6djxvMnbBA9kEjv1aWqy4chY:o98nOaWDe9vMtWNNPOchY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645712628, "uuid": "03408c04-e324-40c7-81ae-8c93f20d9d8e", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645712628, "uuid": "cd7ecee7-b294-44ae-b408-637dc8d3be45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712628, "uuid": "f1cd285b-226b-408f-8351-dcf79f064b2a", "value": "PO#24-02-2022,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d775d1-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687751, "uuid": "0735b8fe-0149-4027-b2cc-72e4101571e3", "comment": "Malware payload (Gafgyt)", "value": "defb7a7b79459e842e2ef0a807d27e87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687751, "uuid": "4c346b94-7652-4e17-bc55-c12340876854", "comment": "Malware payload (Gafgyt)", "value": "88617382af191e74d05144d209f230f090412f6d6b5245259f74390aaae3382d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687751, "uuid": "fbb14c41-6577-4133-8dcc-c10782d087f1", "comment": "Malware payload (Gafgyt)", "value": "9858bdbd36d14130115c467776eb27a2b443fb5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687751, "uuid": "ceedf522-9a6b-4eb4-a93d-728aecfec5e5", "comment": "Malware payload (Gafgyt)", "value": "a6480db8398a6a23c2f88374dd07a9ceb85c58964f98ad59d05721d7bbc6ae0c2c4b6a543ab0056b6ffcb926c273f0fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687751, "uuid": "d09d68af-91ee-4261-a32c-686abf418f32", "value": "T1E6B32901D5508B27C2D2277AFB9F425D37332BA8939B33255A24BFB42BC279D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687751, "uuid": "fb1d73a9-8932-48be-a142-0c90a9ec2402", "value": "3072:wdZ6wa++h8tZ2hWJloKTDorqz/bmTQOWsXAOn:wWwa++h8NoKTDpbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687751, "uuid": "c739152d-e87c-4e8b-b3cf-1b71b21fb9f2", "value": 111521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687751, "uuid": "a06ce419-c280-4d7d-b69d-581a4dd7f1a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687751, "uuid": "d6751969-1019-425d-b930-2dcbaa44a9f0", "value": "defb7a7b79459e842e2ef0a807d27e87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e07c48-957a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645711271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711271, "uuid": "691b1a72-8752-4882-9c64-4bbdc988929c", "comment": "Malware payload (AgentTesla)", "value": "9d617295d741964a8569c806d09a2373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711271, "uuid": "36fc4796-b708-4a9f-bf87-7106234ebb60", "comment": "Malware payload (AgentTesla)", "value": "894a5bed332d5a142a6121f54c2116eb85b4db36b4d72a2344e0eaff7f9879fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711271, "uuid": "300a9115-ae25-4d23-a238-e0a9d5f98630", "comment": "Malware payload (AgentTesla)", "value": "fe4fa8ef9a7a2ff35bdcfb6abfb4dc6b25ec8743", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711271, "uuid": "2f59681c-255e-4d2e-82c1-0925b5973465", "comment": "Malware payload (AgentTesla)", "value": "0cb7501bdcde3410bf3262865b2954f2a6e65a35047bd0f4650e4d18564c2f61d435e20b048d78e58cbcc986d8d558e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711271, "uuid": "04d7fe06-7a62-4e04-844a-3b4252f5c72a", "value": "T1DFF4331260B98CFCD1B888744F8186C6C99659C27A5F752C6C02BEF439D3976C9726F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711271, "uuid": "b38a6bf8-6a5c-46da-8a32-de96e57c625e", "value": "12288:XKZWgmhtPdnKmu5xUztLEV9zNyTk0krrDT7q1xqtPE4n7cFpy4yesGFhT:XsWgmhju5xUztmnyTk0krrDvq1sGaAUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711271, "uuid": "5dbf2842-c62c-4213-88f9-5a9f7fb2e7e1", "value": 740798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711271, "uuid": "8097309a-4808-4fd4-89f4-ceb4ef2e5553", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711271, "uuid": "2d23294d-1387-411d-ad6e-d1dcd305aae1", "value": "SHIPPING ADVICE ASEANS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abf22a3-9563-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645701503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701503, "uuid": "aaa40299-f9f5-44d4-bc86-7e67692ef594", "comment": "Malware payload (Formbook)", "value": "ad35195080aaf247005d6ecab3f8db72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701503, "uuid": "f141a096-7170-45e6-ab12-bc4fa4b81e67", "comment": "Malware payload (Formbook)", "value": "895f390d56ade378e72f343465d78ed3f3f98ab04a3fb3e2e2616184e566b6c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701503, "uuid": "61f9812b-9b96-4143-85b7-7a3a4f2ef58a", "comment": "Malware payload (Formbook)", "value": "1d4368b26588323743b5de77995260b2a08d3eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645701503, "uuid": "39fbed99-7df3-4004-99fa-dba75e58c8d6", "comment": "Malware payload (Formbook)", "value": "91fbf271bcf4210ec010521fb07ba6870a1c9e42eb1f3b553976edeb06883fba9c27886cbc0bf6ce6873f64d2a38e013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701503, "uuid": "0128a7d6-4c0d-4e84-bcfb-5eb4886a957f", "value": "T1E6F42359B368D6FADA7F477D34A2770A4531FE04601EE2078E8830E0ADF2B7494B5396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701503, "uuid": "5bd24721-a977-414b-b88b-6e792c2f6145", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701503, "uuid": "b0fee4df-c009-41d2-8705-f020bfd1eabd", "value": "24576:ckygsXzLhX0ab8kLDnyQCjVBW6Ymh6WPa:MFXXV0ab8kXnyQCjrRYg6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645701503, "uuid": "f6bf91e3-7d1f-4973-b314-7f3d9a7e3353", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645701503, "uuid": "6da6995f-71bd-4332-b95a-182eeae0bc64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645701503, "uuid": "c7622083-c10b-4c8e-bfe5-33ce4f4f337f", "value": "RFI von Aeris Impulsmoebel #RFI-9090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3063cc10-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645688493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688493, "uuid": "a212e77e-6303-43f9-8714-eddbc2399566", "comment": "Malware payload (Formbook)", "value": "c6b55600442ac7650d1284926160465a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688493, "uuid": "febca0de-a094-43bf-82d6-024771aac4a8", "comment": "Malware payload (Formbook)", "value": "89d730831dc7d8c03f6e8f777d52d7e94a016c24daa0a513b7fdb8f13ed4cb94", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688493, "uuid": "23a6e567-7822-4fa9-944b-ec47fe4d426f", "comment": "Malware payload (Formbook)", "value": "c8b122099985a972cc70d515dac549b2695ea976", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688493, "uuid": "91d8aa8f-29d5-4995-8963-69edf269713f", "comment": "Malware payload (Formbook)", "value": "8179965fef1811af665c3bdb665e4d02d76fc86aec296e8f63b2f253f3127ac032406290810826714432e0aa78402f0e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688493, "uuid": "8cf86f68-38e0-4c9b-b3bf-8b0d099011eb", "value": "T1248567F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E5E6552EF6A11F90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688493, "uuid": "ae768652-015a-45ec-9356-9847fcf54e71", "value": "12288:aQTfwJn8x3lgoaRKSl0IjCMzXSQbWYR+jZutln6bXENGNnMqs36o:xfwax1gRdl0IuZFn+l6DENGZMqs36o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688493, "uuid": "b8156578-36b5-4247-b63b-67d37e7e9f09", "value": 1718891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688493, "uuid": "695d2ff4-2d56-4985-a4c9-d3a184882495", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688493, "uuid": "998a963a-25dd-4fd8-a0ed-f66087472647", "value": "N 0065CFN22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6495d1b3-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694164, "uuid": "bb2bed3c-4450-47af-b458-bda1b716eba3", "comment": "Malware payload (Heodo)", "value": "ad143edc51a20fb83ef5ec44fb3c94d6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694164, "uuid": "3ef96cbc-7475-4807-9883-a2dda8f2a93f", "comment": "Malware payload (Heodo)", "value": "89e80acc49404fcf29d5a6513a7cfc5fbc7f8fd136d42b5e1c5767c04e82fb76", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694164, "uuid": "34afb8c7-49e9-4ad5-95bd-4bd7ee183c3c", "comment": "Malware payload (Heodo)", "value": "9e1e7db48546cac97171e60501449ed343f31fb3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694164, "uuid": "f761696d-5863-4daf-b903-9f531230bc0a", "comment": "Malware payload (Heodo)", "value": "d5ea2e7a81e25a4d20b1495c00c85c6b482c4ea34a68998fa0fe74197d2a442d80e9d7716c4f7de14f62bb25560abb19", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694164, "uuid": "c8f61342-ca9a-400c-84aa-7fb34fdb0591", "value": "T1EA93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694164, "uuid": "7ba0f752-8aeb-45c4-a9df-e174420c6fed", "value": "1536:DQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:qDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694164, "uuid": "8cfb5a09-4289-4653-bfeb-ebd9c7503f4d", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694164, "uuid": "64f990c6-7d7d-4a0b-a9e9-63098111f5c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694164, "uuid": "22b2b8b6-35f3-4006-8ab7-a0e0ea7dcf8e", "value": "opastonline.com_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b3c7bd-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687731, "uuid": "d01bc92b-667a-4acb-8971-b6eb9250b6e8", "comment": "Malware payload (Mirai)", "value": "dfb767d32c9a0693c71b47e35f5243dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687731, "uuid": "702bfc71-4dc2-45f9-bcd4-52b4aaf9db2c", "comment": "Malware payload (Mirai)", "value": "8b2ea75dc65c65500202af8a9d58b337716a49c453d16111b856dd076b0b8a2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687731, "uuid": "4775bc56-c343-440d-870f-6fb9abb42958", "comment": "Malware payload (Mirai)", "value": "3a16349951deb4ea858af337cea6bef9446d5ce9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687731, "uuid": "4e42b152-1099-48e6-ae5b-2367bc719cc1", "comment": "Malware payload (Mirai)", "value": "68bb3b6a90109f51ca5aea89c25eeb733a99422063652cbee4aa69ed420e9cd3af1ab8436d96ef24ce833b6cadde486c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687731, "uuid": "6fe1e5df-82c0-496a-9dad-f669a5453a94", "value": "T17BA30896F800DFB7F40AE67604D34B20B670BBE14F532622731739A6AE762D52823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687731, "uuid": "944b4c5c-cf84-478b-a514-6067ed8510b4", "value": "3072:/Ir2vIBAxMyAOLRcft02OemuxVqDr78fz1e:/Ir2vIRyAYcm2OemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687731, "uuid": "8fa3fa56-448a-417e-b7dc-a6158ccedb3c", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687731, "uuid": "e0dd2c2f-6f99-4690-9ec9-0d4c581c07c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687731, "uuid": "2788748c-c312-480b-ba34-4fa251834fce", "value": "dfb767d32c9a0693c71b47e35f5243dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae329b0-9541-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687115, "uuid": "eb847f76-a622-4319-8057-21b014a14ebd", "comment": "Malware payload (Mirai)", "value": "b43b5bfa6112c79ff7a0ee565d6d8d45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687115, "uuid": "b92fca62-4237-4d4d-8232-aa8df6191a73", "comment": "Malware payload (Mirai)", "value": "8b3e7176790adde8d142d4b0e57ecc6171133f60d8bb04c6e4c4f0f8bb3b89a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687115, "uuid": "f3d37e9e-89a6-4b63-9058-b7c7057b9f53", "comment": "Malware payload (Mirai)", "value": "363937737686c2f4b4f44a114ab647eddf91d461", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687115, "uuid": "9c67774b-ae27-45b3-88ee-1335645cc763", "comment": "Malware payload (Mirai)", "value": "5c67f2c9e33aa5081fc4ea6bcc00b972c6858bf7e8184850bbaaacbb2d383c1df04f8f3c3eecf225b14fd239e1ab59ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687115, "uuid": "ac3fad9d-05b4-4ce3-8d1c-ffbffffcd4be", "value": "T11CC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687115, "uuid": "95a87b4b-4873-403b-9205-341e44395445", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeOEdWfRZrmW+IFj:Ted0W0MZQHMd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687115, "uuid": "afc599bc-5f3a-4f51-bfd8-b4b3339951b6", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687115, "uuid": "15c129a0-ed6f-4e17-a44e-94417a3560fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687115, "uuid": "dc75974e-7983-4c63-8930-38f924fe7fcf", "value": "b43b5bfa6112c79ff7a0ee565d6d8d45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c7cf4b-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "8ad30960-a11e-4693-9b58-0fc7aa981c0e", "comment": "Malware payload (Heodo)", "value": "30d78a968b101bf2f18761656872211f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "3c7a24ca-ea4a-46b9-b8ac-78421f5ff936", "comment": "Malware payload (Heodo)", "value": "8b5e2918ff87247d6f368b5210837d2d2ce99a8518f9ef215053eca90101a4fa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "8048f89d-73d2-404d-aae3-8e6720484c45", "comment": "Malware payload (Heodo)", "value": "5f6afd1c03857ea70874095b2567ab74372e35bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "e5caaea1-a210-4cb9-8c56-37f6e445c0b6", "comment": "Malware payload (Heodo)", "value": "72ae084f0d04c494c43761f43027c445fcc88da607027ed7c3533dee0d5af6ea0ad99974b668e920522c219f86d7fb2a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "d3870ec9-3205-40de-b5d1-9026d7bd74be", "value": "T1C5E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "f95a243d-ca73-41d4-ada9-0d1fb307695d", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "05e3c920-4617-405b-b223-b37b8c4f81f3", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKVe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKVLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660941, "uuid": "a46cef9c-2da8-4612-925a-2e75883f3c1d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660941, "uuid": "4d72ffa2-813b-47e5-b25f-f223a1ca6d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "b413f5f9-3c16-440f-8df0-a61f1adee236", "value": "emotet_exe_e4_8b5e2918ff87247d6f368b5210837d2d2ce99a8518f9ef215053eca90101a4fa_2022-02-24__000214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03af3ace-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687130, "uuid": "22483d50-cfe8-4007-b88b-be9a6b7b51a8", "comment": "Malware payload (Gafgyt)", "value": "73c4e8bbea0a98e1b81d9a6992b3210d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687130, "uuid": "b64b948f-dfb9-4959-a538-aa8e4a8ed4c0", "comment": "Malware payload (Gafgyt)", "value": "8baa61d17f084601d9b4014c73c391ab6a893f46d076e9e5d55a55991d94b057", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687130, "uuid": "77a9f93f-fd83-4149-8e35-1d5ba67abd61", "comment": "Malware payload (Gafgyt)", "value": "d98cc4490a6b40f00a1672a5244f450f671335c8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687130, "uuid": "80e6d615-cfa1-434b-aef1-601a1f42cf3b", "comment": "Malware payload (Gafgyt)", "value": "9953186d56bcfdc3f2da36d5d0aabc36ac0fedaf0496a0c0f80ee247f51437233c4477f7e188beef1b50500966ecd4c6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687130, "uuid": "57fc6848-ee56-4b36-8c58-0d0f1d31198a", "value": "T1C6835B23A651C67BC0875BF91BDBD5615023B8B90B33720A73D8BDA92B36DC85D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687130, "uuid": "057d99f1-e749-4613-ad1c-41677ca52aea", "value": "1536:eR7cH1LhKlBSQ6VhuzdPQq0aJP9sWtjG7ew3nmLW2DPPmoIYuOVje+ZNne:ehMhKl0duzdPv0o+QK7eknmLdDHmrYur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687130, "uuid": "1492dfe2-0255-445d-98bd-a8146e7a3e05", "value": 85796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687130, "uuid": "3fad2cb1-7fbb-4336-a6e3-a470f14aff07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687130, "uuid": "ae47f365-c0d2-43ee-b5d2-0b288f4abae2", "value": "73c4e8bbea0a98e1b81d9a6992b3210d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f662ca-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687696, "uuid": "eab76a0f-e2b8-4c81-96eb-0e3c9c21e2de", "comment": "Malware payload (Gafgyt)", "value": "c704e1595dbbaab939c7b61daea8e7bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687696, "uuid": "3c13b1c9-e540-49b8-9708-46f10b2abb83", "comment": "Malware payload (Gafgyt)", "value": "8bc7079056584b8b7ddbf6ce4425e7e9e3e4642206682c80c3c04f2415213a83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687696, "uuid": "7a6edded-7bab-485b-aaac-1db3fa00b014", "comment": "Malware payload (Gafgyt)", "value": "d5a070cd47745d42bd194a78ade34802cf181f50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687696, "uuid": "eafd9ffd-5398-442d-bbba-ee7be4260af6", "comment": "Malware payload (Gafgyt)", "value": "67cc0dde0ade3b73efd933ba9dc4f63de6d0fbf971c4244bc11d7b40f6c055100f619b7c1b3d87a5ea7062e6a14da881", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687696, "uuid": "ad19567c-bb93-41f7-83b4-f3d5ead471de", "value": "T11993F792B900DFB6F40ED77A08D34724B670FBA24E531672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687696, "uuid": "e5d61624-222b-4099-81f8-60b542149990", "value": "1536:46ZrozTV8V9eEG8ktQmzn5h8Jn9/QT60ydwgk+2ddeI/UBTmQ9VqXjewf2Le:rYT49m8KT8RQT60ydwpTdt/6mQ9VqXy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687696, "uuid": "422a9658-41a9-4a3e-bf77-d82d7dcd87d0", "value": 91080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687696, "uuid": "40cedafa-842a-4f4f-a611-f9a143654e99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687696, "uuid": "9d1c91b4-ca7c-4342-b361-8061750581ce", "value": "c704e1595dbbaab939c7b61daea8e7bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6d3b1b-95ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "445fa778-c145-4089-955f-1ff5bef43314", "comment": "Malware payload", "value": "eefc8ca800ac9a0beb87222f8ce4b9d6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "eb097057-0599-4488-92e8-ac52e4fd7af1", "comment": "Malware payload", "value": "8bd42c56fa273363ce909884dfeb401993a4b9c5fbfcd970485e9dc7ca49f73f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "9ada28f3-c0bb-48da-b7d8-4b58253a311b", "comment": "Malware payload", "value": "47829746a1c93b6290f912ae4ebde47b61feeba6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732487, "uuid": "9fb020db-ecfb-4fa0-a11c-b8396dd47ad1", "comment": "Malware payload", "value": "52938fb70b6346c137279ebdf2774b44cfae922d9ffa66c5c47e52435d487bc67b7ba313b558120170d7a1630072a184", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "3cfa0e79-8252-47d0-b3be-b4f7c3e45138", "value": "T14BE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "231b0506-3ae2-4cea-9f8d-2cda85d88195", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "99d7b2aa-0f00-4728-b619-f7c7193fd181", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0X1sD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFW1a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732487, "uuid": "bd66bfd2-fbb5-4bac-a8e4-7791e949efd2", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732487, "uuid": "5d3ec88e-de4f-4dc1-82c5-e63484ec897f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732487, "uuid": "350c7e3b-d8a2-481a-846a-83e58ffa914b", "value": "emotet_exe_e4_8bd42c56fa273363ce909884dfeb401993a4b9c5fbfcd970485e9dc7ca49f73f_2022-02-24__195440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd832fb-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687174, "uuid": "0d58f0ef-0f48-4025-991b-f68f18a16760", "comment": "Malware payload (Mirai)", "value": "476a25c12af43804bd0f37e858fd95b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687174, "uuid": "ed577957-125e-4d8d-a663-79e944b27312", "comment": "Malware payload (Mirai)", "value": "8be82aa8e59c03cec7f666eea9c2d8550388fbc06a262239450d7530799650e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687174, "uuid": "cb0249df-bc6b-4b5d-aa93-32308fdc4a48", "comment": "Malware payload (Mirai)", "value": "9f5c20e5d11a8b448b7a5ff7f236c6d6ebc6f8e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687174, "uuid": "5e506223-b255-4a39-8335-62829379443f", "comment": "Malware payload (Mirai)", "value": "2e3357f928f17381a56e815c393f34d69f02b85f63a914aedd0f29427ba3ecd0b846f38ce55d083cac37bf3988f6e3c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687174, "uuid": "e8d41caf-db0f-47bf-8aab-dfeaea580620", "value": "T138C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687174, "uuid": "429b15e3-f539-4276-b8e5-f499b74ec8b9", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epv+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8EV+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687174, "uuid": "3fce52cc-d87c-4b1b-84e3-a5afbe7757e5", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687174, "uuid": "9008dedf-f005-495e-a7c1-8065916e9715", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687174, "uuid": "89f8a675-69ed-487f-af99-5178731637de", "value": "476a25c12af43804bd0f37e858fd95b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552778b5-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1645694139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694139, "uuid": "143f4f00-0c87-4c69-8dcf-f3405cbceccc", "comment": "Malware payload (SilentBuilder)", "value": "9bce9020dd71cb4ed4d4540aaa017c16", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694139, "uuid": "050b803d-0908-45fd-9233-c53160442986", "comment": "Malware payload (SilentBuilder)", "value": "8ca6ffa893cc2512f843d08c90fff8bcfd58dff6201b76c4583dfa53dd151ae6", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694139, "uuid": "79237cc3-d8e9-4265-85f5-684435a4b31c", "comment": "Malware payload (SilentBuilder)", "value": "1cc77fae548cc761886cb7d162491940dde5dc70", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694139, "uuid": "9f4aa80d-9465-420d-bbe6-65064a44abf3", "comment": "Malware payload (SilentBuilder)", "value": "2025ee4629d471dfa53c05fff59e8b0093c1645e3e9cc237af588693d459ffe4d53fbaa21eb5113abaa60eb599dd25a2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694139, "uuid": "40fc1acb-ba69-441a-a620-c7d6ed7d8251", "value": "T10C44C04AB84A5C35FD45C3BC8983C7CD84E5AD3A6B5B815E4D28332396B3EF416025EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694139, "uuid": "9ce10eba-8210-4c11-a9af-c5138e1e38d9", "value": "6144:EKpbdrHYrMue8q7QPX+5xtFEdi8/dgUThvsiKIjvl5fd1Xh8rsoX/w/0t:UhEXs5fXR8rsNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694139, "uuid": "cb88f672-f80b-4423-9c55-19476f1851cf", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694139, "uuid": "443b6f17-ecf3-48e8-9092-6c4ed912af70", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694139, "uuid": "953f415a-94c7-4e8d-b32b-7a12912cd75a", "value": "Doc_23022022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0877b99e-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "c7413e96-f1e9-4d8f-b73a-4961aba4bdd8", "comment": "Malware payload (Heodo)", "value": "9f95cf16834f3442b6f5276e16f820c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "4fd69bd6-2106-471c-a434-845c9f4efda3", "comment": "Malware payload (Heodo)", "value": "8d17af915a1d8237866e6f89a58bf3f9443aa49fee4162f698827eee002ca450", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "84744f91-9d75-4eb9-a9c3-6223f450e73a", "comment": "Malware payload (Heodo)", "value": "a1b9ad0ea10544b9833696035f3b3a7afcc8ba1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660939, "uuid": "26f02742-c756-43cc-93af-522d2fe12c10", "comment": "Malware payload (Heodo)", "value": "f6140db3c0a14df6092cfbfe60cade319f3d76cf0b9aeb32a6d60f87e3d7b6a56a7aeff3db2ac6a9a99d135d688b3949", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "83cebcda-05e6-4986-8f44-4d9cc59191db", "value": "T15EE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "fd975b28-731f-4ca8-9e4c-0edeedb878d8", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "06c69b8f-dace-4f4c-bcbe-76dfc8168679", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKKe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKKLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660939, "uuid": "06e8bcee-76ce-479c-bcf4-66f65d9a77a0", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660939, "uuid": "cac41a36-e4d0-49a5-a2c9-da58805c09a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660939, "uuid": "bf561337-0472-4cac-8d2f-5e6cc4c56fe2", "value": "emotet_exe_e4_8d17af915a1d8237866e6f89a58bf3f9443aa49fee4162f698827eee002ca450_2022-02-24__000210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b9b2aa-95ca-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645745756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745756, "uuid": "d4a097b3-831c-4875-b57c-7ebf4ffdb0bc", "comment": "Malware payload", "value": "13fd93c5aad144cba40f57c7e48e1d17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745756, "uuid": "02d5ce34-ed14-4e0d-90ed-bba298e4f2d8", "comment": "Malware payload", "value": "8dc7bf5fe63a2a0da5947a290c46cd2a6d76b27de92cd4ada0c692edc06b1eac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745756, "uuid": "e8ec420e-e309-4133-81cc-008d308174be", "comment": "Malware payload", "value": "8c37f97413f9e09d93796263f6021750973b9912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645745756, "uuid": "4141f716-6e93-4b14-925a-3d36273e40d2", "comment": "Malware payload", "value": "900a685dec3adcd89e7f779357f1ab3cbf6655d015509dee9eeedac809f69fc39c55acb7873e83d7f17c6a1d01a1852e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745756, "uuid": "bd6a98b0-7f27-45e8-b096-b86d60128f68", "value": "T16235BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745756, "uuid": "f9690fb8-9d25-4743-8c20-361364f287ac", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745756, "uuid": "34a7be52-7844-452a-91a5-0d0102c03b17", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+u+VOe528JO6PC:6iRGcUY0UvDYNFtu+5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645745756, "uuid": "eab8f50e-ebbc-482b-a54a-14fe39a81bf9", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645745756, "uuid": "c1d775e8-eeea-4650-be42-a8a0385c3241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645745756, "uuid": "34e49918-160a-4465-9008-aaa4734b423b", "value": "13fd93c5aad144cba40f57c7e48e1d17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa23381-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "e817f328-59ee-4192-8362-be0e5a76e280", "comment": "Malware payload (Heodo)", "value": "e39fd79afed60ec5ef859ebb47c4c5e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "c5f38a6b-cbb3-4a36-bf8d-6d85a0ea14f5", "comment": "Malware payload (Heodo)", "value": "8e24000b1e6e50c039fe163a9aae0c86b9aabbc5a6ea52fc23d662c7d8559f92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "3801a892-4832-4258-8bb6-ed5f43d8fbea", "comment": "Malware payload (Heodo)", "value": "47b6936f9b60eaaab8828427e603d6d429cfe96f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "bd470879-054c-4d62-8ecf-369da63cf069", "comment": "Malware payload (Heodo)", "value": "e262d29034501834a5492b1a9ac3f7e502c3012ef8f966219a47e589258647866d7eb822f43283f96ba7c693b6749349", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "475f338d-1d7b-46f6-9151-f53ac3822b75", "value": "T11EE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "e0b4f306-3997-46c3-b4a1-3381b95fedc8", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "261eb01c-cf4d-401f-a8cc-64b0b93392a0", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKae/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKaLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660942, "uuid": "e255fe2b-f753-485e-a7ba-7b3be9a4ff55", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660942, "uuid": "2e6d4c38-49d7-4b91-ac5d-9317af25be96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "673cc73b-9ce1-4811-87e6-1ad6c69827dc", "value": "emotet_exe_e4_8e24000b1e6e50c039fe163a9aae0c86b9aabbc5a6ea52fc23d662c7d8559f92_2022-02-24__000216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f4835b-959d-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645726572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726572, "uuid": "53d8a446-b2f1-4ae3-a734-5e62703b9000", "comment": "Malware payload (njrat)", "value": "ace68f95f65a16d1d3986dfdd4c7a6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726572, "uuid": "1e3475af-7809-473b-87bf-b503004a30a2", "comment": "Malware payload (njrat)", "value": "8e35682bf7dd5f6c48b12dc157d28bc95fd2338ef24da44b3f96f54f8e863aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726572, "uuid": "4dde83da-eeff-409f-b8af-1cde617a160a", "comment": "Malware payload (njrat)", "value": "f490f64440584b2d0879c14c6b621c4c890a6a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726572, "uuid": "6d547ca8-5884-43b2-a0c5-7c702aa77d1b", "comment": "Malware payload (njrat)", "value": "2ee1ece0a2bf0aae75e2bcb601d192eb1898436f9f1206f96819658770fa39db93aba968e6007f93d69deba8d73cafd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726572, "uuid": "4deae1e9-506f-4fc8-b9f0-f5633cd58cf1", "value": "T1E403294D7FE18168C5FD497B05B2E01207BAE04B6E23D90E8EE5649A37636C58F50AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726572, "uuid": "5d66533d-afa9-4355-a32a-4f61a3abfca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726572, "uuid": "744764d2-f500-435b-985e-fd813e69266f", "value": "384:DeLx1kit8Zf5W9cTYXyc/bBM0izvncnPMIurAF+rMRTyN/0L+EcoinblneHQM3e8:CLxKjjTYic/be0PM/rM+rMRa8NupCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726572, "uuid": "09c8925c-47db-44fb-b99b-cb989c7c5e4f", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726572, "uuid": "675dbc10-a08a-4119-8899-25feb5a6be5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726572, "uuid": "373b8d5d-fa7d-47c6-9d4a-c1e190c1e2eb", "value": "ace68f95f65a16d1d3986dfdd4c7a6e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986c875f-95ad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645733336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733336, "uuid": "cbc63254-e46a-4f5d-8987-0aa7d54a7bd2", "comment": "Malware payload", "value": "fcfe97a4218e0a80523220c574703b98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733336, "uuid": "079827c4-c303-4ca7-bcc0-243efde52b59", "comment": "Malware payload", "value": "8ecc42f3887cd33404cf3ca71f292c541891e8e6ec2500cd8e0a2dbd7480d9ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733336, "uuid": "bc5d6418-5dff-49e7-a9bf-0f5e29cd664a", "comment": "Malware payload", "value": "fd8a8dd8592e325fbc56d79538495e9a306dd375", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733336, "uuid": "dd4b363b-8025-406e-bc5f-aaa69085ec68", "comment": "Malware payload", "value": "643fb0afd660823fdee8f4735afb754eb303336e7f868b5123c83421e3eec382a4b9759b90bbe964fd36b8e3a57609b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733336, "uuid": "5ada31b2-a45d-49ec-8809-1ddf58bd1a32", "value": "T1D3E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733336, "uuid": "ed9f1316-34e9-4160-a421-b37215b91ea9", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733336, "uuid": "b3b9791c-e930-49c3-a32b-0eacb1223406", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XesD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWea1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645733336, "uuid": "75cffa9d-b7be-4e4c-b782-81299087c0bf", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645733336, "uuid": "b08192d5-c632-4e3d-83dc-576dd9becac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733336, "uuid": "f4c206aa-b389-4742-89c4-395c9aa1c626", "value": "fLjn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8033af-954c-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1645691658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691658, "uuid": "15d5fa2a-8afb-47e0-8e26-dc01e2c238df", "comment": "Malware payload (STRRAT)", "value": "e628dfc38bc08de88d9cddd977187a98", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691658, "uuid": "d953df43-015b-42a8-855e-8d7adeddd03b", "comment": "Malware payload (STRRAT)", "value": "8efa0e193fb08adf90ba95c2e7f2de6453c3276cd8ae154c4af117a48a668ef3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691658, "uuid": "992ceebb-d1a1-44b4-b30a-e9bcaa71db22", "comment": "Malware payload (STRRAT)", "value": "0e9bc853226d52161a64cd13e200023aa51584ad", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691658, "uuid": "d6cbbeb8-f5fb-4d44-8e37-ee0afab5697d", "comment": "Malware payload (STRRAT)", "value": "64363769db7c0d2c377e6127256b05b3df3ad6e5c2d4484a595f28d162e0a8482d35afd23c46efb287d02bb014fdd26d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691658, "uuid": "4b249a3f-227f-42ff-bc2f-c13b8b06d632", "value": "T1A2C3236CFA02DE128F966C27613BC1CFA2231EB5C56154E27CB7999F30066572C6AF4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691658, "uuid": "3a0de858-b2a8-49a7-8e3c-dd61c26dbe05", "value": "3072:jrnqF+HyJjXRTJO+K3YwuyrI9lHFvm/21KI3U:vqsHCtpK3YKI9Xm3I3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691658, "uuid": "be86233b-33c6-4579-b640-f4ced4cac65c", "value": 122438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691658, "uuid": "e118277c-ade0-4cb4-a3be-1455cbb97218", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691658, "uuid": "546dd73a-b1a7-4f0f-af65-6e356aec3f6b", "value": "HBL No. SKLZ212352--ORIGINAL.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1dd941-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1645692993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692993, "uuid": "9b6f59f4-6fd1-488c-8f99-9259f496a458", "comment": "Malware payload (ArkeiStealer)", "value": "cf3763844b1ecee581ddb3a19c5b4f44", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692993, "uuid": "7f8d6580-4f6b-44f2-b0a2-db5334c76a55", "comment": "Malware payload (ArkeiStealer)", "value": "8f3c17ac18a040730c85fc32be4a41d7a3c37555b46db36e008f917951f0b7af", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692993, "uuid": "08b1039d-ee91-42ff-808e-b52db29252ff", "comment": "Malware payload (ArkeiStealer)", "value": "e2a8ac5fd6e7f20f906e575a522c22aaf870ca20", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692993, "uuid": "fc6bf517-d991-4ac3-89b3-9a3f1792bbb9", "comment": "Malware payload (ArkeiStealer)", "value": "4d1e702b9d509b82f58176c2f3ba7fe349cedb9e73507c3b22a8d80f509293766ee452703b2ae2e57388862f4d12970f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692993, "uuid": "df833779-8ebb-4d62-94fc-fe48681e5c5e", "value": "T192749E10BB90C035F4B716F8897993A9B93E7AA16B3550CB62D116EF57386E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692993, "uuid": "a42d1023-27d5-4ef5-bf13-25bda81a645e", "value": "90f4cb1f395a200889984b389a9496a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692993, "uuid": "4e729515-0f3d-4917-9db4-94123c12ed5a", "value": "3072:n67mSiDAh7NhJV8qy/8lbJ4VyHpHIvAqfAe99b4iUXZ5oO0BtDF388KMir042uEx:RsfhJWH+94sKvAqf/99dPnhdzKX053", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692993, "uuid": "511bd931-9cee-4e96-be4a-884695d893f7", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692993, "uuid": "86600a79-57d4-4a3d-8bf5-ac462314462f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692993, "uuid": "45347728-c3f0-4d2f-8b65-f71a607bee99", "value": "cf3763844b1ecee581ddb3a19c5b4f44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000c43fd-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "a54a24d6-9a37-4d1d-8740-d396faba34fa", "comment": "Malware payload", "value": "b13ab269e39b6421a574a3689748a328", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "52b6b2ce-1acd-4352-be4c-e130143420c5", "comment": "Malware payload", "value": "8f70e9e54f7ad6cd103c029954231aa9c21f20487f0787abe0019d31563ddcea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "77ce755e-3790-4386-92a3-0d502992c36f", "comment": "Malware payload", "value": "69d2c51d8c136500907a0a3ec8c81f987b0d9c37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "ebe492e9-9836-4471-a398-98900dfe56ef", "comment": "Malware payload", "value": "11d27916cbb81bfcf007464d6f21a4c83c8bd7cf12292d1c9655651d186a2d7c664ba8248c8c8cbcb602f287b8cf86ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "a27f2c49-308d-47b3-8c88-c61108b729ad", "value": "T1AB35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "c0b8e0cb-5cd4-4d60-bc42-7cfd79fd9b17", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "29dc1eac-d829-4d72-884c-9a2c8f7ed89c", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uoVOe528JO6PC:6iRGcUY0UvDYNFtuc5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738663, "uuid": "d53aec32-18d0-492c-a516-4a95f99164af", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738663, "uuid": "6ff1e66f-45a9-4358-8e84-d7f90c11d5a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "a8f01744-0c43-4eab-9d78-d62b671c0247", "value": "emotet_exe_e4_8f70e9e54f7ad6cd103c029954231aa9c21f20487f0787abe0019d31563ddcea_2022-02-24__213735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fd229c-951e-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1645672021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672021, "uuid": "abeefaad-c63a-477f-80d3-822f777e82cc", "comment": "Malware payload (Pony)", "value": "2cf2d385af6389247d32e3aec67a8a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672021, "uuid": "6badba67-4f61-4e51-83a3-05e84dc3408c", "comment": "Malware payload (Pony)", "value": "8feae03951203fbfdf623c8dfadad2cdc10560bc11e28c1fc134492a764833a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672021, "uuid": "b3791a16-f95e-4ff5-a397-2d4e910eb1d2", "comment": "Malware payload (Pony)", "value": "2ed7b01c1ae88d9c64fa283611fb80f5a48310cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672021, "uuid": "24c959e9-f091-432e-856c-ce80fc01a3a4", "comment": "Malware payload (Pony)", "value": "abda5715501709145039f1e596f63d1d93200f1b18a859163045b03472614ced06c158f3ba88b5fd9cd96bd90f0e5b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672021, "uuid": "5d1510ba-0642-4069-ae22-5ef42af5e17c", "value": "T1E7931903F480E0F1D1A22AB17BC11771EBF89F6978768D4EEF8D49856DB26977B12042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672021, "uuid": "7a6316d4-1c43-423b-b7af-197d2245f79a", "value": "728afd0aeb7539a2a721ececf5f36865", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672021, "uuid": "ba5fa332-e41b-4179-83d9-aa5971e76044", "value": "1536:x3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEIhkzZ3:9dOy+ubiDBzv+1H4OgYEIK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645672021, "uuid": "7d39773a-11c8-42c5-b3ea-4da5f3a2664c", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645672021, "uuid": "4b8cc230-7510-4841-8c5a-1a8f780d9192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672021, "uuid": "e715070d-2df8-4a7a-a74a-a1ca57236c8d", "value": "8FEAE03951203FBFDF623C8DFADAD2CDC10560BC11E28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595362a6-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694146, "uuid": "b49c46f9-c61e-4075-8a3d-210bce6cea8f", "comment": "Malware payload (Heodo)", "value": "6194b5ea71563f0b264f7a9c29e993fa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694146, "uuid": "6c8b683c-6e5f-4caf-a70a-90ceaa620b3f", "comment": "Malware payload (Heodo)", "value": "903da2149ea7d5eba00258f870a7d21d4627d77c22b4afa6398278d7e87227af", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694146, "uuid": "2ca36976-1660-453a-bc0a-d869d93d20e5", "comment": "Malware payload (Heodo)", "value": "dba5c5c0dd2ece02db6ad6b2e2fc5fa1769eedc9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694146, "uuid": "04feeed4-a645-45bd-973d-4f659980c98c", "comment": "Malware payload (Heodo)", "value": "81640247a069f4dc673f3792d3bc4b148fe6af1375a1d6dd67f8722b3b12415ad87fc87945d3ea4ec39d1eead422403f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694146, "uuid": "1f18e2bf-4f23-4ee7-8112-46dd96541d20", "value": "T16493022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694146, "uuid": "6ab63b1d-fe1d-4487-9227-9f7d173d73c0", "value": "1536:DQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:qDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694146, "uuid": "44796500-4bf2-4f5f-b503-d6270167e13a", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694146, "uuid": "f008dc9a-06a2-4185-a78d-e0db4561d149", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694146, "uuid": "f1674d5f-864d-4275-bf55-3b68487d1612", "value": "MedWin_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b93a65-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645728959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645728959, "uuid": "e190714f-f1f4-47a7-b2d2-358ebc9e3f8c", "comment": "Malware payload", "value": "037108e76aea0fb082896b0dfa806a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645728959, "uuid": "5fd84011-714b-4616-9087-8b9be0561edd", "comment": "Malware payload", "value": "90c29a66209be554dfbd2740f6a54d12616da35d0e5e4af97eb2376b9d053457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645728959, "uuid": "3705bcf9-aea9-4013-9691-fff2c216ed6c", "comment": "Malware payload", "value": "cc1035bbb80813ba53ae7ad74b8649a4c696e9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645728959, "uuid": "64b000e2-694c-47be-8664-38cd1279d980", "comment": "Malware payload", "value": "ed566fbdcbb6cebc8378247a1bccc73cf6e3459523c1219e48256aeed2f0f1069d65c4e7100c0fed9356156e05793ba3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645728959, "uuid": "35c7d9d8-2893-4876-b90a-5daabef63f4b", "value": "T1A2D45B7AA6A605E4E0729434D9521507DEF17CA113B0A3E797A2374A0F3ABE0673FF05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645728959, "uuid": "390db0bb-cdda-4772-9667-65a94d5fa7fe", "value": "4c863f147d9b4997050f4d6fe7b3a7cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645728959, "uuid": "366b993b-8cb1-4bd8-8ea9-335368f0ee45", "value": "12288:Sl3Ioz1txxQIx/4o8F/JgnY5N/zLjV0mA6G:SlYo/xxQIafFRgno/rV0z6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645728959, "uuid": "1acc6866-98af-4af5-8b39-cd5f6cbe9fac", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645728959, "uuid": "ff70d392-843f-4b4c-91a6-aacd49924bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645728959, "uuid": "8e078dd1-5dd4-4a51-b64a-65f34dbb1161", "value": "data.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a034fd-957e-11ec-9275-42010a9c0029", "comment": "Malware payload (Metasploit)", "timestamp": 1645713309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713309, "uuid": "12fa11cc-3d84-429d-b1c6-c46274b1ee5c", "comment": "Malware payload (Metasploit)", "value": "acd127570e0b879782b2419590e51efe", "object_relation": "md5", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713309, "uuid": "2ef9059f-78ea-4091-90c2-78f057d93c7b", "comment": "Malware payload (Metasploit)", "value": "910f08368c08b139a951918b47ac7e0a23ca8f461bb319538ad17916819255bf", "object_relation": "sha256", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713309, "uuid": "0a2a75f1-0594-42a5-9c0c-e986b3f1cc75", "comment": "Malware payload (Metasploit)", "value": "d73f0445d15d05d5702b920a0e78b1cf4fb80003", "object_relation": "sha1", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713309, "uuid": "b61de4bd-2418-4c3e-a468-82cf9a77c71e", "comment": "Malware payload (Metasploit)", "value": "4841e7d2ab9130d4937b4676b645149666c12f2334585db9f940684e6437793490996ccbd16d940232adcc4d0c1be794", "object_relation": "sha3-384", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713309, "uuid": "88922f65-f39f-4c5d-b5b6-ff10b2575ddb", "value": "T188A38E1175D1C032E57659361870D6B05A3EF9302F21AFAF3394223A9F316D2EA1AD7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713309, "uuid": "42ed1b52-3008-42eb-bf9b-05a08fb687eb", "value": "35884c2ad371ce92b953366395804d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713309, "uuid": "18fd93a6-6a28-4a68-9f28-ac359ac58bbf", "value": "3072:NcvEtWJiOhjSfQepzDy6LFyw5Er9iv4woOY86QN4m:ekoOieor9MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645713309, "uuid": "cda420af-f607-43ff-9028-a7627ebe74a5", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645713309, "uuid": "4399c508-8685-41f4-a314-380e6a469131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713309, "uuid": "a9c2efa1-4aab-4319-ba5b-95ca3ecec2bc", "value": "910f08368c08b139a951918b47ac7e0a23ca8f461bb319538ad17916819255bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a202047-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "1c6ee5e0-1e57-4739-a6ec-7bc3c1a5b007", "comment": "Malware payload (Heodo)", "value": "4f7adcceab561eb08d621b88c99b9fca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "da0f0d40-f4d6-40ed-aa3c-9ed453aa175e", "comment": "Malware payload (Heodo)", "value": "91c3af356538ebda04d12492c0beb6df24ae786624f5e21d1dcd4407647be0a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "0c7d5379-0b0c-45c2-830a-722bb550320d", "comment": "Malware payload (Heodo)", "value": "7240833dca6d4e0c1e758736cf5c90b93504ac50", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "f2077dbf-1c3d-4322-8b90-bbd2dc1a270f", "comment": "Malware payload (Heodo)", "value": "9f2a4cc60159193dc5f10bd0d5da4b7fc076edf872bae3fdcac60ab51eb855d062f5e9c250769145323f2c0a86f00536", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "78057e0d-56af-4a9d-9739-69ef2b8510b3", "value": "T1A1E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "bc9be55d-49b7-4d36-ab6f-f5e7c0e0ca7c", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "49c93030-a1f5-404e-8803-7026cb4aa4b8", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKHe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKHLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660941, "uuid": "0ccc41e5-623c-4bd7-a1e7-b6a907a45546", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660941, "uuid": "feed9054-f11f-410e-b88a-94069853e360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "690df020-37df-4078-8d98-f84796a24f1f", "value": "emotet_exe_e4_91c3af356538ebda04d12492c0beb6df24ae786624f5e21d1dcd4407647be0a5_2022-02-24__000212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098e3a5b-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "3828d174-4fc8-4062-ae1d-d2da407254bc", "comment": "Malware payload (Heodo)", "value": "849dc7f71cd42671e0cca22ae666fc36", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "dff3cfe1-3b2f-4f36-9056-884fbc68fe68", "comment": "Malware payload (Heodo)", "value": "92316dcb6e25af23b28ea7216353979e1f5e31c147f923a515b591a5f33ee529", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "90f96978-29f0-4237-ae8e-4991950da513", "comment": "Malware payload (Heodo)", "value": "522ec337a1e5928df120f15a0ea2efa0ae6558b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "9febd0ba-85d9-4f63-850c-1f652cc6b726", "comment": "Malware payload (Heodo)", "value": "c12d0e40e37d2af2c6c04adf7d7518146654d0beb362f29f4e6d589db0f6ed1f5bf94ac5684b55fd398d652257e3e98a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "fd0e61c3-35cb-4487-b9e6-2496a6c09bed", "value": "T18DE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "66b93d70-9203-4a0e-b633-ccc4b610adf4", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "eab3c666-9929-4e93-9898-f1b260840a0b", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKTe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKTLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660940, "uuid": "24e921bf-4ec5-4617-a6f6-154eb12c2d5d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660940, "uuid": "b50e9411-50d5-400c-84a4-7b3ab8744756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "85a8e00f-446f-4014-af73-6a3a9880b05d", "value": "emotet_exe_e4_92316dcb6e25af23b28ea7216353979e1f5e31c147f923a515b591a5f33ee529_2022-02-24__000212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3c2ce6-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645710552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710552, "uuid": "345beec2-76a8-4e0f-8bf7-57562cbab296", "comment": "Malware payload (AgentTesla)", "value": "5ce488263865e63d2b8fcf8b7ebbe6a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710552, "uuid": "53aaf463-78b4-47d4-b260-914bbfcce4b5", "comment": "Malware payload (AgentTesla)", "value": "923a9a186ec5469825de55eb0ee1482ae587a9eedbfb1d4b7a6d15ef67fb1a81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710552, "uuid": "a8aec231-7b12-4681-b8e8-7fbdca7c49bf", "comment": "Malware payload (AgentTesla)", "value": "414e7914b43896e5969e975d7d39f6d463767fdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710552, "uuid": "a8ce9523-555f-4e70-b71d-95ba83f414cc", "comment": "Malware payload (AgentTesla)", "value": "416ebcdd76499c6a2bb8a92e0176461f42c143ee11d6b16d252f54c411260946f87055c31fdf18a03eeb037f5efd0601", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710552, "uuid": "0b7d1c19-33bc-419e-a14b-7610f1aec4a5", "value": "T10E7423F6A63CB3ECDD2950F404F6BA5BEC710866EE0866188D55830D12B68F6BDC4772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710552, "uuid": "c97c1947-36da-4c0f-845d-0e348b549a62", "value": "6144:eTLlpIrEIEm2YfE/Roe2cxKLp54t4wi9duS08U6K5sBjXtI:4LXaOXRX5ELAOwiHvU6KKBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710552, "uuid": "a3c53036-be9d-4cac-9817-895804ff8d08", "value": 346828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710552, "uuid": "5b29d156-3157-4ba9-86b8-25019c88b60b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710552, "uuid": "e6dffd6a-08af-4a93-8bc5-4c900259563e", "value": "NEW QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823d36e3-953d-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1645685195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685195, "uuid": "816f97cc-3af1-40ed-9b68-e619250e9bc6", "comment": "Malware payload (Socelars)", "value": "06c757ccd95aa9f6476dacf46d508d0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685195, "uuid": "c9ede642-23e1-4f17-b264-d28b1fb7c6b5", "comment": "Malware payload (Socelars)", "value": "926d38e1c5e541072e75838857a822473a3db1c226e84e7f18409ca33c93f9f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685195, "uuid": "1664d407-3532-44f3-9af5-b96e25b586ac", "comment": "Malware payload (Socelars)", "value": "cda93b1dc4ccec25ab541c347cca120c9df28774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685195, "uuid": "3ba1ec41-4f2d-4e4b-8ee0-ac7e3c288b4c", "comment": "Malware payload (Socelars)", "value": "7ec459afc7007b308f66195cfca3ba04f0eda341dc6d293044099986632e07e77f79cf1143677c2aa80bcc3d06489cea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685195, "uuid": "5a946cdc-9ba0-4ba7-b58b-975a54fef3a3", "value": "T18D659F11E6C2A036E8E3007385FF66FE8E6C7A23030C74D7E3C469695A715E27A36657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685195, "uuid": "bdbee2a1-7642-4c4c-9c32-92aebd7455d5", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685195, "uuid": "92b7a902-6018-4a2a-a88a-606dd6bb8fa5", "value": "24576:J9opFqoCv+VsqF7nZYll2QDUrygcC0JY3ZAwS8c95/d6sWjRoOYu:MpH1sSDu6Auq5/dhWj6Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685195, "uuid": "5d7741bd-4994-4981-8ac5-121c4e7036d6", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685195, "uuid": "36f6e1a1-9575-4239-9b07-119d6d8dfca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685195, "uuid": "cf16f5f1-31e1-414c-b9f2-7a2c1798e1ef", "value": "askinstall42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa47037-9566-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645702979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702979, "uuid": "063993d1-9523-49b1-97f0-9ab7da4e6b86", "comment": "Malware payload (Heodo)", "value": "b7cbf72766a097c320efbbe9305d3600", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702979, "uuid": "58b317c8-a72d-48fb-ae85-1903c54b1516", "comment": "Malware payload (Heodo)", "value": "9278bb335583ee01cd3adefc0f1d457faba3bd795e9e518b56f2792b5dde27e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702979, "uuid": "10fe82ee-5881-4c21-9908-320e4ea6d4f3", "comment": "Malware payload (Heodo)", "value": "4f8da28a8fc86abcb07d5f32e5fa35e45e35a081", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702979, "uuid": "42ba2a8f-4df4-4ffd-9c9a-42fb846abe02", "comment": "Malware payload (Heodo)", "value": "6972505ff038c0839b95da56f6ef828dfe4727d249d2a31e33f28c4fcdadf8d84c390756b321474316aa81d2eb7176c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702979, "uuid": "2a76b675-c0c2-41db-b0c6-e83f8e47e7bb", "value": "T11FE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702979, "uuid": "7773e16a-9631-456f-8cb4-4781a743802b", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702979, "uuid": "a284249a-e577-4d5f-86a4-5ed179b1bdf1", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKze/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKzLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645702979, "uuid": "3b3a524d-e014-46f1-9ec3-ca97bbd6664e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645702979, "uuid": "797a7a17-954f-45fb-a578-7cf54c9f1d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702979, "uuid": "7de3ffa3-46ac-403e-bedc-5868d0bf48d8", "value": "b7cbf72766a097c320efbbe9305d3600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a15e54-95a9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645731663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731663, "uuid": "6c5666b3-b753-4ea2-b771-d9fc23ec53fc", "comment": "Malware payload", "value": "81f70884de0ca3c6fb0b6de9f8281872", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731663, "uuid": "0020e85f-7c29-4dff-a179-3531f7f237e8", "comment": "Malware payload", "value": "92a5651f84adcfa8ac7b9e7bf445497566f64f105a81323bf48817a3a9911ec9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731663, "uuid": "7061cf83-5c6b-4fcf-8395-967252ea02bb", "comment": "Malware payload", "value": "329b1064b7037d380dca1e6ddbaee460e1d275ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731663, "uuid": "f650e491-05dc-4d1c-adb8-c604aef1061f", "comment": "Malware payload", "value": "57aadc8530b82138815d8b9e78fe00ca1dc56720a237eb1758fcb65700e2c140e6eca714392fe474efb61d58aab1bb63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731663, "uuid": "cc2274c8-e730-4fc0-b827-4298e0708b8f", "value": "T1B6E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731663, "uuid": "537046cb-8c5d-4ee3-b00c-f4962dd4b955", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731663, "uuid": "eaa42b21-c73c-45ce-af15-8081e7743c8b", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XysD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWya1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645731663, "uuid": "5ee5b7cd-8279-4f1c-b5d5-6d029b04fb94", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645731663, "uuid": "74db836c-d54a-4bf9-9acd-1888d2dc0bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731663, "uuid": "8a1ddc16-1137-4e41-91db-3cd3b663c978", "value": "81f70884de0ca3c6fb0b6de9f8281872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d116f5-9588-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645717485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645717485, "uuid": "288cf465-8242-46dd-8255-7e4c1771deb8", "comment": "Malware payload (Heodo)", "value": "a5ef0529e98233581fa7dd4049c089a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645717485, "uuid": "00e5dd33-16e0-40a0-93eb-d08148a51240", "comment": "Malware payload (Heodo)", "value": "92e7ee4747ae0f723c503ba01258e41e6386600faf5e16a774242192bed14263", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645717485, "uuid": "ce8f6694-dc44-45b0-bdf2-dbedf1966d02", "comment": "Malware payload (Heodo)", "value": "9b622318016311530325e0194c488b2a99de093e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645717485, "uuid": "5cda54df-adeb-4022-bf56-b97eb2ab3c46", "comment": "Malware payload (Heodo)", "value": "2114a6f4c7a7961ee44c9e896fce98134ed7bf423703013ad6d582fc8aef49c146d1dc18a30809126736bf55be635b1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645717485, "uuid": "0b1b48e2-cbdc-469e-b912-1e3f7ea3de00", "value": "T11DE4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645717485, "uuid": "4d0b8684-d524-4ae0-a47d-b46cfd804cad", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645717485, "uuid": "a015d145-7a05-4981-95b7-1e1aa9dadae4", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKdKDYjX3rUXY:ygHpbVy97K0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645717485, "uuid": "d6e2a503-038d-41a2-892f-2b740fc29963", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645717485, "uuid": "de33a833-9e2d-488a-bed1-a24346780f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645717485, "uuid": "6abcfa64-c193-4465-8959-a2512965bfff", "value": "a5ef0529e98233581fa7dd4049c089a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6962d4d-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729118, "uuid": "9079775a-fcf3-42d6-9dd7-de47bb0ac223", "comment": "Malware payload", "value": "2f1751878535544714d7b71130abe071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729118, "uuid": "45a849c6-4c1e-46cc-a927-8a24c8b6a85d", "comment": "Malware payload", "value": "92f69355bd02da6bc9f8b1b05370086c014f4235016804f313b38c4d3e82c2b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729118, "uuid": "6a3e5b22-7c78-4152-ba62-d452212c5b65", "comment": "Malware payload", "value": "4282bd18596b0a099ffffefc02890d11bdcaba45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729118, "uuid": "8b8ca211-8fe4-4def-8f4a-10e7327b54ff", "comment": "Malware payload", "value": "ba82ccda553ec266619a1bb95694e5ab0722220655f5fe2bf22bf6995f29949fb1c3afa632bf08ddbdb7d57308b6fc79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729118, "uuid": "58a05286-2370-40c0-b312-3698000500c7", "value": "T13864232E20E94CFFF8A3AEB5A061B247CBF2F7151E1C049B9B155F3A2A5A0451F09747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729118, "uuid": "eab01d8f-502f-4203-9009-57c6e169f6d4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729118, "uuid": "48495731-51bb-45ae-b54d-eddbabbdea01", "value": "6144:TxD7F9n+7iEaPz8fncIvrzDVrCe+W2EsKvK0djCt84rwy0ICsSVUCFK7fFAs:ttPzwnFvHxrEEsaKKmtqyjkBafFAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729118, "uuid": "7c4a928e-a1a5-4988-aedd-da2e233879bb", "value": 335092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729118, "uuid": "46ab2830-9e27-4751-ae34-101f17e836cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729118, "uuid": "fce75a77-c720-4cd6-9a48-220321a95f41", "value": "2f1751878535544714d7b71130abe071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b733aded-95a9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645731669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731669, "uuid": "a59b9f75-48b7-43fb-9849-1d7c6c998aea", "comment": "Malware payload", "value": "a30217c126c0c4ba87078753bf46fc5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731669, "uuid": "53580507-15da-4304-9d50-221866bf31fd", "comment": "Malware payload", "value": "9331e4405771abbfa761835a73f73f80f489c5b69243264364ac0919fb919e19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731669, "uuid": "b4326417-639a-4801-9ff2-d3727d4f7a4a", "comment": "Malware payload", "value": "12e6ed5ea484f07dffbcc3b3a0b6d2c98b7bc2b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645731669, "uuid": "aac1f9c0-fcac-47df-b9e6-8dc36a81da38", "comment": "Malware payload", "value": "f6026d7b270d40f41947554320e76edc712e9c0f2bcc079e39c277d5222b3289ecc09efac3aedb26f795891b8aa9ba30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731669, "uuid": "dd29a81f-4568-4008-a164-fcd0d4020b29", "value": "T17CE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731669, "uuid": "f60f6df3-353d-4ed9-b8a1-cd0e09834a18", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731669, "uuid": "e4268590-4c12-4c1f-b8ed-a5913e90ea33", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0X+sD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFW+a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645731669, "uuid": "bc26bf68-d7f8-4278-b96f-ad193bef14cf", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645731669, "uuid": "0a92e57c-3c74-4f5c-9759-2f3f149adeea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645731669, "uuid": "3ec02f4a-cd36-46c8-a0c0-ea044a6c6c0f", "value": "a30217c126c0c4ba87078753bf46fc5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf81d5b0-9585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645716221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716221, "uuid": "82ceb6c3-d1bb-4e77-96ee-4077c6b153bd", "comment": "Malware payload (Heodo)", "value": "4031220f4aa6678a8ed5730300bae0f8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716221, "uuid": "be4a5cd8-d4de-43b9-96df-ffa1ba52612d", "comment": "Malware payload (Heodo)", "value": "940ed304a86974199c318d6a2309f60896d0608ac22ae2b60beef165edc9128c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716221, "uuid": "46d077e8-fde2-4125-94fd-34bc2a13623b", "comment": "Malware payload (Heodo)", "value": "0ec9dcdb0eabe237da3076943fabc96bbd2a73d4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645716221, "uuid": "bec44848-3e77-4710-9bc7-1c76a480f5c8", "comment": "Malware payload (Heodo)", "value": "9bc6c10c1f8ae00827afac86beafb1417011d46ebf27997205d6332aef1ddc7fff7f7b164428f96bb2a00c5848584daf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "XLM", "colour": "#CF01C0", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716221, "uuid": "5193f52f-6c7c-4367-93f6-b2f8ad0ca042", "value": "T13C93026ED32E44BACAF58434F108D4EB690E5D071409EA490890F69B5F7AAC58F7DCEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716221, "uuid": "1da2f000-7dc3-4ee6-b1ec-0fc331dce6f1", "value": "1536:gyx1gX2hnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xX0Hi:gyDm2hyVEoBo6hKb4llGsQjbxoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645716221, "uuid": "2882408b-b8af-47aa-8559-0778683f71ad", "value": 93363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645716221, "uuid": "e2a1f788-22ff-4348-8eaf-fcab138bbaab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645716221, "uuid": "797d7f58-acee-4251-9305-1b43c23cbcf0", "value": "Form - Feb 24, 2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b75932-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "5cd38a98-6036-4328-a337-1feb21f1ec32", "comment": "Malware payload (Heodo)", "value": "b9fe2caec52e9e6326666297d6c2c21e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "270b98fe-5bf1-4702-a707-ece693e899de", "comment": "Malware payload (Heodo)", "value": "9449e9f176f54b5c7fbaf32f2ec3c8aa5ff21fc9895ecd7f397a6401d70ce057", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "9d28d1c1-b99e-4601-bac2-4d923fa65650", "comment": "Malware payload (Heodo)", "value": "7efdb417b7d70e69a41456bb214e1b68b2bae0a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "f9c0b0ba-c8c9-4d58-aef5-e59e4f90a3d4", "comment": "Malware payload (Heodo)", "value": "b76d4ed6f7ea84486c8c4845d8da3acbfb512cd6ee61b2652d6db87dc4a461d48635c9fc0c2cb86aebaf74afd64c521a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "ec843d9d-36e3-45ef-97bd-0e414cb2c91e", "value": "T1ECC4AE4177C2C4B6C65F01725986C31E62E1AAA0AF3996C36BD49A7FBFB41C2DE35301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "a61c16a4-200e-4f39-8aee-e49b0c912ba6", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "a9f70544-b79d-4638-b7da-e6edf8731b50", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0ShR3Hm/zZe+sB9qF6+Z2ncwH2P:ffdA3/18nLrOoaYNfKPhaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660963, "uuid": "c6bb4914-8aa2-4183-ac9c-4f1c222bdf71", "value": 567945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660963, "uuid": "c5c36597-9efb-41bf-882e-60d3e93eb7de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "fcc110bc-18a2-4252-929b-eaad119a3dc4", "value": "emotet_exe_e5_9449e9f176f54b5c7fbaf32f2ec3c8aa5ff21fc9895ecd7f397a6401d70ce057_2022-02-24__000236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe6c1be-954e-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645692304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692304, "uuid": "d6d653b6-62c8-4272-8d56-0519490499c9", "comment": "Malware payload (Loki)", "value": "4dbb01a2674c55dd85e068587422f099", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692304, "uuid": "126531d7-94bb-4afd-b06d-cf97688fb571", "comment": "Malware payload (Loki)", "value": "94612e7fe18a313168be8bf420088890c89cd3b5d292a6e3c1fdda7e4bb1eca0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692304, "uuid": "c40c0ffb-b276-49dc-b9e2-31cd295169e6", "comment": "Malware payload (Loki)", "value": "fb02a436d649a76dfcd0172cbaf6b4decabb8c61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692304, "uuid": "a1522751-65ba-419e-b475-617c2c03f33e", "comment": "Malware payload (Loki)", "value": "82e9d774f7b36ff9c198502d9adecda76d000f8cf4defc9331c8762a537d3e08ad3888af080ceb8e21884bf6b7d96ba1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692304, "uuid": "c5cda1f2-733d-42ec-b6f2-3aca43c0ae03", "value": "T10FE4BF1439AB20DEF063DAFE9DC8EDF0DD6AF13B220E75BA24460F564B49941DE12172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692304, "uuid": "82eec4ab-37dd-4b27-b48e-5d2698642aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692304, "uuid": "e28e0f97-57b9-49d3-99c8-81995532015d", "value": "12288:8MrZNJA1L7XcCflo/tXMRTWT6BU1wb0udBQA1JAEJEXB7z:fJE0V4x+qIhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692304, "uuid": "6b634240-91f9-4da5-8849-f9bdf3da0e40", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692304, "uuid": "6968a902-d944-495a-9f2c-3b66f853e1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692304, "uuid": "7b88f167-edb1-4280-becc-bcd268b58722", "value": "4dbb01a2674c55dd85e068587422f099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f50d90c-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645682425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682425, "uuid": "5eccb8f7-b3f5-4037-8b1d-7319e05f89f4", "comment": "Malware payload (Formbook)", "value": "6c68d9b3663c3a198feaf117d7ff5d40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682425, "uuid": "2975946a-9563-4f7b-ac03-b705482c9f25", "comment": "Malware payload (Formbook)", "value": "9484b37af380c8c86dbd8234b60e7420e498671548359ca9393ed0402d9dbd80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682425, "uuid": "7401cce4-792d-4aa6-9a07-91f4d2f17ab1", "comment": "Malware payload (Formbook)", "value": "960472919c98e6186180ca19546a021ee121673f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682425, "uuid": "212f4982-b05e-4d89-8fb8-25d3cf946115", "comment": "Malware payload (Formbook)", "value": "bc3b82d2ad7351452589b52587d85c1bfd8c4c46514ce4b238d08b7f229fcd9f59b9837d07967486e6ab03ada10e7cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682425, "uuid": "29e7fafd-cb85-4b73-bbc8-c8bc416875e4", "value": "T150F4CF2435AB20DEF023DAFE9ED8FDB1DD6AF53B220D72BA20460F164B49845DD12572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682425, "uuid": "c2d5f188-b4e1-4ffa-ada4-a3451fa5362e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682425, "uuid": "9240ae8d-060b-47ca-a854-2dc0dfb286e0", "value": "12288:Ib68dywN8r/3x5WgoZ/ZpifvW9XHK2k3ti90RinX/8d2LvV+eJdPN9yfLTI/eUTz:U38r/TOZgf+TksyQnXk0LgezyvI/DTGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682425, "uuid": "e89c65b3-8d4b-4a0f-ab3e-baddfee8c50f", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682425, "uuid": "ddd3363d-96c6-409a-8ad4-035315ad1745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682425, "uuid": "de123a48-512a-4a5d-9bdc-9fffaa4c2848", "value": "URGENT REQUEST FOR QUOTSCAN COPY_PDF______________________________________...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978324f6-9596-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645723456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723456, "uuid": "ce739c95-8247-42e3-9778-83f05fc89753", "comment": "Malware payload", "value": "bb33d7ae803cff6e57fe357eba70fca1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723456, "uuid": "7168c2b1-a4fe-4ee5-87ab-5626f48edd0c", "comment": "Malware payload", "value": "948f42039dbad8f44067819a9587cc23720286bf7668615a7a0296d573e93813", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723456, "uuid": "fc772d4a-337b-48ab-a875-dcd6af4d1735", "comment": "Malware payload", "value": "d12b6e0198a8b924b8e03f52558afd974051bb6f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723456, "uuid": "6a094297-bbc6-4679-83dc-fd3a58644481", "comment": "Malware payload", "value": "0e52b6b1e7da1bff5f8b664ddc7013c5102fecfec135a7d24b0576120a0bddc1c41196407b212e1a2b34ea80d9f490c4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723456, "uuid": "7a9a6b45-0fce-4ac9-850d-fb51dbe4246f", "value": "T1A116014BE709A8AFCAB756338D79032102975C2642C39BD72D55B62C0AB76D02F9DFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723456, "uuid": "99552789-38dd-4d33-8098-c082ad3e4d1a", "value": "98304:Yde8/D3mBxLQ1ypKaauAkaQzxEj2e2BeUI7dWhbfC/GKiLHbYHHmL3Iwzfr+N:Yc8o18yKaKMEjCvCWfC/GKiLHbYHHmLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723456, "uuid": "8b9887b7-83b6-4100-8cc5-b694147556a4", "value": 4415803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723456, "uuid": "f1a69185-4542-4cf9-886f-4ff1a6702047", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723456, "uuid": "9325f217-8265-43cb-9322-91453e724ffb", "value": "Diabetes Management.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba5bec5-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1645692727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692727, "uuid": "e06b6935-67b4-461a-b3af-a786e99392f8", "comment": "Malware payload (NetWire)", "value": "e746d3a4857eabbcf3a0e4ed6b46f3f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692727, "uuid": "b86efa5d-b36e-41ce-b309-dd92f850b854", "comment": "Malware payload (NetWire)", "value": "94da93cd59741706734ff7d177842b579ba7b360949be20a3a052536c7aee6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692727, "uuid": "2780acea-b89a-4082-82ae-750cf8eb31d7", "comment": "Malware payload (NetWire)", "value": "0b7f2c2cda1d2acc6d170b2f3d3896e35ab916f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692727, "uuid": "c4851679-62b9-4dce-9dfe-60df6600a40c", "comment": "Malware payload (NetWire)", "value": "9cc95e54150e9ba2a60db2dffac5e264b4b400c11090ad2c3358a6df30c4cd42ef98e6a172acf094328544f106a0fcb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692727, "uuid": "8a573916-5b5b-4837-8f25-ee8e20df4f7b", "value": "T18FF4BD1028AF66CEF1768BFE5DC8A9B18EBAE53A3509F1B91C814EC70741B40DD51A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692727, "uuid": "e5440604-9f7f-4513-b046-a91d3d6c9582", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692727, "uuid": "c58742ee-690e-4622-a5f5-87d3d387b38c", "value": "12288:7U8TEJgYYz0KsNdemXUDH2qNvlpqPIU/xnPSiyaboNyGTBfJRFefzmnHrqjqg7eX:b9GNcZXTpkIU/xar1ZTNnFSyn+jqfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692727, "uuid": "06556303-1042-4b72-b226-6fe722851d3b", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692727, "uuid": "b0549e32-a206-4959-9d30-2c746ef158b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692727, "uuid": "2b14cc3f-8f1b-44d1-a238-7c5d1a28cdba", "value": "RFQ 9P04794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae8edfe-959c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645726119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726119, "uuid": "f26ef4a6-1cd8-4d45-a4cd-21549b0b1225", "comment": "Malware payload (AgentTesla)", "value": "76f5ff89b203de5c52d60017d6d4c9de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726119, "uuid": "d2c10cce-76fd-483a-9a8b-2924c54afc3e", "comment": "Malware payload (AgentTesla)", "value": "9583a4b3e4f4621fadda270e9d6a003f5e93dcf7228e4e2335b83d5d2b0d2714", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726119, "uuid": "ee57d9a9-e451-4f2a-9ed1-78b6683ac2b9", "comment": "Malware payload (AgentTesla)", "value": "47b59c45668f60ec49e07703c6b45c3c867fd76a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726119, "uuid": "c82ab0b9-2ada-4b5c-a2a3-afb03ae5454c", "comment": "Malware payload (AgentTesla)", "value": "43a392d784e66a7d1dd40ecf3fc38038d309ff55b0132a6c43fbc463b08dac1b0c19be3cda03681da68e857c213fe16e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726119, "uuid": "99b5e9f2-568b-424a-bc7c-dbd993df34c7", "value": "T18005BD1035AF66CEF0368BFE5DD8A5B18EAAF53A3519F1B91C820EC60751B41DE11A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726119, "uuid": "b6b1fb5f-dd93-43ee-8e19-b151efec808b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726119, "uuid": "59e8d78b-0c87-4e31-b672-47ca3051eec7", "value": "12288:OhYFEJgYYz0IRbxW9J2O+W8ki2xPyFNDTNElgLzJDjepcZ3H8Hr+xhjmBDwwJ54D:79V5I9J2vW8dsyTD5D/MC38S0FJCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726119, "uuid": "f268aa34-f410-4ef7-aad1-475e187d9758", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726119, "uuid": "d7920803-3018-428a-a887-6e96f04f71cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726119, "uuid": "514e933c-4806-44b3-932f-db82f6afdd18", "value": "76f5ff89b203de5c52d60017d6d4c9de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e784af0-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694154, "uuid": "ac3c7e94-08aa-4209-ad9d-70e2acddbd6c", "comment": "Malware payload (Heodo)", "value": "2cf9368f1e6252f74aad66350e63bfff", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694154, "uuid": "705b79ba-cfb5-4184-baf4-505cad77474d", "comment": "Malware payload (Heodo)", "value": "9647c729557d9167beca184209db6f8376218cc220c588c8f0badb58694a4e82", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694154, "uuid": "f648ecd7-2db7-48fa-914d-59842c551e12", "comment": "Malware payload (Heodo)", "value": "ad69944fe390ef5aca0f2442b79365f723b2c72c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694154, "uuid": "c3e9e8b4-88cc-4458-8261-af3b33729ef5", "comment": "Malware payload (Heodo)", "value": "99359c946a4afef49beff61ed97ba2771e37893684d27715a863deb469851687d4da924c1afbd1eabaf396ac5cbc2bd5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694154, "uuid": "73a1f397-eb07-4b94-923f-89f8e015fcce", "value": "T1CF93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694154, "uuid": "639ee682-3d03-4480-ba53-11bb2cc4368f", "value": "1536:PQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:mDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694154, "uuid": "47ed3c74-f89a-48ca-ae99-1661edbf5f01", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694154, "uuid": "1721f47f-e77f-401d-be37-be2fc64509b9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694154, "uuid": "adde2c2a-6020-40d4-a923-94e663fa19c3", "value": "OPAST GROUP_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209c0788-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "6db67037-b1ba-44e7-b03c-20b0c18365a7", "comment": "Malware payload", "value": "cfacd1bfae92ada6efa8c4bbf1fba965", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "b20b5519-7ca6-45c9-a22c-4383465b3847", "comment": "Malware payload", "value": "964d6068af3852eb9650de504102f2e054e76c7abacc307871a0b8b9f1ead9ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "1a0310f4-9e19-4952-84d5-52f838455b6f", "comment": "Malware payload", "value": "feef2c9f7227973471bee3776c772a99351c96dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738718, "uuid": "66b6b2de-f969-4900-a0b4-93cbff632db7", "comment": "Malware payload", "value": "ea2d63043daa4c02e498f270607ba03f98164387eb626168dc88de100a07faebe52bba12e988dcc369a93ac8a32fa794", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "adc13777-5f33-44b4-989a-d2c050c480dd", "value": "T1B435BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "31b07997-8ed8-40f3-bc02-4fb90b32ce3e", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "078506c4-74a8-487d-9f93-d4505c06dece", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uSVOe528JO6PC:6iRGcUY0UvDYNFtui5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738718, "uuid": "2a06bcc8-b435-4fc9-8225-11026ce01fda", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738718, "uuid": "636234a5-9ad4-4c16-9d6a-79d560f0b031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738718, "uuid": "b416bfd5-62b4-4b9b-bd01-5af1b33cf5db", "value": "emotet_exe_e5_964d6068af3852eb9650de504102f2e054e76c7abacc307871a0b8b9f1ead9ee_2022-02-24__213827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3114a7d-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645682780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682780, "uuid": "c06e990b-205a-4901-8b4a-07068dafabfd", "comment": "Malware payload (Formbook)", "value": "7c9460ed6d828b0347486281c052fe27", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682780, "uuid": "2527ca00-9ab7-45cc-ba09-df85e5bfcff5", "comment": "Malware payload (Formbook)", "value": "9664a3f4d21a1d67c4c98ebe798891058ac040dcff9c2a06af95b0b8301074d4", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682780, "uuid": "e5e5bfd3-5a42-48f6-a13f-b4ac3e6773fb", "comment": "Malware payload (Formbook)", "value": "240a020028dd6d4098edbc12f3c633634946f879", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682780, "uuid": "1d571f27-74c0-496b-9949-dd2085c230a1", "comment": "Malware payload (Formbook)", "value": "7a6096acbcb1563377f5b2049aa976122975ba299a8cd53bc670d162170b78c9b71dd9b4d1d4ffa27a3e0d2e48ada17e", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682780, "uuid": "b3e32e6f-03c5-46be-b54a-e3c3cd82c351", "value": "T140E433979B02FB96218965229C97EE4253B18F0B9C6CCCBFEF5DF9847A1021CAD75013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682780, "uuid": "1931fb42-664d-4dfd-b23d-b3dba1765368", "value": "12288:6x4EQXS1LzfuLi5JYbOCWaUGlA1AEFrSZaRacyY4m1njFDuVbI5N5H22Nl:667S1LSeQbTW9Go9aaQcyWjNuVIH2Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682780, "uuid": "e34499d0-80fc-41f0-8251-23eea167bc94", "value": 668135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682780, "uuid": "b1f539b2-840e-44f8-97de-fabc72608205", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682780, "uuid": "c5a8fc08-db12-4431-a9ec-d7c1aa98c3d0", "value": "PaymentXTTXslip.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d63768-95c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645744314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744314, "uuid": "8f47e6f8-264c-44c4-a4ba-75bf3ece6264", "comment": "Malware payload", "value": "2f0805d3ab192688b4997650b2da707c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744314, "uuid": "7f37a4bc-7377-40e7-8431-c7396968760c", "comment": "Malware payload", "value": "9668a2648ca782bec391aab138a5ee776e3af4f1fde8c01970ad661bd3c0e497", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744314, "uuid": "f01df516-033c-4c21-8406-f9529ed741cf", "comment": "Malware payload", "value": "1a750651eaca4c0a6c5f31ded0c2d1d26facc5d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744314, "uuid": "564065aa-8363-4f20-877d-d4f346c06d55", "comment": "Malware payload", "value": "145fb1299589954fd5bbbd267b4a67aa83ee492ae66104c1a6306529678907cc993170b581f05e4102eb4ceb7462fbed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744314, "uuid": "8be0a985-a6dc-48dc-8ab9-adb4d2a10768", "value": "T1DFE4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744314, "uuid": "ae2e307b-d54e-4fbe-8d5f-46bce2d81a9b", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744314, "uuid": "ac1ab87d-da5a-4c4e-be57-72231086f5b7", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKPKDYjX3rUXY:ygHpbVy97U0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645744314, "uuid": "7247c0f9-0a9a-4ff2-a286-dd43ec699156", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645744314, "uuid": "06695166-89dc-409f-94b8-549d456d10b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744314, "uuid": "94ddba2c-cc82-4e57-801a-6a08ce0f244f", "value": "2f0805d3ab192688b4997650b2da707c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e23770-9520-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645672663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672663, "uuid": "e8f00aa6-71f7-4420-8f1f-6bece8c75a2e", "comment": "Malware payload (Heodo)", "value": "987c03bd488ec024ad81224bfe5be33b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672663, "uuid": "28334180-6b86-4eca-8265-c4cedae6ea56", "comment": "Malware payload (Heodo)", "value": "96848c2ceeba54196cacd269fd3f95afea2f6f33140b0fbb258ab3522adc4f35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672663, "uuid": "369a903a-5afa-4954-8779-07240ffc25ca", "comment": "Malware payload (Heodo)", "value": "4c918b3321a5b3759564c6dc7db5df71888dd256", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645672663, "uuid": "f5c3a487-3cd4-4ace-ad89-ae030ea5ebf1", "comment": "Malware payload (Heodo)", "value": "ee6db7ff4f7f7c8af7aa57af992ffb9cee2eac0887745a127734996f865e2945ce178b6c1fd877b0a2cd05a723be8e3c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672663, "uuid": "3ce1c604-07f2-4995-806c-046428db0b35", "value": "T13BE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672663, "uuid": "ca83c0c5-f7e6-422c-964d-dd9d875eaced", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672663, "uuid": "fef2d9d6-c542-4ab9-a437-f29d1ae2e2c8", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK+e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK+LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645672663, "uuid": "32e7247a-6094-461e-ba0e-0e28d342755c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645672663, "uuid": "08772269-725b-48d0-878d-712b80d3a71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645672663, "uuid": "33bd7a54-a546-4bba-9f86-5ce456217b78", "value": "xpwWrM3zWrDUg266ym6In.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dcdbb2-9595-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645723002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723002, "uuid": "38466e70-2c4e-439f-a9e8-0546421ad1a3", "comment": "Malware payload (NanoCore)", "value": "52d630791fa548c9ee000eaf7fc4cf72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723002, "uuid": "4d45dff8-f34d-4e8b-a04d-6cbc733586b8", "comment": "Malware payload (NanoCore)", "value": "96cf3dde4a7f0757b82e055c75f6b3025414fb06480b021fd36ae1186d67850f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723002, "uuid": "7839139e-16d5-427e-8983-1ceabff3c812", "comment": "Malware payload (NanoCore)", "value": "77294d6c051774671a3435ae1381f40835200599", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723002, "uuid": "ca86a254-efe6-48fd-8031-0091086b0883", "comment": "Malware payload (NanoCore)", "value": "cc1e089c39295569c43fc13966ba44f562f43f77fc311093715c08c97243c28d338361e53c8cfaef98b2a06d282809ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723002, "uuid": "0f1d99ea-61fd-45c6-a2c7-a74624e5780e", "value": "T1D07390A1BE84F629D12A2C32DB12DAF5C127BD2BCD6099537CC47F1F79376429401B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723002, "uuid": "b09e0c94-79af-4f1d-8cbf-9be92c20078c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723002, "uuid": "c6165aeb-b604-48fd-a8db-30c406d74f00", "value": "1536:3dEbO0nt3QU+iopiA+bHq0R4Co0s7yj7c0q19:NEbzYzCo8/c0q19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723002, "uuid": "558a9a56-7bb1-4eec-9642-43b2dabc1a6f", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723002, "uuid": "16474480-68fd-40c3-9e09-67edc066d9d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723002, "uuid": "7b92a3f0-2dfb-4434-a3b9-ca57347d7de8", "value": "52d630791fa548c9ee000eaf7fc4cf72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af04d7d-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645723220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723220, "uuid": "e87110d0-390d-4708-8d4d-81d374af2eb7", "comment": "Malware payload (Loki)", "value": "6758eca3266518974b7871929360b34c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723220, "uuid": "0a630798-c25f-4499-939f-4839ab410bd5", "comment": "Malware payload (Loki)", "value": "980aa120829118df07df0201e73a4eac548afd3b027decb4f1e021c24899e6e1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723220, "uuid": "dd79891e-f1f6-4789-a3d7-8cd47cf5f6e8", "comment": "Malware payload (Loki)", "value": "8a036b5bdd1edd3dff59775778adaf592c709be8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723220, "uuid": "38465a2b-b43c-472a-be17-1480d1f82112", "comment": "Malware payload (Loki)", "value": "9d41f7e118f7aa032d02286474910e22f70188bd98a2591fc1d881b67108dfe7fddbac704decac85874675249fb07668", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723220, "uuid": "4db28b63-377c-4fc1-88d5-601811223909", "value": "T113141258B7FFDBAAC63A34734C90591DA1B5CDA0461AC6277DE8318B10362D7DA06C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723220, "uuid": "222e76da-67c1-4038-83b4-0dec64760a36", "value": "3072:Bzel1kJWAAHAoBGmj3jeFNOB1PZ7g2q1vND1uNixZ6YVlJiT/WHacWI+HYhiYoD2:4AAHJGmj3jew1B71q1lD1fxZ6YrJuO6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723220, "uuid": "d8fc6fac-ecd7-4f2d-aca2-badaa10c5b14", "value": 190360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723220, "uuid": "109bc6b9-f932-4a7a-bc39-bbe083573240", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723220, "uuid": "8c1d5d94-fe53-4e2a-b94c-bc93eda621b1", "value": "swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13949466-954e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645692311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692311, "uuid": "b014ec0a-7dd1-484d-9ac2-952063add5fc", "comment": "Malware payload (Formbook)", "value": "b8c17d08c78f88e49edd77c35b47e851", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692311, "uuid": "e830b9d8-fd3a-4790-9081-cf4aa5fdcfee", "comment": "Malware payload (Formbook)", "value": "982e727a53a27d2bfbaea608209b315bc892947a1ef954033f1b29c687b6e001", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692311, "uuid": "df438101-54ee-40c9-83b5-94bc04b1cae7", "comment": "Malware payload (Formbook)", "value": "43bb31c71c84de912fbc4b2df45df445e0fd5de4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692311, "uuid": "01788a04-3156-434b-b19c-f8574806ed68", "comment": "Malware payload (Formbook)", "value": "ebbb7796d61c7508b83bd1849ce3b33253901c075c1de1b1e966194052545099db0cd616ebde2add91c63a5ddf60362d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692311, "uuid": "bf3f7556-e930-4084-9176-49ab4455f236", "value": "T1E315AEA2739315E0F72AC7B8442937112FB070AB69C6D76D5FA614FC99B1F926804F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692311, "uuid": "b0220981-ced2-4c84-b655-6185f5f8455e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692311, "uuid": "d1298b76-fbf9-4b63-b68c-b9840935ddb1", "value": "12288:C1apH3333333PfJ55555555CaqaF0qMgmxd0C66baBTn0huT/pWygoptzU6Lm/GD:/X6TgCd05BTtpWDoDzU6LmO7SlEZLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692311, "uuid": "69f8e886-6d30-4ac6-b571-cbfd9f98c69f", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692311, "uuid": "7388c3f1-89c2-4203-8c93-a426bb20672c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692311, "uuid": "be83eeef-6970-4d37-bf06-97b6a87b36e3", "value": "b8c17d08c78f88e49edd77c35b47e851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517c55c2-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696280, "uuid": "bafdeca7-ca2e-49c0-a265-022e022836b2", "comment": "Malware payload (Heodo)", "value": "9740457ef9412dc96531d9ce239d8366", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696280, "uuid": "c05deea0-987c-496b-9518-8fe9848b9420", "comment": "Malware payload (Heodo)", "value": "987b6fb672a34ac333ea358758aa4ebbbdb88f2a6eb5813911b3202b34f08209", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696280, "uuid": "44377657-a121-4fc6-bfae-8232c15c6167", "comment": "Malware payload (Heodo)", "value": "cc282390b9c0e6c6cac40288bfdfd9be9e981464", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696280, "uuid": "d5aeb591-1fb0-4323-a125-6ccbfaa5928a", "comment": "Malware payload (Heodo)", "value": "7ff7ccad03df544037c3d261fc5d79d10c8cf72bca35340b6b2744b114615d837372bf182b1a5efec98908326bed39ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696280, "uuid": "29739038-4448-40d9-ac3f-042e4a82f722", "value": "T19BE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696280, "uuid": "78f99cbe-ebb2-467b-9ab4-42ea718e8fe0", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696280, "uuid": "87363236-5957-4252-9076-16328ef6a72a", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKoe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKoLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696280, "uuid": "fd2ee735-e67a-4aca-a964-6c1911778934", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696280, "uuid": "daa02683-ea2a-4b7d-898d-6272e229f0b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696280, "uuid": "9a604dc0-c49b-4f25-be13-eac45c4ef665", "value": "jKpbCOfhGg1RRP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9662af-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694148, "uuid": "70df189f-15e1-40ba-aa5c-a3d671167beb", "comment": "Malware payload (Heodo)", "value": "5c4f1e18af8a633b170fc43d46e81af2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694148, "uuid": "a6735fce-05b0-49ee-bb49-812d519ad960", "comment": "Malware payload (Heodo)", "value": "98a81c8ebf1d27106d54cc4f3fa787892f5eaa7c6e53630cde78a2c3fcad6ad8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694148, "uuid": "f96a7165-44e9-4214-9432-828b9f762a9c", "comment": "Malware payload (Heodo)", "value": "30f4e7860ee9175142c34dc57bd2287256a484e2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694148, "uuid": "528c7e97-4f92-42bb-b995-21fe2c579fcd", "comment": "Malware payload (Heodo)", "value": "fa82683b39558d342437d37ef53161af214e450f7c9132aaa82f592a7d82f67f5858094026fab86e49ac46904d5a805f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694148, "uuid": "0c6e074a-cf0e-42a7-8b29-544d06ff683a", "value": "T16393022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694148, "uuid": "07f52c72-b0df-480b-8c60-1ddbafd884a2", "value": "1536:zQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:aDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694148, "uuid": "b94628db-81eb-4c2b-ac06-c4fa765d2393", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694148, "uuid": "91b2b938-9c8b-4531-86eb-a543bebf84f4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694148, "uuid": "3509ac69-a1c1-4e30-b688-8464178ab359", "value": "Medwin Publishers_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0010f25d-9550-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1645693137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693137, "uuid": "f14b3045-c7c5-4aa5-a1ef-efeed4a87487", "comment": "Malware payload (Gozi)", "value": "3e28814e19eaf2699c28a2afe25b55ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693137, "uuid": "dd5a6228-c45a-4eeb-86ff-effc38d08880", "comment": "Malware payload (Gozi)", "value": "9982fdf2c1b5b3c8e15cffe317da900d764d65d7d09cf98b0e52cfcc966898c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693137, "uuid": "657336f1-0a7a-418d-af28-f0b7cd30b95d", "comment": "Malware payload (Gozi)", "value": "d7941a5e940c8f549252ec96a75359c2273337cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693137, "uuid": "a1a325f5-80fb-4389-badb-598f7abf3ef5", "comment": "Malware payload (Gozi)", "value": "0f06321f998aeedbb42c8526773c28476d6a61ef2081f7f5e8188553213f9d2ae28ec116ed45191ab7f6ee4792e6df9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693137, "uuid": "db5c9184-2176-4c49-b28c-7901e3087251", "value": "T13AA4D0B726AEB47BD6CBA53F32382AB80840CD11D6ABA2D366C75BDDC46DFD34404941", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693137, "uuid": "51ec4245-a358-4dd5-a3ab-b5c50c4b69eb", "value": "1c04dffba09707f083fbfc83a7f90758", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693137, "uuid": "1f93b447-25dd-48f5-ada4-c4a23a95ede9", "value": "12288:JVRknbEsfVRknbbQi9VRknbQVRknbWVRknbAj0LhL9+:JVibVVibbvVibQVibWVibAj0LNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693137, "uuid": "6fdfd328-6d1c-43b4-b76e-39af91d1ecbb", "value": 454936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693137, "uuid": "dcf030f3-271a-46ee-872a-121f66aa35a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693137, "uuid": "07c5788a-bd01-468b-8ccb-a35e0ada9eec", "value": "3e28814e19eaf2699c28a2afe25b55ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8459f000-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "560446a4-623f-486a-9261-972f361fa1d6", "comment": "Malware payload (Heodo)", "value": "57f54c50e5e6c4ed859abb65ce1db200", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "899c0f5b-9f61-49fd-b618-6b521a9d32f5", "comment": "Malware payload (Heodo)", "value": "9982ff192dc733be2630d4da675aa12daa32c9d76e5ba13a6d178f1047dc4e23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "825130df-5b28-4a9c-bcc4-4c104981c265", "comment": "Malware payload (Heodo)", "value": "07e3e32040f789c8c7be3240e5d768e0d9ecd631", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "5fba415b-dfd6-45bd-ba3f-e60ca2fcc175", "comment": "Malware payload (Heodo)", "value": "f6634079c36429a5183f459e5cfa2fc1dd25e5e45ff47f47c15cdf6920f4ed0fc1efcf784bb817b8c619e587e77638d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "6201e942-510d-425e-9cb4-4c88b042cfbe", "value": "T182E4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "ab44720c-5a32-4ba2-97c5-72cebee36bd5", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "aeb7ae90-83e5-4419-a09c-e7007e518844", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKQKDYjX3rUXY:ygHpbVy97j0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710539, "uuid": "99e21e46-d22f-4a4d-8d86-bdaf91f412f1", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710539, "uuid": "55dd83cb-cac9-410a-a450-50411f423ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "cca5c666-869d-4da4-889c-f994907a8f5e", "value": "emotet_exe_e4_9982ff192dc733be2630d4da675aa12daa32c9d76e5ba13a6d178f1047dc4e23_2022-02-24__134853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48f0988-95b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738107, "uuid": "73329968-5845-4e6e-a90e-472c39804214", "comment": "Malware payload", "value": "e0bd52a0799be69814914ca9aedceb23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738107, "uuid": "802a18ca-662d-4dab-a58f-e186aa1c8564", "comment": "Malware payload", "value": "9b088483e38566226df82d4a75b3aae9e661632f4db82432162d1c6418620a3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738107, "uuid": "4564196c-e477-4b28-9e51-a6a08f28f244", "comment": "Malware payload", "value": "511506c50f9893cdc6d1d3b721bdea27dbbccbbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738107, "uuid": "3b976b1c-0d34-430e-9edc-f88f35d65477", "comment": "Malware payload", "value": "4b6a8e56e9498c3e578b15b5e8d989cee5803c9907f1efa48b5f3f6d93caab9586283cf57e9db6f7478e76fe2ead1d52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738107, "uuid": "52edf8c4-ba73-4276-bc38-b13a55861833", "value": "T105E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738107, "uuid": "778ba8d6-464b-4940-b35e-2d5a448732ce", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738107, "uuid": "bda88d40-7a94-46e8-9aa5-93af5f00781a", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XNsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWNa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738107, "uuid": "c4cc03c3-1b42-4891-a44e-863c3de50db4", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738107, "uuid": "f5468767-86ac-4615-a6d8-0fcccc9eb049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738107, "uuid": "b1e6bd04-e16f-401a-b7b0-6a8af7370963", "value": "e0bd52a0799be69814914ca9aedceb23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d580030-9511-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645666342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666342, "uuid": "5a553c6d-13e0-4ea0-97a4-8a01960850d4", "comment": "Malware payload (Heodo)", "value": "ac3e9a83a314803191ca6f294d184068", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666342, "uuid": "1af7b5e0-e539-4661-941a-17cc14eaa9e2", "comment": "Malware payload (Heodo)", "value": "9b1b799809900c47d2c8f9a45547de201b86369d2e62cbf96e7cb23a318da916", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666342, "uuid": "ba9df6bf-92b8-430d-80ae-b1313af421c7", "comment": "Malware payload (Heodo)", "value": "7c7d668463998532130069216df2e6a0ee24c07b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666342, "uuid": "d2f522f5-62f4-4fec-a0c3-275ea24b8a66", "comment": "Malware payload (Heodo)", "value": "5501d069f5d6ad7c7984aa822280d9695925d555e23527a207d0e1dd6f1ec847cb70fa0754de1ab308c44f7e8390a6a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666342, "uuid": "2f329f91-2c13-4032-b0c0-9716f1d79cba", "value": "T11FE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666342, "uuid": "4f1a27aa-0db8-4779-bb39-cb7034db4f61", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666342, "uuid": "681d7a92-3c3c-48fb-bfa3-f46b7a4d31ff", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKbe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKbLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645666342, "uuid": "c5ac1831-7dc9-4b25-a3a8-f51c28bd457c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645666342, "uuid": "ca826a17-b754-445d-89ce-89e6aab68c10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666342, "uuid": "9f676c13-cbe1-4c4e-9af4-33f532acf3eb", "value": "ac3e9a83a314803191ca6f294d184068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b78401-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645723432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723432, "uuid": "f18633ac-648f-4ad5-8f91-87b7fb5058fa", "comment": "Malware payload (AgentTesla)", "value": "ed6e0eb9c8cff7ba8af61ed23a2f6787", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723432, "uuid": "ed0cd7fb-6f9c-49ee-bf83-b0d2fe60bd6f", "comment": "Malware payload (AgentTesla)", "value": "9b293ea93f6d5b87f879878e6eb5f0f81ca84f82f2154810f92cb42886e4091b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723432, "uuid": "613d9f98-8de2-41e9-82d6-9e1c381da291", "comment": "Malware payload (AgentTesla)", "value": "24fe24ea27c7b989b407e0a59784ed1ccc94f99a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723432, "uuid": "542707bf-8b45-4cf9-9beb-50cff24ac96b", "comment": "Malware payload (AgentTesla)", "value": "128fe1a7aa268aa1ef3e8384aec1afbfbabc6774a838b4a1d063388e46ee274a126f6162988670329f948a307cb04194", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723432, "uuid": "213b03c4-14d3-42fa-9304-ea96a749469f", "value": "T1F9C47E57F7DBF6B0E6BE827A86F1851C52B774620260A78F664072886D23392453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723432, "uuid": "6efe529b-0706-4cb0-b9ac-0028c7598436", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723432, "uuid": "afa4073e-4f0f-4dc5-a281-041d6a9b205b", "value": "12288:kn/zDvGHAykH8vLW/4+8bzbBSreMdZBY4ZyrE7K3yl8PeVooA/AB2LEJZEAQPUqj:GzbGHAzHKjX1OBY4ZyrE7K3yl8PeVooo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723432, "uuid": "a170c5ee-aea9-4b6c-bf5a-a22d18987e1f", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723432, "uuid": "a2425702-bd6e-4005-a713-cbb603b64765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723432, "uuid": "4596c635-4c5f-44d2-b0b3-d9105e4afd24", "value": "Quotes.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8641ae4-954e-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645692614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692614, "uuid": "26d7cf29-a7a5-4468-9d30-5ae984bc867b", "comment": "Malware payload (Loki)", "value": "99f494296a64b7bc9e213064a87885be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692614, "uuid": "0f5bbe77-d42e-4384-9f98-6faf645560d1", "comment": "Malware payload (Loki)", "value": "9b32c7bab515a968de59b05494701600fb0fac369e11169297713dc30b552491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692614, "uuid": "e479e5ac-8251-44ac-818c-98cbd632b729", "comment": "Malware payload (Loki)", "value": "4e5f02e01f80a5eee34ada347a7daafe7093070d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692614, "uuid": "77c819d8-309d-407a-886b-6d90afdcbd57", "comment": "Malware payload (Loki)", "value": "6a8848be30e3835b9c3f9599196f5cbba75ed0f8568e3d4e24c431165f8d0284099e9865a4239df4c4614b0ed56f4f7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692614, "uuid": "1b24248f-eaf0-4dff-807f-26b41118179a", "value": "T140F4AD1024AF26CEF1369BFE5DC8A9B18ABAF53A3519F2B91C814EC70751B41DD41A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692614, "uuid": "8e9617db-728a-4324-9070-9a5f01918d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692614, "uuid": "21112fda-c0e3-4b0b-8658-165b10f370ac", "value": "12288:J0pTxEJgYYz0AaqRVKLk8YIglYRZ2rq+ICXdB2byF4H+dsdDImKApAG:S97VKLk8YIglYR+IC322F4H+dsdsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692614, "uuid": "bd36e21f-5ca7-46cd-8612-8c05a6749338", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692614, "uuid": "a0f13ec5-9f06-4312-8811-4f5859a526ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692614, "uuid": "e279c5da-42b9-4528-86ed-7f018638f725", "value": "PO 038964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0f120f-954c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645691575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691575, "uuid": "71e0b0b6-3412-40f7-b15d-3dc778cf8d8f", "comment": "Malware payload (Heodo)", "value": "520d017de864aad0664902541f0b6b4a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691575, "uuid": "b5693af2-ad23-4b4f-8d6e-e2dc35db8a71", "comment": "Malware payload (Heodo)", "value": "9b69585acef667cbf30e6a481964ca9c64b2eccaa30df10b19c36907ca304d60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691575, "uuid": "c1a320a6-74f9-4d9a-b12f-1df4c84fd052", "comment": "Malware payload (Heodo)", "value": "1f305656c2193402214eadbafa5bb0103d832d06", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691575, "uuid": "c1ed5806-5068-4df6-aa8d-fbdd3445a873", "comment": "Malware payload (Heodo)", "value": "f6b9f430b766aa544bd1355aa2780be20fa0849684a0f09e766df8967585e946138bc177a517e287429c24af12bf64cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691575, "uuid": "aff3cf61-abf1-47b5-90fa-9747dd19889e", "value": "T189E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691575, "uuid": "f4b96c7a-4e15-4b60-9923-19f1bee93847", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691575, "uuid": "f5f40429-2fa5-452f-967c-561c959eaf5a", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0JhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfTPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691575, "uuid": "df996fc2-7bd5-402a-abb9-aa0f114e9960", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691575, "uuid": "e9e7f39b-034b-4947-b3e6-d0c599b82ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691575, "uuid": "4ccdc688-d76c-4b44-a558-6e1fe5abfcc8", "value": "N92qCn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00124efb-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "04346120-65ae-446f-9255-03e1a8caa5ce", "comment": "Malware payload", "value": "9b2fde3b8fb9dbc4d6f84d0142d49ddc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "7acbb93d-de98-48b5-a408-044ddda60bee", "comment": "Malware payload", "value": "9b8095af601ae3cf43a1c267bb0a076cba55e24fee1d7d8f7d0bb50340f5ab24", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "e9671ca1-e915-4da6-921f-230162d45d83", "comment": "Malware payload", "value": "8a55cc85fbadf33160a7b610736645028c0714dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738663, "uuid": "e4e91473-cc52-4b32-870d-099d91a2220e", "comment": "Malware payload", "value": "969b292af6d8f1e8ad76b9dc5f5a9edf20906debe43568d2ad11dda98fe382e58d0c23f5e671ddeabfe13234828dc6e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "3546233b-7c28-4c20-b7bf-371688819e04", "value": "T19035BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "9a0a2e80-fe6e-404f-9ae7-93cbeced80a3", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "0dc2113b-3f41-42c3-a667-1981c51039a3", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+usVOe528JO6PC:6iRGcUY0UvDYNFtuw5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738663, "uuid": "8ca65203-a886-46d2-b572-7b0f816c4ef0", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738663, "uuid": "b313b359-d204-4d5f-b6df-b22b23002212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738663, "uuid": "31e2ab2a-a549-478d-b39d-4a137110c603", "value": "emotet_exe_e4_9b8095af601ae3cf43a1c267bb0a076cba55e24fee1d7d8f7d0bb50340f5ab24_2022-02-24__213736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d18caa-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694354, "uuid": "f58904b0-ec24-4420-b8fd-4924bb417d09", "comment": "Malware payload (Heodo)", "value": "bba349083e4348490aafe69b7a10b884", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694354, "uuid": "48d0f9ee-51eb-4e4e-8b72-bc061f4acf40", "comment": "Malware payload (Heodo)", "value": "9c2551aba362a33a97a82d5073b2e520454371798448b05db96257021ef87d19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694354, "uuid": "2bbc3b8d-6b82-4a23-a9be-4539daf1b974", "comment": "Malware payload (Heodo)", "value": "cb65266eb6137bcfb645a2043ffc6865f222cd3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694354, "uuid": "f9fa673c-d603-4ed9-83d9-79b0d73f5b80", "comment": "Malware payload (Heodo)", "value": "b2795105c676611520abf9572e102b7f238e2a190baae77d79ec5afbadc38ac5a2062524ebcf94733f09d54ed2435567", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694354, "uuid": "fd0ea2db-d5fd-4002-b3b7-8ec4e93b4baf", "value": "T135E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694354, "uuid": "ec6638d7-1500-48bf-bdaa-fde0e776bf23", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694354, "uuid": "170df898-26e0-4cfa-8ae9-01abff6fb028", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0uhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfaPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694354, "uuid": "f52c6406-07b6-4e4b-be7f-6291bc1eb028", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694354, "uuid": "b0acf985-4088-40a8-8fe5-96a2bb924b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694354, "uuid": "92b0a7f5-dd32-4280-8577-ecb6d3b12cd5", "value": "bba349083e4348490aafe69b7a10b884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39047f46-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645723297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723297, "uuid": "49a6c5f4-dcbd-41fb-a2d3-a5f3af5b3a6f", "comment": "Malware payload (Formbook)", "value": "614ef4d60431a91a13e85658f86eb41c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723297, "uuid": "2ad69f77-0e5c-4366-95af-f22a7dacea8a", "comment": "Malware payload (Formbook)", "value": "9c36346fac1e994da13d21f02fbba1503fdfdd4bc7b6c2d0459923e73d0e77b6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723297, "uuid": "843d1bf8-5b6a-4304-b53b-e49ee5852156", "comment": "Malware payload (Formbook)", "value": "57e60a7ea0ef16320bcb1d2e575a38f7bf0537be", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723297, "uuid": "95ded095-9a7f-41ae-b704-bba658e2080b", "comment": "Malware payload (Formbook)", "value": "ec062fb4794153e7bcbcfbe6a9f4e20e9058de9c0d4a81eb17941b5a888c40a422f3aede01a4d00341dc58f375fab08a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723297, "uuid": "2f191abb-e028-48ac-bd9e-619c68b95a72", "value": "T121141234775D401AC65A3E71A87C500DC683DEA4DC36A6EF2C1A799B3EF262166E3C13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723297, "uuid": "65f819e7-fae3-487d-aae1-02909f70aad6", "value": "3072:XpW9D4aNvvCLs/+MXUTBF2kellag884bxhnlfa2Cqiv38fTgoKAe4bNQC:uD4aNyQJUNql3t4Fh/CvMfC45t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723297, "uuid": "8aa1288e-b435-42a7-a1aa-0e8de6c270f7", "value": 191096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723297, "uuid": "e484fa40-0b2f-420f-bf4a-b7adaf963ed2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723297, "uuid": "557b2ab3-8cda-4a6b-9aa9-ffc7b7aebbe0", "value": "Documents AWB 8032697940.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105f9e99-9546-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645688869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688869, "uuid": "74586a99-d7c6-450a-b7ee-9289a3bc01d3", "comment": "Malware payload (Formbook)", "value": "0e6739d4bc0cb0b89f7c10c02807443d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688869, "uuid": "ceea6594-73b0-4389-b5d4-4450e2317383", "comment": "Malware payload (Formbook)", "value": "9c45d9b25496c419bacd25bd90900e38320af4797633fdd9ea942633bc69c254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688869, "uuid": "3130c0ff-fbce-43a2-840d-76e873803f5c", "comment": "Malware payload (Formbook)", "value": "2e236e93e5b6777d9772bfc0b3b2e452fbe85321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688869, "uuid": "c169503f-0895-4bd7-9754-d7cc59d95123", "comment": "Malware payload (Formbook)", "value": "cfbee033c7b288609653b34caf9022cc19b2afe70a3eacc59952aca6511abc1babc40336d4c76b2ae8679745e1f95e40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688869, "uuid": "b921eda4-9995-4171-8bea-2e1c3414da39", "value": "T1326412F3B9E168B7F4451635A27BAA2EC77FF7051A37612F87395E2A911108320872C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688869, "uuid": "ac4aef80-01f9-4148-99bb-8b76c1834539", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688869, "uuid": "fe01bc35-9506-4fe3-9f47-7d06b67719b3", "value": "6144:TxD0lqJ0BZx/8GH/QD/AQsanbYcY3yXhpU1/u9370T6NglsoUi:eaYN8KQD/AQs4beyxpU1mzisoUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688869, "uuid": "cc8d1117-4193-4331-b98e-71125f4e350f", "value": 325116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688869, "uuid": "907264cb-482e-42a6-8992-91ff22bfad84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688869, "uuid": "a7c11121-3e3e-495c-93fc-8e81c8f970bd", "value": "Order-EM83196573-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d35244-953e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645685743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685743, "uuid": "a426d526-e4dd-4282-9736-edb2e9b44c40", "comment": "Malware payload (Mirai)", "value": "b29e6e38b9c6dfab6544eceda9e4d4d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685743, "uuid": "11fe1aa1-a41d-457e-9b3a-e2e1b26c858d", "comment": "Malware payload (Mirai)", "value": "9c4a4be10ad59a2b8bf1c2a38e50612e79805360e2229feeabf5b6b0b26e230e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685743, "uuid": "d7b8b92b-c573-4da7-a2ca-c5bddfa69d56", "comment": "Malware payload (Mirai)", "value": "96fad12cb5dbb5552fa94ee94bdb71c2d96a152f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685743, "uuid": "08538268-93a5-4189-8b7c-0362451b763a", "comment": "Malware payload (Mirai)", "value": "8c4d53fcf50ffe600f814f4fcfe522a161e388ebf2dcee951602331babdb19d774a9f73cd53b2c7804ab9b2c1b932bc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685743, "uuid": "582cbdcb-c9b7-40fd-836b-afa2f20f4a3a", "value": "T1DC839E61C4B9ADD4C9520B357698993A0323F40065A72DFAFA819F1E9087EDCF45A3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685743, "uuid": "41fae5a9-804f-4df9-95bb-8302c09ff3d3", "value": "1536:z/X/PKLzaEjrXdrPoZ6jVVdpkA5IB9x/8vQVZDYg55pPCWoz2v8W:zP6/xXlVdpfO9xkvC5Yg55pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685743, "uuid": "2d71ea86-87bc-4808-9e9c-2db5f57a6ff8", "value": 87044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685743, "uuid": "7de06a8f-a784-499f-8ac7-f263cd8c4e7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685743, "uuid": "adb36dcd-cdb6-4b42-9abd-f29fda1ed242", "value": "b29e6e38b9c6dfab6544eceda9e4d4d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfb51ca-9536-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645682339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682339, "uuid": "25759185-5bb1-4376-ab55-cd4ae0336fd4", "comment": "Malware payload (AgentTesla)", "value": "ddb29c3943a7d8a52c43057ee33a86fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682339, "uuid": "b4e886c9-249e-4d58-87a8-86919f8f0a34", "comment": "Malware payload (AgentTesla)", "value": "9ceafb8d73c24122a9ae0b2a91f5edd02bedfc34767c8e3f7136674f005b6238", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682339, "uuid": "2d7b3f46-fe60-435f-8098-1d630fbf4de5", "comment": "Malware payload (AgentTesla)", "value": "9c42f385aafe88009ff39ba83e86cdb068e74747", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682339, "uuid": "ca967096-1b60-45d1-87e1-b01e47524ed2", "comment": "Malware payload (AgentTesla)", "value": "8495908577e14c70feda16f6b3a3a855a56694a55abbc6e6ee52b62129572b1ce816d661b8ef323737dc4e461594c83e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682339, "uuid": "c8f1bbce-81ca-4018-9f46-855227a9823a", "value": "T1CF05CF1439AB70CDF063DAFE9DD8EDF1DD6AF13A220E35BA20460F564B49941DE12632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682339, "uuid": "7b993742-615e-44c2-9671-4140970c3ab7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682339, "uuid": "9e08896f-7862-4066-a035-1da3b438f9cf", "value": "12288:mK+cDzOpSfVovdmtcLwLcsKLZKuSrgAA92XEHJwfQ+Y95azVlQ5cXHQSBiEJfYZB:mIvOUovotc5tKtaYEHJw85aBlcl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682339, "uuid": "fc0243f5-645a-4d02-b69e-81ba04faceae", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682339, "uuid": "9e809e9c-557b-4d3a-8008-5264f8daca0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682339, "uuid": "7940758f-e790-4b6f-9152-c095754cf842", "value": "PO PR-21419889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176a2396-95c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645744286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744286, "uuid": "5e636e14-a4e2-4dfd-b17a-eabbca599b7f", "comment": "Malware payload", "value": "d80418381cd99b1ca4dc8b46a06ef5ea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744286, "uuid": "229b3c7d-7c38-4c57-91b0-c47db5e0ed2e", "comment": "Malware payload", "value": "9d14919dcced4b1c81f5d27510020b1061862350ab3bf7414aa6ed6f4f59c50a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744286, "uuid": "a2cf5b6a-5cb5-488a-80d6-7283a005e7a4", "comment": "Malware payload", "value": "2250eccc27ce59daef1e2338a65479269c39b62d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744286, "uuid": "a03b7e04-cfc5-4124-a58f-fc90c370be64", "comment": "Malware payload", "value": "361c3ce84e5050ccf981c011d8c4045722ecf4bf128c24defa26194e6b407743e6af0d8a148a0c73547c98e8ca5e38ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744286, "uuid": "45a0eebb-2726-450e-9e0c-65a1b7b20d4c", "value": "T11A14A4434D494B97D11C83F4BD5B4EAC2F4A6B1CE8C6BAFB05661FDA3E652160C8D02E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744286, "uuid": "335b1386-fd85-417a-b355-36bbb6263448", "value": "3072:BUjWNX3hRqo2wDtStV6ofIWPQZzzjqlHsgGgYGfnKFUw/:B6WVxwoNDtiMofIrZfqeFP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645744286, "uuid": "3a82571b-4cda-4d20-9c33-6e1edf5a9a44", "value": 195257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645744286, "uuid": "b4db8ffa-305f-4307-969a-2c4da7ecd69e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744286, "uuid": "c9da70fe-e6cb-48f9-831b-c8e00c8ced15", "value": "D\u00e9tails_56.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdd89da-959d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645726235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726235, "uuid": "c4f1a140-d1c4-46fa-816f-b744d9485382", "comment": "Malware payload", "value": "f4219fc4c5091b4d333c34aa5174babc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726235, "uuid": "d690d189-ed03-4544-bede-b1dba3d8eb3f", "comment": "Malware payload", "value": "9d38b479594e3d84fa98e70b11599a3f652916a917f9496f0b4d1dfbb03ebe94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726235, "uuid": "deb1175d-7fcf-48ef-acfc-5cef9f623773", "comment": "Malware payload", "value": "b3222f744ac4c689c52695c3c7cb9cc85e82e638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726235, "uuid": "b28c62f4-fb2d-4872-8456-607d6ced202b", "comment": "Malware payload", "value": "ccd9b5d132302d32a8d759a24b370a7eba6d2044a13930ea9662de12c5a18a7be368fd2460e8f66141a7fec820d94566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726235, "uuid": "723be00a-8d25-40be-8236-c0182e43c503", "value": "T170E533851F7F4E07FA85FC38E124B731BCA1C6391267D3E17585AADE3E0770180966AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726235, "uuid": "e7ce97b7-d50a-4825-93e8-8d5fbb003d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726235, "uuid": "62d80cf1-85ae-48bd-91cf-ebd14d1b438d", "value": "49152:BLC52ynFoDY891Ewi+DvWejYyuDpOAA7AaAdeIE7fbCKxhDJ+gPQTUidq0iU:pinn0Ysi+50JDplkpLfOeJ+gooir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726235, "uuid": "296d2e88-0bb5-4cd7-9ba4-1a591f4a1a6e", "value": 3218944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726235, "uuid": "987f9e25-ebd1-4183-8013-1a2e895c6791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726235, "uuid": "23f57b05-97b6-4a6e-960a-9a31abd1c77b", "value": "f4219fc4c5091b4d333c34aa5174babc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1442296e-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "fdaf5dc4-0941-409b-b1a2-a87e1efe3e44", "comment": "Malware payload (Heodo)", "value": "247f6bf08a08d7e3330102892cd5a1f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "5371eb54-88c8-4c38-8193-7bf2fd9585de", "comment": "Malware payload (Heodo)", "value": "9e3e8a3539a19ad24249194ce92c2d1efd130f383cc595c0ae9b6e934d93c974", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "4ef9b2a2-ddc7-4bd3-8cf9-1dba95f92360", "comment": "Malware payload (Heodo)", "value": "e565d204ff3850de39fd462dac8c0c5aefc867eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "013a0c11-7cf6-456c-8863-f404b749c613", "comment": "Malware payload (Heodo)", "value": "9ff2fec2042cc1053932ce873453300d91d6b8666070d5919400fd77755dae5ee1eb31994d56668013a9468780fbfa1c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "c8dcb500-271b-4692-bf29-a8ad0164e5ae", "value": "T1E4E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "81e8d8ba-c7d6-4281-92b9-f84b99a7afa6", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "6f573331-fbe0-4bb1-85b1-dabc1b8dcfc7", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XzsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWza1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697895, "uuid": "b7d34d41-42e4-4d17-9b81-3abaf5707f11", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697895, "uuid": "1c1d0046-0759-4f1c-92f3-66388c099d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "dbeeecd2-c61d-4ba4-bc92-2b412c9aff9a", "value": "emotet_exe_e5_9e3e8a3539a19ad24249194ce92c2d1efd130f383cc595c0ae9b6e934d93c974_2022-02-24__101810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24674cb3-9596-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645723263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723263, "uuid": "6ef87113-95b2-48df-b7a4-a06fbe7c2c6c", "comment": "Malware payload", "value": "4d92fec8f1e5112b5f5c3dfe6c8fbffb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723263, "uuid": "3cb1a987-7812-4862-8a83-7abc51125afa", "comment": "Malware payload", "value": "9e6ba4b20781a97961952afe9985271e0c277c41ccf1161061a5bb11154881d2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723263, "uuid": "cf610ccd-a431-4cb5-8abe-f80a220f6473", "comment": "Malware payload", "value": "14b9d0f05c090156456b6f0080065c8f29e6800d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723263, "uuid": "246e4bb4-8a9b-48de-8f1e-827e6764a041", "comment": "Malware payload", "value": "0cb11bd584db25fbab9f6d3c20edfe854bcad99961c4b6d994c6f94b36939c58ab6e1df418b47b91d33818e83625e396", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723263, "uuid": "5b1d0b6e-2299-47a7-a3d7-88b9f47f460d", "value": "T1205444A0682F0972E748AE1E50E1704A1DF6FEEAB0C19731639FA564DFD46F18EC0857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723263, "uuid": "bd9a309c-99d5-4090-a61f-3891b7ee56f4", "value": "3072:iLe9uXcR06QRQe9uXcR06QRQe9uXcR06QRQe9uXcRhlnJwdzFtr5RDAw5wfQ:IadzFt1RDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723263, "uuid": "f6529798-7b5e-4c96-aa29-b0facaab68c6", "value": 289160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723263, "uuid": "d0391a6b-1ee1-4c98-aaf0-6babf618de82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723263, "uuid": "b8b9b252-bfc6-4b28-8e7b-a060b0fff217", "value": "JOB-in.line e.K. - Purchase Order - Request for Quotation 57780887.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43c7f8b-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729087, "uuid": "b6a5e604-35eb-46e8-b102-dd8ef89c787e", "comment": "Malware payload", "value": "7aee37ace491906933af573afaa6e1d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729087, "uuid": "1f5c0da6-98f2-4fe5-801b-6e6281e0d36f", "comment": "Malware payload", "value": "9e986640add85898682bd60fbce67445eeaa363f04683991ce067c73fd1e0f0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729087, "uuid": "90bf5190-cb5f-482d-88e2-1fe61b2a4fa3", "comment": "Malware payload", "value": "5f01bfd5d6c4ec0e41491b14d0b3649a279e41fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729087, "uuid": "5f594638-a3eb-4f70-9564-a3490f83220a", "comment": "Malware payload", "value": "1f492606cc2c50ffed0e18f19e123a7a4f99dbb1b327e80128eb7feb96d5d95f035bb856eb65d51623839402077df210", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729087, "uuid": "1cb58ae5-81c7-4d64-ae1b-02775b41d8cf", "value": "T11FF4230D144A4725C6FC8F7D82B80E2D5B71526E7286D6A76E8D27ED9C977883210EF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729087, "uuid": "048e47f7-d426-4e71-9155-2c79fb7e58af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729087, "uuid": "189d736a-0a4f-41f2-ba9f-f1d38b556faa", "value": "24576:xPcDsB6AVWKRuayK2PIuC0fFHtivXhIH/HajCdBHJYpBt:i+6AwAuiXstOXhIH/HajCdBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729087, "uuid": "13d0fb7a-5783-4ccc-a338-4354b1b39cb0", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729087, "uuid": "0e29774f-ea3d-4f3e-991a-4f8117fbac2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729087, "uuid": "de1d503d-d02a-4bcc-9508-71d67df98189", "value": "7aee37ace491906933af573afaa6e1d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c1fcc7-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645682439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682439, "uuid": "183b846a-c4fb-4e3b-a625-f132a36fe90c", "comment": "Malware payload (AgentTesla)", "value": "2023551044af4b5ff2cb60a0fa239154", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682439, "uuid": "7fe861d9-8f3a-4ef1-9eb0-3d45322de318", "comment": "Malware payload (AgentTesla)", "value": "9f843bd3e6656eb8f6c60aa4bb8bd46cc151657fd27c5a121b22e64148867894", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682439, "uuid": "034c176d-2b0a-4f62-99fd-7bf3be4cf72d", "comment": "Malware payload (AgentTesla)", "value": "88f8cf9cbee0c405a2a0aa91141e94b379646cc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682439, "uuid": "0381f4a6-3967-4213-816e-b156fc1b9e2a", "comment": "Malware payload (AgentTesla)", "value": "290258eb32baa36112597553c629ae7c1081bec5b6429c9f09a53bc4f960e10fc4617a473c28c65d7debabcce84c6d83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682439, "uuid": "7066d46a-8b55-460e-b95a-73b887589dcd", "value": "T16105CF1034AB20DEF023DEFE9DD8EEB1DD6AF53A260E71BA20460F564B45941DE12672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682439, "uuid": "ee5f9a6a-e1cf-47d1-b6d7-8c5ee77e0f37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682439, "uuid": "46c32197-597a-43ff-958c-ab4c810bac83", "value": "12288:daFWVc5XABR7GZkIrVn+kSlyJMibazyQ4XwjRS4sLk5uh25ElzJGkA+9v1l2pHrN:HcCBR7qLSlyKIxfXOtsmT52sq9v1iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682439, "uuid": "9a1a22b0-fcb7-4dbe-925f-40966135ea11", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682439, "uuid": "c9f3b8d3-8c88-48c4-893f-7b7cef20a804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682439, "uuid": "b5bff40f-0e5b-47c6-bc5f-937864b2e0a9", "value": "PRODUCT CTG ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eebfbf5-9542-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645687310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687310, "uuid": "c236f4bd-21fe-446c-a86d-ac540c3cc17f", "comment": "Malware payload", "value": "266c12f067dcb5e5e36658d152029b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687310, "uuid": "52386991-5900-4c26-ab02-2cb615d04e23", "comment": "Malware payload", "value": "9fcd071f437b5db8ba6df1902a41a9b226f5fb644bb83056138415f36b2abcff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687310, "uuid": "291e65c2-40e8-48bb-8c15-be23e576f416", "comment": "Malware payload", "value": "6c9a9e1543b7279dd87a365b21580990846035e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687310, "uuid": "b483eb86-4eee-4e93-bb3d-210bca3af4b9", "comment": "Malware payload", "value": "f3862da7282b4b65bf90729c4b0f838aa9e55c7f7155a847ede6627ca013fafc68b550d14358e9be3360653da8037ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687310, "uuid": "e990558b-5649-4702-8d96-703e8634a6d4", "value": "T1EBE412E03980D479C04176309826EEE1456FFD71CDA00B8636B83B9E6F376D66B6960F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687310, "uuid": "48e324d1-d430-41f3-abb7-412ee0f8436e", "value": "917b0dc587f632b60bbe39ab8c418265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687310, "uuid": "897ddca8-8409-458c-b976-d118eefa6424", "value": "12288:cdKPTRsMHA9/xuGa48qLvSjAGD5H+ng7x6iWRaCYfc0Lm5I6jGysG7klRE:cdOTRsMg9/7j8qLvSjTVCk8ICYU0Ld6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687310, "uuid": "7b0ce27d-e6c2-433a-9ec0-b859e2cea963", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687310, "uuid": "ad9e481b-6eaa-41b2-8898-d1c43ff1ffdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687310, "uuid": "b0e15df9-dda7-4c03-b5c5-f8c79ba46fae", "value": "rolle2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee54190-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645723226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723226, "uuid": "0ff904bc-8ec0-45ec-b463-e8031e082f3c", "comment": "Malware payload (Formbook)", "value": "eb82c58ce606dfbdb9fdeca9cae65e03", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723226, "uuid": "51644204-02e9-4c4a-9cd2-b7080a5c6612", "comment": "Malware payload (Formbook)", "value": "9fd9d8c7e1d18213283d679e98f24ad0475973ee2e0c013a894d087f4b3ae2e2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723226, "uuid": "879756ab-cccd-40cf-9fd1-e577eb4b1f60", "comment": "Malware payload (Formbook)", "value": "e8b5300c294cd0f01a5ebc7a5184d661d513be49", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723226, "uuid": "9dbdd67c-e856-4c51-8361-6e1b33688f39", "comment": "Malware payload (Formbook)", "value": "26cb46b6c4d7c62df3d08361d04879ce80058619276534ded631af45eda0a54d8b61057a2ad9d5a6072e11aa80507aa9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723226, "uuid": "ca517db4-5889-45e8-b2bf-a8879d844df2", "value": "T12014020239DCA79CE4F61BBA68C1C0DC6CD3EC3574126886375CF9BA683B97A8D5056C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723226, "uuid": "6c8c9fbd-2784-4216-b265-15edc50d3a15", "value": "3072:3+quyJAYxlzsOezg7WV7Dkc05s3/PHt55aVZofoI4IAxLUskxCjEbWXj7z:ruyJxlzsDIc0W3t55Lfo3IAx3kWz7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723226, "uuid": "6d9937ce-b227-4776-acdb-029a489ca566", "value": 191160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723226, "uuid": "1d9b7842-6c50-41b1-aa67-c24947331074", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723226, "uuid": "860c11a4-8d52-4e34-9d47-b44f5d0b477e", "value": "Remittance_3239934.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b54d8a-953d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645685390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685390, "uuid": "0288fb3b-2297-47b5-9c8c-4f6b8909c11c", "comment": "Malware payload", "value": "7a92658d837f0d97a5854589f457a04e", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685390, "uuid": "43324f3d-de67-4b43-8033-f162f53c3e16", "comment": "Malware payload", "value": "a01774399ef3f471a08f444747251c771e3592640bd2a53ebd0f3fd6980eed23", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685390, "uuid": "2961e00a-118a-48b5-b291-7115b858e15a", "comment": "Malware payload", "value": "e89b65243dd5ef9b9221c65c84abaf945ba69472", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685390, "uuid": "0957628c-3c3f-4bde-aefa-6a248a62edb8", "comment": "Malware payload", "value": "0c9008d928e82a66a515c4af1c671445bdfac68eccd05f70dcb28a5380e1abf17f8ace05b547f969faceac5b4c1e201a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685390, "uuid": "1c5a18b6-397c-4a7c-9aa2-8ff2bcfd5e9b", "value": "T14AF0A3A4C11E3B65D8E64139C89BCF25475CB50D074A5160A21A55C6377C9016A434C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685390, "uuid": "9f3a0976-2d8e-414e-bfc6-e7b2f6865723", "value": "12:8rfl3OB+9LAPpdzW+HralFxsYtFx05on70PhGJ/:8H9LA/zW+mlnr42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685390, "uuid": "8e1eeab9-b3fe-403b-b653-1efbbd0a3754", "value": 516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685390, "uuid": "6c2f1870-475d-4835-9b92-462892a84136", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685390, "uuid": "a2f41c32-430e-4800-b26e-d9f6d8ab9020", "value": "3T241K53_704.91155959.745380.98145.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fd9649-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "522a3dd1-a807-4447-8a47-5fca8c925a4c", "comment": "Malware payload", "value": "147c7648bd0c08e6aa2b6b889878d068", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "38233ba8-e7e5-416d-9521-5478e0515a72", "comment": "Malware payload", "value": "a068440d6f87595836a5207de9d1b9585cbc867ba1066b9bb537a3be3105b8dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "cd2b850f-3452-4a01-9c48-881b0d0e8b83", "comment": "Malware payload", "value": "0734ced5f9539781891acc5ea917ee3966a3870e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "d40993e0-a5eb-4940-8ae1-ab6ddbcf0602", "comment": "Malware payload", "value": "b5536b2af556227c3fc63d66f265faf7c5e1c1117aef60e9753f6221c3145e91d4a8977ab352ce1742065dbb04ad61b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "4f812c8c-9d1d-479d-883d-0727b71df41f", "value": "T1B735BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "c4fce4a2-680b-4c2c-8be9-cf47a69fad2b", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "5cb23101-28c6-4948-b61d-e060f4961fa3", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uFVOe528JO6PC:6iRGcUY0UvDYNFtuX5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738719, "uuid": "f6dfcc23-85b7-480a-b6d1-d8797599dfc0", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738719, "uuid": "13482562-ae43-4d6b-b951-147417df8c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "87a1cb68-9821-4910-a461-e86c4c903526", "value": "emotet_exe_e5_a068440d6f87595836a5207de9d1b9585cbc867ba1066b9bb537a3be3105b8dd_2022-02-24__213828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3455db96-9591-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645721142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645721142, "uuid": "1e89d147-9f8c-41bc-a032-95efa4ca0c08", "comment": "Malware payload", "value": "3f94df9e22f2af2e9daa36fe415c770f", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645721142, "uuid": "cefb22d6-6b73-4f38-9bdd-3548244d45bf", "comment": "Malware payload", "value": "a071870c1c5f8c94eddcef52d2f509ebb3c31e198a4286563d10bbeea6bd7e22", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645721142, "uuid": "52645242-1692-400f-a203-653dca267b8d", "comment": "Malware payload", "value": "57e805f4c0a7a241c01e1b18be8806cb6e82cc01", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645721142, "uuid": "cd51be0b-57ff-4ae4-b6ae-ac87080ba718", "comment": "Malware payload", "value": "10ad50029084ee066aa18b7fd15637f24a998654f930865004c3990c6cd72f8fd7491ec9ab9ad34576e294c14852e486", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645721142, "uuid": "79d08403-aaeb-45e2-aa02-ed36ab7362fa", "value": "T19507195CA449E08C25A7DBC5F70AC8E5A35D53636AC84C7B799F0E820B03DADFA4B447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645721142, "uuid": "27b9a816-1aca-425a-8053-894dc5bf4f07", "value": "196608:O0Nv1BJ3CoS0ifIpqH1JU58up/q2ETFo4BjLM/8FY:Lv1BUHIq4ym0LtM/+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645721142, "uuid": "b055f29c-3aca-4a9a-8da6-9e1904caa6c1", "value": 17867852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645721142, "uuid": "fe067e5f-f0cc-4b46-bf13-286a728a1cbf", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645721142, "uuid": "d3a8b2e7-9721-4114-9aac-f41abd8a15ff", "value": "Dentons Neth Inv.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143e678d-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "f67609e6-8cc5-4cb4-b952-4e82d8630717", "comment": "Malware payload (Heodo)", "value": "b078ecec4d52d72efb945123c34fd951", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "4ba16819-087a-43f7-804b-0e00658becff", "comment": "Malware payload (Heodo)", "value": "a07e70b73644340d9c126074e0f720d89a3461087977ec18a6618bec8cc6d2c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "32f8353f-6337-4b29-86d6-cf7c51623d02", "comment": "Malware payload (Heodo)", "value": "9798b6f3d7482fbcddfa395841349c4f14a40fda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697895, "uuid": "2bfd3c93-a80e-4e8f-b8e6-2822c5790886", "comment": "Malware payload (Heodo)", "value": "3966edfc49781103f6835fab1950511512210b06dfe50acbf5fb7caa80e3b4d951872090d304b0eb87f3eec46a2cfa06", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "b00975eb-80a7-43f1-bdf2-0b33dddc4d21", "value": "T104E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "6abfc4d4-ce49-4f9f-a413-0303165e56fa", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "3542170e-7f3b-4cbb-8bc5-be2d4480c6c5", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XRsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWRa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697895, "uuid": "2c313321-8511-4779-bde4-8e0d3ab96cfb", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697895, "uuid": "dac38e90-6d00-428f-bc57-7d5d62fcd399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697895, "uuid": "da08f8f6-52f5-4ab2-8219-5cf1dcc4275b", "value": "emotet_exe_e5_a07e70b73644340d9c126074e0f720d89a3461087977ec18a6618bec8cc6d2c9_2022-02-24__101808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814cf72e-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645688200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688200, "uuid": "3aa2a6ed-ef7f-4d87-917d-0255f34f4bb2", "comment": "Malware payload (Smoke Loader)", "value": "28a3c0e8a29f760afc04e5ae0391acbc", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688200, "uuid": "45bdb000-2d2b-4b30-ad1c-581b31a45bbc", "comment": "Malware payload (Smoke Loader)", "value": "a0b2f8ae36583980dac6da6e75a488367f2d784e1dce5d6c9872a1636f25856c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688200, "uuid": "cbbf8cc8-9966-4340-8845-a04815a08ac5", "comment": "Malware payload (Smoke Loader)", "value": "a6d4ad4707362247774421dd0a24b93d37f5ea28", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688200, "uuid": "4591ea36-595e-4861-b811-75412222a459", "comment": "Malware payload (Smoke Loader)", "value": "e0cd40c7ab52929eae7f1cde7efe355f6355fba39dffabe9444fd3fe49bc6a2d51d2ca008d9e911f4e9a2cdf755d347a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688200, "uuid": "57b6c3d7-a985-472d-bc29-ee6e93bb2e9e", "value": "T1E544ACE07981D671C04B3630982ACFE01D6EBC62CE6059C372BA3F5E7A722D556B521F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688200, "uuid": "05d550dd-13e5-4072-b36a-0d64fe41b807", "value": "83a71afa38dc72d24820578696a17db4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688200, "uuid": "dd0834b8-8710-47da-ac7f-545e4e8a6465", "value": "3072:y7sN6hEJr4ka7p1H1mmC5GVggjcGkNIVqIOM/h35FfSeC3:Csmdt1Hsi7ITsqxwF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688200, "uuid": "0c8bec81-74c9-4bf4-a1e8-bdab08aaf064", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688200, "uuid": "c0b21849-10f8-44d4-b1d7-d0a5f38de350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688200, "uuid": "5449eb09-fcab-4aca-8c1a-6cc994c1626b", "value": "28a3c0e8a29f760afc04e5ae0391acbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2806b871-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687191, "uuid": "81671b87-f622-4500-bae1-5613f827221d", "comment": "Malware payload (Mirai)", "value": "6c3a4adaa64a3255a4399c9741f46552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687191, "uuid": "1c82f006-d395-4287-b952-0a34caeeb76a", "comment": "Malware payload (Mirai)", "value": "a1545fd0cf2e879405e55f4beff86fb28dd568dbe1f6cf3ada9c39af9c66f405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687191, "uuid": "efbb9643-3a7d-4160-bdda-b4a32ee4c062", "comment": "Malware payload (Mirai)", "value": "f683ab46c2199134d491a8833ecae69b933cbf67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687191, "uuid": "6265ae63-77e4-44c3-9438-3ab439ca2e8d", "comment": "Malware payload (Mirai)", "value": "c189345e2c799a3af50fb48224b494250c65d0aa293de30c3a56ded2e9411367997d5844a829f5345176eac706623d8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687191, "uuid": "612c8a2c-8a57-409c-b0b4-01d39a3b7c8f", "value": "T16103E2FDE0652ED1EF5E696272CCE8D2374A0F696FB14501B1CCD74286FAE4607086D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687191, "uuid": "0a393188-6430-46f6-a7aa-25b69f2cbdb8", "value": "768:nnxdRgawkoUh53ZKTsslNElJfIPy5gWwKK/3bJxRSh4uVcqgw09M:nxdRgawqxZkssl+CWwB/RA4u+qgw09M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687191, "uuid": "b8fe2e19-29da-4a06-8d6e-490fc01cb80d", "value": 39140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687191, "uuid": "d111eff5-a134-45b0-a572-21473da45b1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687191, "uuid": "fae190d6-c92c-47dc-8354-d5b07035141d", "value": "6c3a4adaa64a3255a4399c9741f46552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ef453a-9579-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645711056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711056, "uuid": "0a952240-54b8-4da3-9159-b238c549b075", "comment": "Malware payload", "value": "fd965589388f799c03f49cf467c61fd0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711056, "uuid": "bac378a9-6a39-4f5b-9fa5-284ed3e4341b", "comment": "Malware payload", "value": "a1708494e9baa7612fd8fd6728d8c8aa8fc9180e2e7b71fda12a68c5b1e101bd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711056, "uuid": "97692421-21e0-473b-9258-18f1c372361f", "comment": "Malware payload", "value": "a59b1adc316129ea3b4a0c6981367df7f9882c3e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711056, "uuid": "3e77d428-25b4-4c24-8f8d-05142e9842f4", "comment": "Malware payload", "value": "01407fcb096cfd56abcc79afc0a087900509f70069ecbfa4b4409cc3abdb9e07dcef4999f37c93d440c0232e41267207", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711056, "uuid": "b3a1e0e5-e410-4eac-bfd1-244f88c20ee3", "value": "T1032229BCD1AB86E8CF8AA2F865166E4911AC775CC3C8E09279FC67313787D5E810B474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711056, "uuid": "c66269e4-ccfd-4faa-a807-ebbaa386301d", "value": "192:rP1R2Yzbt1DUceMz/LnQOpnnLpmhkiSRItGV9VQyChcsTaircd2P:LvBt1D9VzDQWnnLshkiSItCOyicsGirf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711056, "uuid": "5d5adce6-b0cc-40fb-9144-60936721f7df", "value": 10167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711056, "uuid": "d177b7f6-8c99-4ae8-8019-7f7d163f7d2c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711056, "uuid": "53e0dca1-a8ce-4984-af51-2a8ffb6da144", "value": "Shanta Holding Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f198cc7d-9594-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645722748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722748, "uuid": "f57207f5-4c72-4f75-8758-d0b76e6922c3", "comment": "Malware payload (SnakeKeylogger)", "value": "d90981aeda500403495e6b794103a436", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722748, "uuid": "6dc616f9-7870-4593-940c-146973b587d1", "comment": "Malware payload (SnakeKeylogger)", "value": "a24aa12f9d336072fe3f80f015efa68f874e7222274bf5c7abdda26ec227e481", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722748, "uuid": "d16cb72e-fe31-40d0-9ffb-366b065a9726", "comment": "Malware payload (SnakeKeylogger)", "value": "8cacde40ced0fdb39707dfb6fad2dafaed688606", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722748, "uuid": "d40103f3-57d4-4793-aec3-891e26f2d9a0", "comment": "Malware payload (SnakeKeylogger)", "value": "a3e0d77256f10bd8db680772035544e8c84f2d18a7795410dd03028574105a7e3fa56bfbbc743bc18500a0668e53aa8b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722748, "uuid": "d469c201-0dfa-4475-adc6-52ac30fefd8d", "value": "T18CF4BE1024AF66CEF0768BFE1DD8A5B18BB9E53A3119F2BA1C810EC71751F419E11A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722748, "uuid": "988bef59-789b-4894-b0c7-58b362101e02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722748, "uuid": "b1254905-de01-4abf-bb0f-12a806b8b8a7", "value": "12288:vkgCEJgYYz0mnaBczhzGcKPS3MAH+doEttA/QKMy1cevXFW1:O9NnaD63z1gtw1tA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645722748, "uuid": "b4726c60-9c6c-4bce-a385-5cd8244c24c4", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645722748, "uuid": "9c3c2d45-dad6-4dec-971f-7ed598629a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722748, "uuid": "9dc17a42-d6a7-4ae6-a61d-1df99817ad88", "value": "Order021922.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cf2ce2-95c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645744310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744310, "uuid": "eb7147d8-213d-433b-98bb-ece5fb116a41", "comment": "Malware payload", "value": "813feb605e2f36ddefd911eb20a9b99d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744310, "uuid": "dd054bbd-1fe8-410f-be64-b4ccb6451f25", "comment": "Malware payload", "value": "a2c5b7b4f82ab866fcf7721b5391a3e06f4973bd37ac02a426ed71ed307813f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744310, "uuid": "643ae2d8-d6f3-41cd-9fe4-064706375751", "comment": "Malware payload", "value": "eefba175fc9af615cce932b0fe29139c2b13f527", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744310, "uuid": "edb95f70-46f4-4cc7-a3ec-2a3613f7b051", "comment": "Malware payload", "value": "850d3205417e69d29c8b8beec5abd1c337a6e6678327cf1a49dd76dca73595729ad1e4500cf007ac6c6377ae451b4568", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744310, "uuid": "1213b1a4-a969-42bf-b31c-cf565454d287", "value": "T188E4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744310, "uuid": "0ffc10a7-923f-467e-b44a-dcc8eeee342c", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744310, "uuid": "948f2ae7-f27f-4a70-92e5-2d8b741dd57a", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKYKDYjX3rUXY:ygHpbVy97v0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645744310, "uuid": "ed1499c5-e911-4ce6-8530-3b2f2be58e1f", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645744310, "uuid": "ec5620a8-a904-459d-99d8-e73f7e7328bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744310, "uuid": "d42d677f-244e-41a5-8c95-dede68c3893d", "value": "813feb605e2f36ddefd911eb20a9b99d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e92fc9c-9573-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1645708408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708408, "uuid": "4ad5dcc3-fe0e-45bb-a933-d7b46e2df139", "comment": "Malware payload (STRRAT)", "value": "4b4e19a710126290196df49a092686fb", "object_relation": "md5", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708408, "uuid": "d328a0e0-c01c-4b36-9340-b578803f78b7", "comment": "Malware payload (STRRAT)", "value": "a36323cc7633934af9b10f0c56841e483bb886836ca94fc52ce37ca3f0cfd190", "object_relation": "sha256", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708408, "uuid": "061cb58a-2545-4cad-930a-a11474676c88", "comment": "Malware payload (STRRAT)", "value": "288ba3994ed5fedb3b9d3e19a267bef073f02ba9", "object_relation": "sha1", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708408, "uuid": "2544a214-ccea-4f75-a37f-87347da25e15", "comment": "Malware payload (STRRAT)", "value": "eb4ada61c8ce33275667dccdae6710e192d1eb518248a53ae727e62066e7baad32cb3bb8e4864fd82c4554a088c2a290", "object_relation": "sha3-384", "Tag": [ { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708408, "uuid": "8fa4ee38-b731-4129-a765-6cf9fc1eb657", "value": "T1F6A3125270F426E79BB49042FB727DFDA8D823A1FF714E8C21068D18A696DEF6110C1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708408, "uuid": "067cf353-bbba-4604-98e7-0b0e1f9b698c", "value": "3072:mBIZfsJ/yfUw2P5mvyfICce7Cn7vehBzU2JmYh:XeJgUnx1we7Cn7mE2JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645708408, "uuid": "dae02482-495a-419f-9293-3744c119977c", "value": 104191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645708408, "uuid": "53f0a041-19bb-4cfd-805c-c7d7ea274377", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708408, "uuid": "d1124ee6-3997-4204-8c74-201d5d209dd6", "value": "4b4e19a710126290196df49a092686fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea5bd55-9529-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1645676518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645676518, "uuid": "131e17bc-0787-436f-8aef-aa4a7dcf9b78", "comment": "Malware payload (Pony)", "value": "533767fda14634cde9a494b6df3ad9f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645676518, "uuid": "8a6dc5a1-52ef-4a5b-96e1-e90a24cc2901", "comment": "Malware payload (Pony)", "value": "a3bc503e3bfa3d8fa08154a9fadd285b736d57f551285c73247f5651ebf736d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645676518, "uuid": "2908163c-3aad-4fbe-810c-cc725241f871", "comment": "Malware payload (Pony)", "value": "2df99be8a8d18e290944c80a43c9f4d9f93aaaa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645676518, "uuid": "9f4dadfc-7ca1-45a6-8d6a-420cfa393453", "comment": "Malware payload (Pony)", "value": "93cc4233b986d5b8e44d81ca86df5e495dd5dc8a0081eeac7557c2650d12298be57631d9d0bd02c1ff89cdd8581ee3af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645676518, "uuid": "11f40e5d-5cd1-4819-a959-284e386dc15a", "value": "T14E931903F480E0F1D1A22AB177C11771EBF99F6978768D4EEF8D89856DB22977B12042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645676518, "uuid": "196edef8-f8aa-465a-aac1-bea721593602", "value": "728afd0aeb7539a2a721ececf5f36865", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645676518, "uuid": "649c79ec-96df-4d2b-b930-ffde6fd3dc48", "value": "1536:x3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEIckzZ3:9dOy+ubiDBzv+1H4OgYEI/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645676518, "uuid": "8b95eaa8-9a75-4890-a66d-a2c924b3e33f", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645676518, "uuid": "162234bd-7fb6-4891-ad3a-a0b2f8b93624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645676518, "uuid": "8ca92254-64f2-4896-9688-e555c6a1b961", "value": "A3BC503E3BFA3D8FA08154A9FADD285B736D57F551285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89b14d4-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729148, "uuid": "f83627b3-d35d-4af8-8a1b-ea20867b7196", "comment": "Malware payload", "value": "21d818487a4b2cef438559218a6d38da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729148, "uuid": "a410d450-fa5a-4108-9b36-2c6110790d54", "comment": "Malware payload", "value": "a4e971296c415161c3e923e4b0410d0b96c16944a4a2887350024ff1b1a68a11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729148, "uuid": "65cbca00-b620-4eed-add5-91bed6dadffc", "comment": "Malware payload", "value": "1ddc57535ebe9a4498115f177d1fa3b056b59988", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729148, "uuid": "134de012-2481-4f63-9a7f-8469fa936acf", "comment": "Malware payload", "value": "e70fcd415a9f9bdd142345914d5c075f7f5d073da6f139e5f78e5e30e90756198df198cd8c43b924d2ad7beeecdd7d2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729148, "uuid": "74cc6ec8-8b8d-445c-9476-4fc1d1a4478e", "value": "T10264239AE9DCC0F3ED885471987B4E61F3BEA3472620124F63995F840C63647D815EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729148, "uuid": "3aa4cc56-21c9-46df-8f2c-9281c0dd64a2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729148, "uuid": "4c0eb9f7-7bb4-4f9e-8748-d1c74c6d5d60", "value": "6144:TxDcxbheB6/4E3Pjg9G8VvFdk0A3CrkhpqIvXkwJXc5rbJzSr+:24E7d2Nq0ASUpqIXcB9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729148, "uuid": "420e5f46-a060-469f-8dee-f54c3609064c", "value": 333467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729148, "uuid": "1fc13ea0-0250-4aa6-ab55-d6b87b753333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729148, "uuid": "f3b5cc8e-9800-4f5f-8f7e-261d06909524", "value": "21d818487a4b2cef438559218a6d38da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dedcbfa-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645661136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645661136, "uuid": "083aebc2-1ba1-41c5-84f2-4aef3f03628c", "comment": "Malware payload (Loki)", "value": "8add5f5ccdb2fdc850701d49373d03f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645661136, "uuid": "153ba278-2108-4f05-b942-8a42ad8664c2", "comment": "Malware payload (Loki)", "value": "a51857a171edb674895ee6ec8813aa5b3701c223b613f17d23b0fd01967be01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645661136, "uuid": "2151d7f3-f053-4e31-9c4a-e4f78abfe6ee", "comment": "Malware payload (Loki)", "value": "d3222e3be37dbe73580337f93f92aede42c2f25d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645661136, "uuid": "9530fa9c-e154-4768-9a14-285decea5559", "comment": "Malware payload (Loki)", "value": "87950e4bd95ce8a8b448c852438e8940137fe4750cc8effc57f3f59b39d7f7c63b600c5bc0f9bce61984697888df7ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645661136, "uuid": "81fb113c-3f57-40ea-ac56-129406211a1d", "value": "T125E4BE6038EF20DEF1239BFE9ED8E9F18D6AF13A261C75BA24851F474741900ED52276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645661136, "uuid": "fa428369-c496-418a-8ac9-4805a5da159a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645661136, "uuid": "dd52be63-0d94-401d-a458-c76fc9f2ef2a", "value": "12288:jEJgYYz0250Y7kQDqyHeHDSTF1Y1BRfm7uQbICUVVP8M+205hher:j9GY7JDAHWRy3RmWnVmM+2sTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645661136, "uuid": "683a6dbb-7fcc-4816-9ac0-95fd0347396d", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645661136, "uuid": "fa0fac1c-e9ec-4a90-b325-8d9c0cfe66ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645661136, "uuid": "61bcbb3a-7b84-4488-b9cf-299238362f77", "value": "DHL Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a4ffd1-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645694225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694225, "uuid": "0ae29883-5e95-440c-988a-6d252109d636", "comment": "Malware payload (njrat)", "value": "bf0c98083614e47d33afcf536b9862a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694225, "uuid": "1d1131b4-f019-4ac2-9b96-8e1a5f1de532", "comment": "Malware payload (njrat)", "value": "a5fb1994ab41f815805f040b7fe478f793e33b1ba13e2bac5dc3533da4b843bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694225, "uuid": "c8ca1900-4cdf-44bc-87d6-f10237b440e0", "comment": "Malware payload (njrat)", "value": "584eb7906089b4496a0025af97da70b432fb6b44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694225, "uuid": "e73bf1bf-5c0d-42d6-9e86-aa1785c63549", "comment": "Malware payload (njrat)", "value": "78908fd598011ff13406831bbb0a0300385a9b6a1a22b61dbc11772337c903ad7cd1bb46c147ec83a4aa359770bc98a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694225, "uuid": "8d3eba53-82a1-4489-a118-906a0a4af2f5", "value": "T124852302B9D184B2E27219326479AB61183DBD210F249EDFB3DC2E2EDB751C0D635B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694225, "uuid": "940e9e9f-012b-4207-929b-1cd3d22caeb4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694225, "uuid": "dbac4f55-3acd-4bc5-91bc-ab20f462a230", "value": "49152:IbA3zmQHCpHrI6izpLt3DEtC3P6M94xIp:IbTJpL5izpZ3DR6M9Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694225, "uuid": "fd0629f5-e110-4fd0-9fe0-be13d0a73160", "value": 1792238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694225, "uuid": "cfb57ce0-11bf-4a6f-a453-8609dc580a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694225, "uuid": "3ff6893a-9382-420d-a26c-2afc48a4bfcd", "value": "A5FB1994AB41F815805F040B7FE478F793E33B1BA13E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fb11df-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645688067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688067, "uuid": "205aaae2-9cc1-4d70-ba42-33e5001efc3e", "comment": "Malware payload (SnakeKeylogger)", "value": "9e271600cc1e9a1ea68fafa9be162542", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688067, "uuid": "ab7e7949-154c-4484-b18a-e528ed99332c", "comment": "Malware payload (SnakeKeylogger)", "value": "a6e97cc05092decdaa7de7f43b8be6470c22cf6427c74f906f8f72cd218b68d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688067, "uuid": "84134ed5-8b64-4557-a7ca-e3b63b742242", "comment": "Malware payload (SnakeKeylogger)", "value": "cacbf24f0ada639eb2277229c8cb96f0cbcce4aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688067, "uuid": "275e0534-44a8-4c32-9459-ff86fd806c37", "comment": "Malware payload (SnakeKeylogger)", "value": "f94cbba0d68f6a53b31fb8106f70dc03125d09523a588d26f26af4b863b95d54a952921245805a412517437c048ae819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688067, "uuid": "f4bd81ba-40a8-4ab6-80e8-bbb52189d427", "value": "T130822B82FBD882F4DFBA01310D232B010266AE95C0679EAE1AE470975FD37615677B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688067, "uuid": "e2bf510d-fb26-49e7-a483-ad53994a8228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688067, "uuid": "6e771c4d-d398-49ba-9ac0-0ac4c66d8631", "value": "384:eXf4N+bXwrbeEu8Trc5KGQxy3d7OU3YfvU2:f+bo/xgv3QYYf82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688067, "uuid": "3454fa03-d7f7-4091-be00-aca95295bc9f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688067, "uuid": "7849a8fb-36b8-4512-b5e1-b3d67a655303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688067, "uuid": "73674147-8548-4810-99c3-a2c976839b4c", "value": "Swift message.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e4b624-9582-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645714866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714866, "uuid": "fd88e78c-1860-4efa-b399-214391bd521c", "comment": "Malware payload (Heodo)", "value": "843b1c861deb98c346140ad3cf2c7ab1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714866, "uuid": "7c364fc9-36bc-4daa-aadf-c64c85d6a039", "comment": "Malware payload (Heodo)", "value": "a707d5f238823633abd424de516441b1a1932ae5fc6bdd4038cde7656011a0a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714866, "uuid": "670f9833-6077-4f1c-bc47-91f4d44b4b8b", "comment": "Malware payload (Heodo)", "value": "58441694205d99c84ba011ee124cb6dd52fd950e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714866, "uuid": "31eaa734-208c-4679-8d2f-871c86f3d5f2", "comment": "Malware payload (Heodo)", "value": "4fadd15778e493a6aae6dd44a23a5fe420d71ef3dceda382deb01d66190b5ece61f7c8feb8b35b465973466d88138b47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714866, "uuid": "ae8a12ff-73dd-430d-b6dd-0d3525090495", "value": "T1F1E4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E781C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714866, "uuid": "dcf5958c-ea76-48fb-9227-c8c4a7f37c4d", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714866, "uuid": "557a9a51-963d-43fc-9597-0107aa33355a", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKjKDYjX3rUXY:ygHpbVy97w0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645714866, "uuid": "e09eb5d8-9d67-4ccc-858a-74dd9304d199", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645714866, "uuid": "e608a0d1-bc05-47c7-9960-dbabe5bb3b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714866, "uuid": "4f4575d1-5e80-41a7-ac18-08df0c919b14", "value": "843b1c861deb98c346140ad3cf2c7ab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304b23dd-957a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645711257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711257, "uuid": "c911e133-76b3-4fa9-9f23-ed79b30f2c3d", "comment": "Malware payload (Formbook)", "value": "87ee91152f7a07f16db9756feae2fb0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711257, "uuid": "19f98740-f563-488e-8bcf-34cbeff9d572", "comment": "Malware payload (Formbook)", "value": "a70a717458c5147a02dca62c03c58d2e11e165180e683fa4755c719e6f9ad9c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711257, "uuid": "7d5ff36c-f36f-4732-9025-0dd43a3c6c54", "comment": "Malware payload (Formbook)", "value": "0a3221619d69958e52f8b8719260196aa130ebcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711257, "uuid": "67ea6240-953c-44fb-9293-02cac985c7ba", "comment": "Malware payload (Formbook)", "value": "f484435218f83167b497acedc32a1775cfa2d521b594ef3ce0827f0ad8fb589d232de28842c0908a5c057f9368fd997f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711257, "uuid": "7bdef1c2-40a8-4fcb-b83b-117bd695ad5b", "value": "T16EF4AD1038BF26D9F0768BFE5DD8A9B18EBAF53A3519F1B91C811EC64752B418D01A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711257, "uuid": "fa9e15d4-fbbe-41ce-a35d-b25f4a2c622d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711257, "uuid": "793388e0-29e9-413a-bee2-17706657fb53", "value": "24576:Z91LN7fHzHM/yibuUyyCHOciRtt+pIPGtlS+VwM2:DPfHjMXbumKpIP4lZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711257, "uuid": "65cc3da7-812d-4fa0-abcc-0c06e62a7592", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711257, "uuid": "db43996a-d7c4-4a9b-aafd-cd616a860d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711257, "uuid": "973c63f9-a4dc-41fd-9ba9-a50a11880510", "value": "ovRDe2RyH2kWS1u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ff6657-957f-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1645713328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713328, "uuid": "60eaf86f-6fc7-4d55-9589-dfc8f726ec1f", "comment": "Malware payload (CobaltStrike)", "value": "d493b228b6b83177c71efa8819b80122", "object_relation": "md5", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713328, "uuid": "6033bb10-fdc4-4ffa-ad64-a63fab433fea", "comment": "Malware payload (CobaltStrike)", "value": "a72a126f3a637b0102c656a3308121fbcf6d8fb97841ca1a87f04a6e994fa776", "object_relation": "sha256", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713328, "uuid": "b6bdf504-3768-4d20-94a6-db07ead95376", "comment": "Malware payload (CobaltStrike)", "value": "f87cce9349a2ab85477952a882a75ab8f8cf983a", "object_relation": "sha1", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713328, "uuid": "dd8da520-b33a-4ee1-8b36-0e362713d03f", "comment": "Malware payload (CobaltStrike)", "value": "d0d8f4acf040f118f219a62fe5317ec668643dba11b42ef1825b9f8242149399ca6c45603526e7479d7a454e4ce595e4", "object_relation": "sha3-384", "Tag": [ { "name": "162-14-110-99", "colour": "#9BFFFC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713328, "uuid": "81eb3c14-e700-4d48-8dbe-7bf86f9cb31b", "value": "T16AA2D81E631B4EDCE6EDA23E4F360BD75723B4207F24AADB938003191B2EAD6443B415", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713328, "uuid": "d9f8d7ef-9587-4a52-943c-3a7f71c64247", "value": "9872fc764efdf6171ece2599d004b1a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713328, "uuid": "582220bd-0fc9-419c-b5e8-fb4951de3ddb", "value": "384:oumrpltKDN4Vg80yYvzPV1O43xwiX9Fj2gn8spxa:obK54VgHzv7V1LBb9n8sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645713328, "uuid": "6d5c0134-94a6-40ee-a6fe-fe361e5165ed", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645713328, "uuid": "a88bbb78-8dde-42cb-a468-8b7d2110b170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713328, "uuid": "1de6832d-cc2e-4d0e-b740-f4f06aa3cc3e", "value": "a72a126f3a637b0102c656a3308121fbcf6d8fb97841ca1a87f04a6e994fa776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b44f7b-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "80243c6e-96b3-47e1-b651-d7e93019ec04", "comment": "Malware payload (Heodo)", "value": "ae1cc7ad8f64d9f6d22eecf0cc3efe93", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "300f102a-4e05-4600-920e-322a83878305", "comment": "Malware payload (Heodo)", "value": "a767c1f8014c472813c0d954919a9456644e339ca21ca36475402e587f469702", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "315f71c4-52a4-4b28-aff8-698d94848f97", "comment": "Malware payload (Heodo)", "value": "d77e073cc01a56d65db605d23e610aa091852077", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "e08e5dfb-13ab-4233-a0ce-72b968ccab88", "comment": "Malware payload (Heodo)", "value": "dbcb322c9cf65a9c0e33179e974601d54a6a349bff367ec698e4e809af7cc45c771b235ffe4241c69f5d439c3220b556", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "42113444-6d28-4087-b277-fb813827a24c", "value": "T1EBE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "779af16a-3adc-48c4-89d8-d2559e75973f", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "684a37eb-35cd-4e47-b7c3-f9f8293dd3e3", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKee/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKeLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660941, "uuid": "c29c832b-7368-44d5-8d79-a7b7277cb1c5", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660941, "uuid": "0d4c694d-7794-4cd9-87b0-b7f794878dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "adb1cf9c-4123-4d77-baac-ca1fcbf2bc4c", "value": "emotet_exe_e4_a767c1f8014c472813c0d954919a9456644e339ca21ca36475402e587f469702_2022-02-24__000214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aee2f41-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645688645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688645, "uuid": "f66a405d-612e-4b30-9d81-9c977c9c6df4", "comment": "Malware payload (AgentTesla)", "value": "8c7e5459b1518c63e4e8a0d72a2c0ed6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688645, "uuid": "9d4bb28a-7907-4fc3-b6a1-1aa189f95765", "comment": "Malware payload (AgentTesla)", "value": "a76b7eddf7365013bf0864c5eebc41895644440a2f0f1bc24758a79eb8607106", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688645, "uuid": "ff9fd911-2f5a-4c7d-956c-48ad14118364", "comment": "Malware payload (AgentTesla)", "value": "bcdbe76a589631a62dafe0e66debeb5ac8f91c9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688645, "uuid": "321e66f0-b69a-4d3a-b062-47bee71abb43", "comment": "Malware payload (AgentTesla)", "value": "b5b4b6eacf7b91f0c1006f8d373d21ea1413bd92ca781ff2a4a8409bfb9ed8568e3c85839fee244d200f675d6479a513", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688645, "uuid": "f1be76d9-d3ac-47cf-a46d-e5e41d8c01fd", "value": "T173141251BD36C2B7E190ACF83DD2A8051121DF91792633BA7AC53B4FA772AE8F311251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688645, "uuid": "d9ab288e-42a9-4918-b719-2e69d8825310", "value": "3072:3Vr3WLSocfL+O765zGkeAoWei+fuHc590oOhHBw3SIMcO4s8dLp:uXcT96UTWeXfuHoOUiBlD8dLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688645, "uuid": "f0ac215b-0d22-46de-8846-61db85216160", "value": 191160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688645, "uuid": "d1157c94-a7e7-49ba-83f5-123310cb3713", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688645, "uuid": "db906f96-32da-48d4-a68f-b9a54e16ce4e", "value": "TGO_PO 13681 STEA..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be1f13c-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645688566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688566, "uuid": "3109564d-4346-40ea-831a-a86b6141fcc0", "comment": "Malware payload (Loki)", "value": "4ba67679f9f81225c0031f7e1371bcfa", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688566, "uuid": "b84fd03e-7583-422e-8d4e-b0567e1f4042", "comment": "Malware payload (Loki)", "value": "a78bd30b23708174429c96d482659d1879fe917bb0e36baa531b6d552ff3e179", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688566, "uuid": "a600442b-0918-410f-ae2c-b939b6f1a80e", "comment": "Malware payload (Loki)", "value": "723a55125fcc5f916c78cfac003c59a570266771", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688566, "uuid": "1b80279e-2dd7-49a3-a3a9-ac504895a136", "comment": "Malware payload (Loki)", "value": "b724d6c4ead737ac063c9c336c09b009ee359c96bbe0c760d333e5822a2d2969db023db193c074d6f5bca1b56a850983", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688566, "uuid": "4af7339d-8505-4cd7-aa5a-59a0a0b11026", "value": "T1ED04021C764F4A66D43BDEFB902E7E1F20686CADBA143338364B394D8471253DB5349A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688566, "uuid": "257cb255-1abd-4fd6-bf93-f54f8c075ba9", "value": "3072:0CQXoEgtAyAYov+M8+w2RxwbiLp9A8yWNlAaOAp0HOJR+d+e8x8eRYZ+E:82AyDM8WxmAA8/NWa2OJXCeCZ+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688566, "uuid": "6b7238ce-a2d7-42dd-ad30-53ae57bca94a", "value": 190232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688566, "uuid": "f94e11f9-944c-46a1-8bd4-d6bb6b12f0f8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688566, "uuid": "4e1bbc8c-bda5-4688-a9e8-900f54db84fb", "value": "Fixture_Note_Voy No_5.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b9afb4-954c-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645691722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691722, "uuid": "b1046264-5fbf-465c-af60-9be4e201e68c", "comment": "Malware payload (AsyncRAT)", "value": "1dfb8f4b408ad8a763e4655e90c07093", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691722, "uuid": "8bae1864-486f-49be-bbad-8057eef8e4ae", "comment": "Malware payload (AsyncRAT)", "value": "a7999bf95618f2e2c37c5d0e805f8ff4fa44d2254e0ee0175df630f386a0c979", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691722, "uuid": "e3deff66-5470-43e6-8b41-f4513d89301b", "comment": "Malware payload (AsyncRAT)", "value": "be332a245adcd81707dd3de6b60653e2f68a0256", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691722, "uuid": "2f024507-822f-4c9c-8847-d70cfdf6b92a", "comment": "Malware payload (AsyncRAT)", "value": "6b65f0d6ed6577b409d931f19ea254b564d2c1433baba1d5b49b9456688c71ed7a7adc49f3bfa9ade15f658d6271dac7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691722, "uuid": "02322bf8-8a5d-44fa-804f-fc1db82b173f", "value": "T18EE47C49D7625681EC95627A85F66B453362FFF04CDBC20B71AD387D85BA3983E8028C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691722, "uuid": "c9921023-dfd7-4b27-9f67-3d7248c5b42f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691722, "uuid": "712eceba-705e-460b-a49e-abab6642af50", "value": "12288:RuGa0XKYLhAH22qla5w/yXbxlihtM324lZp+B6HBPrGS:R3XTlAH0MW/IbxlkM3tP+B6HBPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691722, "uuid": "9647eb08-0ed1-464c-b2ec-827386a444d4", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691722, "uuid": "f70fcfa3-ee23-4111-bcdf-0b74382bb6f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691722, "uuid": "b6d47d17-07ab-48ec-bb4d-f975df628fe9", "value": "1dfb8f4b408ad8a763e4655e90c07093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59af6b9c-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696294, "uuid": "3c469680-c569-4975-9733-c4838bc03636", "comment": "Malware payload (Heodo)", "value": "b80c9a5998e997bfcf26d6afb571d3ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696294, "uuid": "d7e31109-21d5-428e-a58c-f79723a6b2e3", "comment": "Malware payload (Heodo)", "value": "a7d7764216f6d083d0201907389b07d9da516c2c135e409802b15a970c70f6e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696294, "uuid": "e947f453-13de-4a39-b5fd-adf4c6b0c104", "comment": "Malware payload (Heodo)", "value": "9a2a9201877e5283351ec365f7a434a97eea2a4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696294, "uuid": "2257673c-f4d8-46dd-9b79-cc9315981490", "comment": "Malware payload (Heodo)", "value": "bdd9c8017266fe57f1ee8aef8efb9ebaa01f090bbe1cc7d8e94262c3956af250994b8f6f58ddf0d21784ce171944df6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696294, "uuid": "aa01613f-285e-413a-bb02-237c951eb0ab", "value": "T15CE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696294, "uuid": "70e5a72b-6f66-4e66-bda1-9d0cce1913bb", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696294, "uuid": "e8e8b36a-3a8f-4039-a5a1-c6ccb26eb4fb", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKke/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKkLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696294, "uuid": "4da919f6-c5fa-4e93-b1ad-1673258f46e6", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696294, "uuid": "f9137871-8a79-4900-b937-46184005f73f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696294, "uuid": "b9ee8d30-1012-44be-b6f2-6b281d7d4364", "value": "zFLIqm5n.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d485ba-9595-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645723015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723015, "uuid": "f005ca64-f068-4b9a-bc96-2228c6e83242", "comment": "Malware payload", "value": "e7487b6f4d54864954c5bb3f9194f6e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723015, "uuid": "f1daf577-b2d0-4c99-ac8c-4d5439b3b5e7", "comment": "Malware payload", "value": "a7f53b92008e8a3678035fc366bc1b88d152efc8466e9e82c754752d000a5ad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723015, "uuid": "3333455b-65e8-44fa-a9d1-2b61cb1b1279", "comment": "Malware payload", "value": "cb489d4820641d1f71a910b64ddb39fdbbc097e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723015, "uuid": "7316cc90-9769-4ded-8fa1-7f69669133bc", "comment": "Malware payload", "value": "0434189a6fb0b3fe6d53b995a69844f36580071984cce60b30549df9af85cbaa6d3e4f9c33e0c296c67399c1c80c70e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723015, "uuid": "4d5ad04e-b2c4-421a-a5ae-c8c22de976fb", "value": "T19F159F12F2929133D02B16349C27D5A9981A7EF03D6CE8477BE43F4D7E3524A392AD93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723015, "uuid": "9c4bddbc-2453-485f-9db2-ca5515b17936", "value": "1c02903d270a37655f586f4aa8bf43c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723015, "uuid": "8f694561-7d24-4037-99e1-9a434e86933a", "value": "12288:Cwkcdx+EleOmksXHxvkAhNSpCsJHr3A5WhS2x3pxjsppdTc:CBoxpeOmBBtQRJHrw5Whd3/j+pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723015, "uuid": "22d2b561-fc3d-485c-b14d-8a3ef7a44fb7", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723015, "uuid": "3fd040e5-b4e2-46c2-8e60-d2d2c6ab8815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723015, "uuid": "cea7ac75-deb4-47ca-9683-021a26e9c0cc", "value": "e7487b6f4d54864954c5bb3f9194f6e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829c837f-953b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645684336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645684336, "uuid": "7586648b-027f-484f-b116-28af94a739ed", "comment": "Malware payload (Formbook)", "value": "43421aa34fa0c1cf231753fb548a3dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645684336, "uuid": "7c4125e4-13ab-41ac-bdda-b392a0b95677", "comment": "Malware payload (Formbook)", "value": "a8aac4da04f10b4b936a31005d3e1fc2ac55dd172f00041e124a35240697a161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645684336, "uuid": "25f7ded8-7c75-4542-a23e-39f53aa86746", "comment": "Malware payload (Formbook)", "value": "347fd222a02f2a03f6e8846c2fda3abaaa88635c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645684336, "uuid": "0a6da392-a8e5-4e84-8b07-63c457bccd51", "comment": "Malware payload (Formbook)", "value": "3d2b8745decc4c0e771395ef0f0cba7ef539bb95a3684a0b3306bae3f78dcb87cc9e5c44b6b4358b8f39b1e5d84623de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645684336, "uuid": "159a5e82-5f5e-4fa4-b8ea-7d814f982237", "value": "T155F4CE1439BB30DEF063DAFE9EC8ECB19D6AF13B220E71BA10460F564B09945DE12576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645684336, "uuid": "37be50e0-0568-4040-b0ff-720ae34384cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645684336, "uuid": "ae515df7-0c55-4953-8c35-6a04b65cd912", "value": "12288:L4+UA+sxaMtpUTxpR+ebK4fI3NDXJNL51zwuZwG4IVAFtObEJgsPYa:TUA+sxbbgpRa3lfCG9mG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645684336, "uuid": "00bd517e-a090-45aa-8460-93af58068795", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645684336, "uuid": "3ca08136-be14-459a-94fa-c86d8c43ce31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645684336, "uuid": "4dff2f05-ffa9-4b92-8aff-1932b30c49ac", "value": "Euro Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754ea285-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645688609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688609, "uuid": "c4e13f77-f1b7-44e7-9109-55bf610583ac", "comment": "Malware payload (Loki)", "value": "2c5a23c1c99112caa331816ac79ea75c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688609, "uuid": "10ec1c43-20f2-48a2-81cd-8942ec8b55d1", "comment": "Malware payload (Loki)", "value": "a972190e24463d5d779696eb31beb81069740acf0a39e67e020c327e4a445461", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688609, "uuid": "1b59a049-3948-40ea-93bb-011478d268ca", "comment": "Malware payload (Loki)", "value": "8af75723904e2458f92ae5f9c078a8f2bc006ffb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688609, "uuid": "8ee9d302-0a06-44fc-9271-9d89d9359dcc", "comment": "Malware payload (Loki)", "value": "45863b9fb722f97abfdd7de6458c4a0e4793085d7105641214f2a8f954d51a7be59c573be5d4566eca9708e712265475", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688609, "uuid": "24b9f04e-9589-44e6-addf-6c2339c0b7d8", "value": "T11504024CEAFA234EE0BD8539C776BD4617228CF7BD18C818214670795C7A756B92CC2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688609, "uuid": "872a2785-2c7e-49cc-988c-73c7ea34d38d", "value": "3072:sSJrLgFOyq7V8RNIA4PZUELIq3anZiWkpRudRjHtSYpJGka2NMuCitBX2HsVQnP:9J/gFOFZmNh0ZUELIqEZi37Y4ka4JvWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688609, "uuid": "8143f742-79c6-470c-8e26-9f67e14926b1", "value": 190312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688609, "uuid": "7284e8dd-61cc-4af6-bea7-e95afb83a6a6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688609, "uuid": "cfdf6ac4-7d33-4fc3-9e74-8d4852db98cf", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93e3994-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645710735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710735, "uuid": "1eea4ef3-7cb5-4b4f-8700-54efcc40f79a", "comment": "Malware payload (AgentTesla)", "value": "a65c0dc8fb915690e29ad127d31cbaca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710735, "uuid": "f98be0d6-cce0-4039-81ac-27cc729c5f38", "comment": "Malware payload (AgentTesla)", "value": "a9b41851019be3aa8ba41108737932c70a5cff16695650273a3a89511febd2ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710735, "uuid": "030590f7-9334-4e9e-b718-894de20441bd", "comment": "Malware payload (AgentTesla)", "value": "2af8541fbc7e92dac58b04282075d3610764af59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710735, "uuid": "9f8511cf-a2e2-43ea-87fb-3889e4ea261a", "comment": "Malware payload (AgentTesla)", "value": "f18440f759e2f1d2870a9d83401dafc546136b21a1a52c64157bdfe58506233df0eb4b07b94c7b8b2b64f2705501d6dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710735, "uuid": "33afed7b-4246-454e-9810-818ee4fdffa0", "value": "T1B57423F6A63CB3ECDD2950F404F6BA5BEC710866EE0466188D55830D12B68F6BDC4772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710735, "uuid": "e6484132-259e-49e5-9a66-99d8a11b7cce", "value": "6144:OTLlpIrEIEm2YfE/Roe2cxKLp54t4wi9duS08U6K5sBjXtA:ILXaOXRX5ELAOwiHvU6KKBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710735, "uuid": "037d537d-8dcd-4552-a6ab-c03339ed7811", "value": 346816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710735, "uuid": "2187a408-d068-49bf-8ef4-485bd8215497", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710735, "uuid": "68332808-db65-4d59-9950-70c0500a24bb", "value": "PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24a0740-9580-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645714052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714052, "uuid": "0631e3d3-1757-48bf-95ac-cfca7028fb89", "comment": "Malware payload (Formbook)", "value": "229a0d84ac897a99d5df4283414abf6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714052, "uuid": "7692a274-b3dd-412f-9826-fe9a1e446b0e", "comment": "Malware payload (Formbook)", "value": "aa112ed45fdbe4d9e70479dce507d4c8b3d5ceae3d2107e83d87a7c84eac6294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714052, "uuid": "36d90593-0b5f-49db-9082-dc264445c7a8", "comment": "Malware payload (Formbook)", "value": "f7bbeb4d67502e7f28d81a4baa2fe0128f036db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714052, "uuid": "743c70fe-c7dd-4548-970d-98ff628feb65", "comment": "Malware payload (Formbook)", "value": "af39296bf3dff74d27769a5511bf03d4b4bf838e8aea94ce97f84a3a470a657ec36396776ce0d73cc70634785f6352a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714052, "uuid": "4b6bc010-cba1-4a08-9b40-b27bc61417c9", "value": "T195F4AE08FF598AC9ECB6467A95F863002354FF749CCB8A07719D667DCABB3952E4060C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714052, "uuid": "2c3dfaa9-6360-4feb-a0fa-06554db1d9b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714052, "uuid": "e165b88b-9eca-45ab-b5e6-641496bf234d", "value": "12288:HyDENczaJsDcH22qla5w/yXbxY6IMypDEel0vu:S8c8LH0MW/Ibx/kbl0vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645714052, "uuid": "1a7981a3-0065-4875-9636-8949549e20f5", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645714052, "uuid": "e6bc2d79-9bd9-427c-947e-25547262ba68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714052, "uuid": "d055e6ef-70b6-4eac-b73c-f1ba398f93fa", "value": "bbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b721d074-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645693014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693014, "uuid": "a88f344f-702f-4a11-9a4d-915038eb7909", "comment": "Malware payload", "value": "2645a3827b3e3e8a4fd278ab1c1c4527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693014, "uuid": "a0261964-8388-46a8-a478-6e3f16be0021", "comment": "Malware payload", "value": "aa69efc6d0e9dcf29dbf1894cadd436c295bc1ed05684fbf8731a9cb0e8d183e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693014, "uuid": "b61c5a03-8be2-4d4d-b05c-cf972c4d01aa", "comment": "Malware payload", "value": "dc06f2131cfb565d3161e60cce41ed93c2831549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693014, "uuid": "c4de861f-1d53-47fb-b1d0-53a5e9d423de", "comment": "Malware payload", "value": "b1385d87a9c86faf529aa9cb659099b210c81ec286b480714641332f11ed12e88a3e285962eea45dbcf35a897ed6be3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693014, "uuid": "47cd0300-afd1-431f-aecd-74bd59d45d9e", "value": "T1A2F25A19E3F8AE33C1756C7E4463CA220FB56E859A17E602548FB90EDDBC2B0D0709E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693014, "uuid": "509fc5e1-c007-49ce-ba04-100d08f4c8c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693014, "uuid": "26d8f31e-8af9-4e62-8537-9f5e135f2048", "value": "384:najmxbM9ya4S3rFVXLd7CJ0FvUDJOo9vAY:n9b/TKEJUboxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693014, "uuid": "7486cf53-2d6f-49bc-979b-2f725201d453", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693014, "uuid": "2e9c1a86-05df-45a3-a90e-9811215dbdcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693014, "uuid": "298145ca-9a2c-49b8-a1d9-365648df92fa", "value": "2645a3827b3e3e8a4fd278ab1c1c4527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ffdc3f-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1645723475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723475, "uuid": "13bdc5fe-a00e-4e79-b9a6-2092a1699082", "comment": "Malware payload (STRRAT)", "value": "1eb65e5d9d782d981b4d5eaeb4795171", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723475, "uuid": "806ec818-1a83-4940-9a0c-d624ef7f9bef", "comment": "Malware payload (STRRAT)", "value": "aa9049ed780b1dbad6cf2c054f84bb429fc923e700572ed61e8d74eb03d0b0ed", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723475, "uuid": "5ad68fd2-99d4-46ac-a2b1-25d8444bf381", "comment": "Malware payload (STRRAT)", "value": "bef54ca61ef2ebe4ecd8e890eee6de2d8b0bae49", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723475, "uuid": "e1fbb983-4a09-4edf-b36a-05df40fc0ab1", "comment": "Malware payload (STRRAT)", "value": "9bf88cb35d3cc0b153246e4ac3a02cc4216baf4745419eb93d52ca61a59d31e58077884e05530504985226815bd89be4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723475, "uuid": "857f7e7f-d29b-471e-a64c-049bf55c3ca7", "value": "T1CF93CF3B787BC069D107183A106985236A0D55D9F24FA12B26FC0C637E34C6EBB576EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723475, "uuid": "fb5d9ca7-1247-4a20-bda5-3de65514ed64", "value": "1536:vX/W1AHqP1K9Qo1+jdncOsnGSt1k0zpLZmjATgKohePEjHGvTvxmp/HrRs:vXDHqP1GQ9jUG21lz9Zm8T7PECvuLRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723475, "uuid": "2d7d6747-8e12-477b-9284-516a666b6031", "value": 90101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723475, "uuid": "56ed70e9-136c-41a6-84f8-c47f212542b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723475, "uuid": "ab7c5857-a621-4920-8e39-2f4d20c334ad", "value": "JUSTIFICANTES PAGO.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a447a5d-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "ca491e4a-f7f1-4bdf-a169-3e2297b4bc3a", "comment": "Malware payload (Heodo)", "value": "2d9f06daacbfa15e07775d1140132368", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "766978ee-07e8-4e0e-b7b3-f6c2b108af0c", "comment": "Malware payload (Heodo)", "value": "ab22e3ab17f2e006fda88fbe6edca135ae9f01afd0f3e09e4d01776ee208a093", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "d7d6abbf-3d6c-47e4-a67e-d0765a2f1ec8", "comment": "Malware payload (Heodo)", "value": "50b26a4c5880b06c2a441d0c9a5d76889901b706", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "2ff72e29-a657-4750-832c-428b0b2249d1", "comment": "Malware payload (Heodo)", "value": "b418114f6abd12dd3123bb9376faae7c3ff538e3588da24897d13c3a603316c794d225904da760bb97a05ccd23ddb63f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "c5c739d8-4064-4799-82a4-8a28386806bf", "value": "T14BE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "acb9ae2b-f964-4eb2-a768-36cd2b6c6b18", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "0081faf7-2e8f-4006-ac6b-c1161bee9f5a", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKie/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKiLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660942, "uuid": "43a89d8d-258d-4378-8821-16ff10e3f0c8", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660942, "uuid": "83fd40a5-8560-421c-ba7c-ae110d2aa045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "8798ddf6-00bb-44a5-a5c6-f10cfb831bae", "value": "emotet_exe_e4_ab22e3ab17f2e006fda88fbe6edca135ae9f01afd0f3e09e4d01776ee208a093_2022-02-24__000213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff96bac8-953c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645684976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645684976, "uuid": "170f06ab-d81c-4947-a04d-2ba861b48ea4", "comment": "Malware payload (Formbook)", "value": "eb84d11bc6919f25437f90da943f7f0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645684976, "uuid": "916bc708-61c5-45e2-9ce0-25ae84aafc33", "comment": "Malware payload (Formbook)", "value": "ac59a96a7600ffeacec6db910d9ff04e5ddfaf5f325ca41a0c06028a739509da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645684976, "uuid": "ef3336c5-3fdd-4aa2-b78c-d7f3f043c817", "comment": "Malware payload (Formbook)", "value": "c9dd5462e60b7c4bd5a46b6f179972d517c37954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645684976, "uuid": "04065603-ce70-4e4c-bebb-a530a55ecbab", "comment": "Malware payload (Formbook)", "value": "5bcfb9a09be71e92ff50346c426e76182a82262c4706bef2588ce39524ec661ff755a60f76740dfada71690c7a9c5f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645684976, "uuid": "0d706b14-b319-4035-9b7d-006c1d3beae1", "value": "T157159E12F6D1C932D01B2634AC0B96999925BEF03D2CE44B7BE43F4D7E3524A3819DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645684976, "uuid": "35de6e23-12b9-4f07-abff-5e33bc142ffd", "value": "1c02903d270a37655f586f4aa8bf43c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645684976, "uuid": "5fed9ed0-4ca8-4380-9c58-04fc9a8f62f3", "value": "12288:Cwkcdx+EleOmksXHxvkAhNSpCsJHr3A5WGS2x3pxjsppdTc:CBoxpeOmBBtQRJHrw5WGd3/j+pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645684976, "uuid": "3c2f11ec-867e-4f14-9843-25c342c338db", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645684976, "uuid": "4172ccbe-29bf-49e2-a6d9-bf6a32d1c4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645684976, "uuid": "c7ad7e7d-c7ba-4e18-9e8c-4ac3f7271b68", "value": "Revised_PO-SWB-18023911 & SWB-18023812.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657457a1-9547-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645689441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689441, "uuid": "01684449-28d9-4684-8dc7-fd6b4e14fa38", "comment": "Malware payload (Formbook)", "value": "631f52a86ea5494976b3ef1463b22409", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689441, "uuid": "c2f29cb5-6ad4-4996-ae72-43d431fe258c", "comment": "Malware payload (Formbook)", "value": "ac635975e5e6ab7b5f10b5a06e3be31b964f34004afd26dff0cf71995023ecc2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689441, "uuid": "860ea5a5-8589-4f9f-ad57-558ff9d18d25", "comment": "Malware payload (Formbook)", "value": "355408f88af73f4d6ee68fda1df98db5209466a5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689441, "uuid": "5ff0dd54-cdb6-4127-9af1-ce3af987b736", "comment": "Malware payload (Formbook)", "value": "13b7c9c3f0feffa10860dd7e03fe024825cd5e3c2b6eda68962467879311c3310f3cc6da3523d4f2f6280499aafed493", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689441, "uuid": "ff42a540-1fc1-4fa0-87f8-db7531173563", "value": "T10951628E7013B028AA376FB1EC2BC8AD5C70A15B623D8442BE0CD6D41D395DCA792C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689441, "uuid": "54eeb371-4ec9-42ac-97fc-5dc59c2caeb9", "value": "48:mNr/MhKj/95NmpkXkaSy1yM9+IjFkANPAV5LOt/IFqL2vHRzzOndKT0qqkR80o:6r/N5NmGXkA1fcIjF1PATL88qL2vRS0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689441, "uuid": "402689d4-bd55-4b17-a257-559ad7eb92f6", "value": 2581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689441, "uuid": "79ad30cc-ac32-4e06-8457-a531ffa32cb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689441, "uuid": "aff597c2-8a0f-4dd9-9d02-58db64261ee6", "value": "75804623697 .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbdc98c-9571-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645707546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707546, "uuid": "173ac405-b2e7-4655-b799-c74e7e7204de", "comment": "Malware payload", "value": "a5485fbd51cd889c5ddda7965e6d378e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707546, "uuid": "3079d88a-4a3f-4135-bfd6-d056fc057f32", "comment": "Malware payload", "value": "ac7bee0e3cdcf41ef4ebc245de8fe908cbc7d930920bd50dc1d0e837a8cc32f0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707546, "uuid": "0668717b-2e28-462f-96ef-69ca8b753724", "comment": "Malware payload", "value": "5da6dbcef4c5777d4a83a36a9c34008698e3a090", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645707546, "uuid": "95ba3340-caf1-4e3c-9784-87e1cefab58a", "comment": "Malware payload", "value": "999cd67b42daa6c7f3c841e0bcd36d0899684c9d8375b246e18efaa3cc7927789a2c78aeac43e12a8a43179492fc3d9f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "wmz", "colour": "#F42C7B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707546, "uuid": "9e3c3be8-dee7-4fa3-b414-f942d0d9b631", "value": "T15531EAA1112A47C7ECFEC5BAA09BE06A44F05B01BB9148AF7D285A6F23C44181835439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707546, "uuid": "72ddec2a-6d4d-47eb-9cbe-cf431be4d006", "value": "24:XSJpREMY1hNQI1QoG2b5+083vgUgdQo3SqRVZV6mCtNii3zfe4ewO1CIH91:XSJ7Ed1d9ddTOvgUC/T/fPdYz2gOH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645707546, "uuid": "9d4b4c10-0ef7-4c5d-955d-41355322a4f5", "value": 1585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645707546, "uuid": "0ce5ad1d-004d-440d-ae38-65f7922df433", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645707546, "uuid": "94741b0c-d500-4650-a07b-e02a058745df", "value": "image008.wmz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c82b290-95b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645734389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734389, "uuid": "5c28bb87-887e-4f3f-9a59-6ebb949c5786", "comment": "Malware payload", "value": "ce5f87a2173fc34d81d800cab419eb4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734389, "uuid": "f3dceaac-ec8b-4c09-89e2-4970cef0bd71", "comment": "Malware payload", "value": "ac8653b6ce556bc4411b07f9031adc1d00b57e3bace598e704638c3e1085ac31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734389, "uuid": "d28b833a-620f-457a-ab23-aa36a491e9d9", "comment": "Malware payload", "value": "425775fc5e5b66ba1d7831161303f6322de6f33d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734389, "uuid": "dafa17ed-bd50-4510-9ea2-73212d23616c", "comment": "Malware payload", "value": "1841ec6286e3790e15e348e420854d4cfb0c94677aa6a4af22f890441ecafa5d072819675208d26f3f65af6491bf7a17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734389, "uuid": "416e2f90-afb2-4c76-b652-d15eae883c99", "value": "T1DFE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734389, "uuid": "025e6983-7997-4824-8da2-1744a0de2cb0", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734389, "uuid": "84e555cb-2816-4daf-b801-17a399c5ac63", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XzsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWza1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645734389, "uuid": "6c83997f-559b-4fb8-b9e8-ecd1b2af88ad", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645734389, "uuid": "485248d2-eb12-4b53-9857-b88120579306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734389, "uuid": "601f8713-b7cf-46c4-b9e8-aced526b1a6d", "value": "ce5f87a2173fc34d81d800cab419eb4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b59c17-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687137, "uuid": "1024331d-d8a2-42db-a955-404bcd28c5fe", "comment": "Malware payload (Mirai)", "value": "44f0cc9283961d949ea23d52bcc56aff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687137, "uuid": "f08b411c-2db7-4149-be6f-55b1464c1e29", "comment": "Malware payload (Mirai)", "value": "ad5793f9e91d023677bd8fcb7716cfbd6b0009487339ed2412ff4a361c478dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687137, "uuid": "7e931fd4-82c1-4713-b612-f358d8cbba0e", "comment": "Malware payload (Mirai)", "value": "dd0fb719ee02941d8da8f06db5a1c44f81e53e27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687137, "uuid": "e5f14ff2-6cb9-459c-96b8-2dac576bd506", "comment": "Malware payload (Mirai)", "value": "88722f17a139be535a0c98b7f1873da08ff50ba82f956251d4b04c515c71d429573b02a28ccc75a2cb47ca528804393b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687137, "uuid": "dd6b8261-83e9-46a3-b6df-8abdbca72745", "value": "T1B4B31845F8408727C3D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687137, "uuid": "edb12c99-d435-47ae-a87c-dc3be5e25f4e", "value": "3072:MSY+46m1qOzssGFPPKNy+AmkZrQAhPDCXFke:06mgOzJGFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687137, "uuid": "5a1c7b33-117c-4bb6-b42f-410f26896dc0", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687137, "uuid": "1cc20b01-bc89-4507-b172-f1bd548ef948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687137, "uuid": "c679a95f-89a4-46e8-b8f5-272b9e4d3cae", "value": "44f0cc9283961d949ea23d52bcc56aff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a8a2fa-9581-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645714488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714488, "uuid": "ea0565e8-b2aa-4ce3-8759-71d5055b1154", "comment": "Malware payload", "value": "63cea514d8874e7d51dfbed0b336a3aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714488, "uuid": "9d189297-5740-4643-854a-d66669005f02", "comment": "Malware payload", "value": "ad90b7c75c2b73f67318dcb26c00cfa0b8dd55f2c466e00c451b3acf489a70d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714488, "uuid": "51399e08-d1a7-4606-8049-f3d3de034a36", "comment": "Malware payload", "value": "1e8b89374e09d1387f2ce8d23425e277e51860f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714488, "uuid": "a65c8ef3-6df4-4b53-b025-d5f2e7888200", "comment": "Malware payload", "value": "1aa6b7e37f894105807a0996760003b260af3558e372ff35cde1021b86069e0eae60f0de7a7293ce034743666f846424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714488, "uuid": "51671167-685d-4e29-91f4-478a5f7b7dbd", "value": "T11A248E0061D6413FD872A6B38598968289FF7D263D6A8FCE578C1C7EDD382915336F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714488, "uuid": "6bbb61d7-645a-455a-8fde-f7b010043369", "value": "a7b6ec0d4c24b8b31f2ebf3e46968180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714488, "uuid": "763be1dc-8dee-4ee5-bcc3-af7f70102a9f", "value": "3072:d2mJamjK63BsvtPN668Okm8Q1vwVgTAHghR3tRYutZJqcbCvf:dU63BsvtPcBMvhUAhR3tH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645714488, "uuid": "de4dd07b-22d0-411f-bd55-5fdebf01d202", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645714488, "uuid": "cd68b2ba-b963-4083-9685-d36a9a868999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714488, "uuid": "0839e343-5a21-4a42-944f-8500b4a56dd4", "value": "SecuriteInfo.com.W32.AIDetect.malware2.15957.32574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c8c458-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "6305a9c7-3394-4a7e-a02e-65fa8f741b23", "comment": "Malware payload (Heodo)", "value": "f8eeb55bba613af5ef8f50d16491b3be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "05425911-103c-4eb7-aa0a-dba83934fc27", "comment": "Malware payload (Heodo)", "value": "adbc08c6ceac210b2c0b98c832014d7b938dc4ddee19b38d68d75567c227195a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "3e33bd4c-3770-4649-a3bf-4cfbccd887cf", "comment": "Malware payload (Heodo)", "value": "72fef5c1add9d203238bfa4b65fb7d6812f20a11", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660963, "uuid": "77e7e510-734f-438e-9bad-ae796d57a886", "comment": "Malware payload (Heodo)", "value": "ac5c0b9bc2da04dba8985ef9f0adc70c381afed08627da79472c021aedac7b764d6724fef0384782cf7b1b452480e518", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "f586ae9b-3f60-42fd-9129-7e43ccc9f531", "value": "T101E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "2ad13b1c-a307-4c75-aa60-43cb70b92bd0", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "290fcedb-a726-4640-a852-2ad242700e7a", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0YhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfMPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660963, "uuid": "2d1316cb-b4f1-4921-ae60-30aaaa438a67", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660963, "uuid": "3a914411-3cc9-432c-a92a-c0c03fd9607b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660963, "uuid": "37801282-f25c-4971-9909-a667a4851929", "value": "emotet_exe_e5_adbc08c6ceac210b2c0b98c832014d7b938dc4ddee19b38d68d75567c227195a_2022-02-24__000236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2176001b-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "1803cc40-60df-4b10-a555-a54147c19e31", "comment": "Malware payload", "value": "001d2115c67bd03aa506b5822b6bb586", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "b0297c7e-e9c2-468d-8c88-7c710d03a954", "comment": "Malware payload", "value": "ade30da4bcb7ef02cbc6798600dbe536a9e83b9cf4de7d791a3de4009cecb0b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "e5490b2c-e39a-43e3-95a7-ec6b30c5c557", "comment": "Malware payload", "value": "22c4f2d76e5264762c382628c308271635ff8918", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "c317ddf0-a034-4f72-8a46-14fa44bbb6e4", "comment": "Malware payload", "value": "105851ecc2c4e97032fa59e159d3317746757dafd14fec65810de83cff100ffc2c0f14f261f6c7a0254330da1083639c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "290888cc-b51c-4d53-8d8d-26ae609a5d8f", "value": "T15735BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "6c32aa8f-9ddd-4e70-90db-0d54a04078be", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "4d3dea0e-d489-4574-93f7-e063e8d08a12", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uTVOe528JO6PC:6iRGcUY0UvDYNFtuR5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738719, "uuid": "9239393c-4331-417f-afb4-a8be4df45c19", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738719, "uuid": "22fe7e98-91cd-4cf4-a77c-901a73b25547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "282ccea8-6f4d-4cd7-b995-05effa31e317", "value": "emotet_exe_e5_ade30da4bcb7ef02cbc6798600dbe536a9e83b9cf4de7d791a3de4009cecb0b0_2022-02-24__213828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26aa867-9541-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645687074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687074, "uuid": "afc92253-58fa-409a-b4f2-941d7454b5a3", "comment": "Malware payload", "value": "6fa75cfecf36479704a1bf9ba5995d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687074, "uuid": "7c4bc475-9caf-413d-80f0-6818396de6b0", "comment": "Malware payload", "value": "ae02d2b43d2d63b75a3a5c87267541c8d34a3f60a03e169ce904e3ea6a5b842f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687074, "uuid": "11d885bf-1f41-4b55-a289-be964987541b", "comment": "Malware payload", "value": "7b3715c0c24341c6ab0b2a0408451f05c1a655c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687074, "uuid": "03995cc7-6a96-497f-b70f-2663ab359860", "comment": "Malware payload", "value": "b4b16032f4db2648b99dbca19d1d8d9dfbb20b81c06229c07777641534095ae9449c517aadc09e4f7c38430f3c203444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687074, "uuid": "758d80a8-826c-401c-afb5-4968034b3345", "value": "T1C4B45B207BFC8722F1BE2636D0B9190547F5F862A1FBE74E689465EA0D537417E203A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687074, "uuid": "d2722d83-c0a5-46fe-94e9-0e6ee4face54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687074, "uuid": "9b66fe92-b470-4910-b6e6-e156de54f3e2", "value": "6144:ivzYbCvU1TZrbUtQXu/7+QxDiM5snMvB0EmKLZPDvOBpqgOMlw/k:icWvU1TZrgt17hf3bvOBpXlwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687074, "uuid": "32043b0b-bca9-48ed-ad27-d0142ee17f7c", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687074, "uuid": "31ca47e3-185f-4e60-8fe0-f034acf2e7f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687074, "uuid": "c6bfdb6c-b0dd-403d-9dba-549640925109", "value": "poweroff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76461751-9577-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645710085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710085, "uuid": "421247af-f156-41bc-96f9-7382384841b6", "comment": "Malware payload (RemcosRAT)", "value": "637349b1b48f34e99d5f2cec2c524eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710085, "uuid": "8595b834-9eca-4a68-a739-aebbccd14406", "comment": "Malware payload (RemcosRAT)", "value": "ae36d90987434b68eabb868620a18c0588f6b5770d504b70aeafc5ab963b1268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710085, "uuid": "677e3281-1edb-40bc-9e43-e4a112ba7c08", "comment": "Malware payload (RemcosRAT)", "value": "16d182d626af370a590faa0d8c271d98c919bb9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710085, "uuid": "aaebf3d3-f00a-4a67-90be-e66c55872b03", "comment": "Malware payload (RemcosRAT)", "value": "295e3d8ae3199bfb2352921b4fed30ec018f31f12506a9f4762f12ce33697b80c829e712d0d72b8728a48c97c59cef4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710085, "uuid": "b030fa64-97cf-4cc4-8353-03118616a237", "value": "T1AA625C2317F8873DD1EE9F7A49339704EE75E601C8535B9EA48D510BBC722540B82FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710085, "uuid": "25b334f6-2e57-432c-a775-81d259850a70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710085, "uuid": "c35b1fe0-d28b-4c2d-b280-e2becea7e4e3", "value": "384:A6b9bhYyamYSDvTHRNdwRfETbXX5Q7tUO:A6Jb3DYSDzRNdwRMfX5Q7tUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710085, "uuid": "a3ac453b-121a-44da-bd82-84d303cc157f", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710085, "uuid": "c36f95df-b784-4217-b94b-149bf503efdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710085, "uuid": "9ca89bc8-d7d9-4b51-a07f-fb8b61f9c241", "value": "09865432--094=-09876545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098f6cdd-9595-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645722788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722788, "uuid": "83ed3119-9978-4d5e-b894-1fa7e8e13358", "comment": "Malware payload (Smoke Loader)", "value": "dfad13d603bb058748ff6a6da0960bab", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722788, "uuid": "b2102a5e-1954-4867-98c7-265e146ea49d", "comment": "Malware payload (Smoke Loader)", "value": "ae65535a83e49de1d8cd03d1ac41ee980660445e5f403e5aec913bbb6a99ecb0", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722788, "uuid": "b04868c4-809b-4099-944e-3f49830f34f4", "comment": "Malware payload (Smoke Loader)", "value": "e4ef2211c46e98b29330fd7839bc9d8e377dec86", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722788, "uuid": "2cee163c-fc67-472a-8999-0f734c81b2c4", "comment": "Malware payload (Smoke Loader)", "value": "3bf15775baed4e72bb5104adcfb0aa0b9864660ed99064926193fb0efd56199db22aa71f4e47c687228cf6fa18c06969", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722788, "uuid": "9e932b49-ed96-4120-96cd-712294efb401", "value": "T11544ADF17981C831C0B631309436CFA0596DAC63DA549A8376F43F9E7A722D962F921F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722788, "uuid": "11651157-bfc0-49cf-bec5-f2151e461f39", "value": "917b0dc587f632b60bbe39ab8c418265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722788, "uuid": "d5cf3865-58c0-4c69-8acd-2dd3c6d09e94", "value": "3072:SoNF08+7VfiHZI/lS5+nUmc058VggjcGkNIVqIOM/h3t7i:z477e+/85+nHM7ITsqxSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645722788, "uuid": "a9c22ce3-73ea-47a1-83c3-0350fdda9645", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645722788, "uuid": "0a3436f7-0013-411b-a127-63340aba9a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722788, "uuid": "995cc068-18c0-4bf0-a18f-279218310439", "value": "dfad13d603bb058748ff6a6da0960bab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59472385-9595-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645722922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722922, "uuid": "0d2ddf51-730b-4e65-8b23-8a5d7e0814e1", "comment": "Malware payload", "value": "7d05bc25816014bd1a26f038f9c8a1ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722922, "uuid": "5df32dfb-6134-49e9-a0da-ec977abda24d", "comment": "Malware payload", "value": "ae6f051dcb87c4515f9d4809c02dca07f452a03b19c4177a8717873a050d6e70", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722922, "uuid": "b93be9b1-63ef-447d-a4b0-33b28dc60465", "comment": "Malware payload", "value": "667a1448d6ec375aa2149da1e753f3739ea2eeb4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645722922, "uuid": "40a67414-2f54-4d4f-ba4c-de6880b9be57", "comment": "Malware payload", "value": "c13050d98083d40bf599aaf06412c0d482f78e915bcbadfb2a7fb61423b905b689ea2be50c00b84f7924cb15070ef31a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722922, "uuid": "f130d888-7c45-4d57-9f9c-14672f6724e6", "value": "T11805AE1253724835DB3B4F38ED4B12A89C15FDF2F86898F5AED4A8687B386512C5B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722922, "uuid": "65f2176f-d7ac-4cf1-8090-df7614c98cea", "value": "c1121acfcf8b9aeea983fd06a6c0a74e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722922, "uuid": "b5a2921a-ba92-4ff9-8cd0-23b580024c89", "value": "12288:l9hhPVn6mBXIlb5oC7QMDkbWlV4AuBmzKT5NQMvNHgTJfnoHu:/XometXnD+WHTWT59O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645722922, "uuid": "4e998051-6b1f-46cd-b19e-a16e24b9b771", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645722922, "uuid": "9d21c8ed-c03d-47d5-be66-bc353fd31141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645722922, "uuid": "b3024c47-0cd6-4730-ad87-32f60a263ef8", "value": "44616.6382774305.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3073d4f6-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1645688064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688064, "uuid": "c6a9ef04-4230-4b57-a96e-23db5246c1e8", "comment": "Malware payload (SnakeKeylogger)", "value": "3d2c887dcc52f450b457b477cb3e4876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688064, "uuid": "2816a9a4-7547-411f-ac96-eee837c2d71c", "comment": "Malware payload (SnakeKeylogger)", "value": "aea7d6f97ab14af3d0b03f365be7c7d80c7981cbb5bea014fbba28b85daa7f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688064, "uuid": "2b1ebfad-ea90-4c41-9314-54233fab444e", "comment": "Malware payload (SnakeKeylogger)", "value": "188ae071132b68c7cc71406065d3bdcff3469d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688064, "uuid": "64c88f5e-412d-4088-9e37-fe3b37d5d7d8", "comment": "Malware payload (SnakeKeylogger)", "value": "83cf1e923e2a5685f665e737d37cc2c9497f0495ab333e61839dff375cc3c68ed652ff1565d2a503c85cc1a21c3186fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688064, "uuid": "17a398e4-5a0d-4963-9806-6b869f213d86", "value": "T17554F189A6D8B1E9C16A4FF56D25F22013707D26649FEE1D2FC0B0C909B67021276F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688064, "uuid": "129a169b-fb24-4b6f-b190-ae815a3eb6b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688064, "uuid": "149c0f2a-510f-4b99-8d28-5cb9566843c1", "value": "6144:4xtvJ/xa9xWkwfA2McgU7JId10LhrQa854qgYbOKnImWy:GFxQ0K7U7JY1gm4wOKnIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688064, "uuid": "10d49a24-198f-4084-8e7a-132146464c3c", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688064, "uuid": "c6368f79-5539-4628-9cff-9a5126b3a3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688064, "uuid": "ec550daa-432a-473f-a38c-1e75c04a8e43", "value": "obi cash snake crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf60a4f-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645696541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696541, "uuid": "6f3b553c-a42c-41c5-8cbf-e6016e2217cb", "comment": "Malware payload (AgentTesla)", "value": "2df5ef23885fba686674e5cae041f7a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696541, "uuid": "8e202448-3050-4122-b46e-942a0d1c1d90", "comment": "Malware payload (AgentTesla)", "value": "afcdb64a2bebf1aa6af630243052694bd98950945c8aafd4eb1c1cb27dfdf315", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696541, "uuid": "1ad1954a-8985-42a8-befa-a48c62b66661", "comment": "Malware payload (AgentTesla)", "value": "9efc305ba3fb0490e1c110c5714e0780095abd4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696541, "uuid": "1b8eebd7-6878-46fb-b954-75896ec3b440", "comment": "Malware payload (AgentTesla)", "value": "73563b50c17ddc7d3492b0e51fe7bfb475174f80a0e27d981ab42889288dc95cae324b7d3bea71d6b4a4a1d440bc6ebf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696541, "uuid": "1a112468-1a12-481e-9018-26e3ce4cb9ad", "value": "T1A474232DB2C0B8B3F88743B355ABB35D48375A471181BE2F4F3CAFBA26215171295B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696541, "uuid": "6ff61678-17a8-46d0-9933-0fc636d1e2d5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696541, "uuid": "71867517-8093-4f50-9d71-9eac2bc52f84", "value": "6144:TxDI3bLw82FKKpJc4XMT9FuUgr4dcsq8Qa+iH+As37J/vM2Hkup:ww8NKwT9oc+O+PL93E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696541, "uuid": "cde933fa-3d04-4a8a-bf3a-1de35afa8025", "value": 352629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696541, "uuid": "f77df767-4e6c-4632-979a-bdd562646283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696541, "uuid": "2eda2328-b7b2-4d7c-bf72-427f70ec36f2", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09395d4b-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1645688428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688428, "uuid": "059e7bef-e702-473e-85e9-f7558a896199", "comment": "Malware payload (Socelars)", "value": "bff3190080d2b4d8284e0174233cbe65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688428, "uuid": "6daeadd2-b18d-41af-a693-06520379191c", "comment": "Malware payload (Socelars)", "value": "b0530e38839e47054bb12621a5f52276b85318d7d3f5d3c014edf04acc02d58e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688428, "uuid": "151172f0-971d-4033-be56-e8bc4be8c8b1", "comment": "Malware payload (Socelars)", "value": "027c6744cfeabb420b706835fc97fbef4f547eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688428, "uuid": "34d7e51e-1631-4317-a15f-c9a6020d292e", "comment": "Malware payload (Socelars)", "value": "49f18d74fee31b5162f6b7f41cb1daf3836a167a3f8a627e2e85f09cbed87d4d6e7d44a63a93efa6f2a1101db75090e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688428, "uuid": "62eac40c-29f8-46c4-89bd-dcc76d69774b", "value": "T176658E16E6829036F8D7087292BE1ABE8D2CAE51031850D7D3C47B695BF15E33F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688428, "uuid": "467312f1-b5c2-4d7e-825c-30d5b018d4da", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688428, "uuid": "adb17a9f-8565-448c-97e4-56610b9ebc9a", "value": "24576:DOpDAMk2izEnuE9qHx8vLKQW5jssUZsMkvvnXQ9YpXC9Kxs:ip7eL+ev+EvnXQ9YZpxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688428, "uuid": "372153fe-4c0a-4a89-907b-a22e9620b56c", "value": 1526272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688428, "uuid": "00d88812-1702-4432-82f9-6138f9bc8f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688428, "uuid": "d89acd63-9aac-41c4-8151-169c22ec8970", "value": "bff3190080d2b4d8284e0174233cbe65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6104cc49-9547-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645689434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689434, "uuid": "aa8984c1-70e5-4db0-b1f4-96908126452c", "comment": "Malware payload (RemcosRAT)", "value": "b97f7809ec6dc6d0e5f4e0d444082c19", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689434, "uuid": "2e6f20d9-a7ff-4ca4-932a-04d7fb91a813", "comment": "Malware payload (RemcosRAT)", "value": "b0ac37aec0eef942e0ff9c35828584b8d887f951ec13afbd80cdc4ce23595ae4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689434, "uuid": "adf3c432-ea8b-46b1-a6d3-68115522967b", "comment": "Malware payload (RemcosRAT)", "value": "12521eca4ed1a2a18f5bda2c167947ac0afa1797", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689434, "uuid": "8edde785-a595-4ff8-9107-e58896ec6e31", "comment": "Malware payload (RemcosRAT)", "value": "e6053062fdd6ac4328a20f1ade67781012144d02ec8b5c2b475664c7387fe8ebf6904f61edfc15b4b75cc0406187acc5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689434, "uuid": "d08b64e4-1e6b-406c-8c09-5ca4ecee3f35", "value": "T1AD51550F7463B53495273BA1EC0FA42ED8B0628771348464BF18A7C44D394ADEBCA9ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689434, "uuid": "38fb020c-9946-4047-98fc-ee3c97c8677f", "value": "48:XOM/j1YzNmSpP2YG52I/9s7A/zrOnKV/+cxvL2vz+jELAKl8qqHytT:Xt4NmSp4oI1s7A/PgKlZ9L27+YLZlFqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689434, "uuid": "a4c2ccf2-d6a2-4fa0-9b08-8c23fc245e13", "value": 2548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689434, "uuid": "d68c646b-47aa-41e8-9380-4771ddbaf6e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689434, "uuid": "e3d9d18f-99c1-46d7-a298-24bb861ca968", "value": "Protected Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f642e698-9541-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687107, "uuid": "c17fe9c8-09d6-4c1d-8adf-b1a77e3fd958", "comment": "Malware payload (Mirai)", "value": "f26ba2a363690ad5f8b1c3eac00a4284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687107, "uuid": "1de5fc62-8723-47fa-87d1-426a6c3211ae", "comment": "Malware payload (Mirai)", "value": "b0aec1fe57e76d7ff70421c1badef42abe9fc41ef06caf51036ace117abc41d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687107, "uuid": "6b41d7c2-9880-4f2f-9b51-ae11731dfaf5", "comment": "Malware payload (Mirai)", "value": "a20da0124ee5d6b7d3eb803c1f10e350e9530afb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687107, "uuid": "3e301b8e-6a25-42c5-980b-d2eda127a43d", "comment": "Malware payload (Mirai)", "value": "5fd43712549cb395982a81938ac7e31a7c1c875634085bb1d420d0bb5ddeed64616a1cdaf116a65735ea71033f73bd27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687107, "uuid": "623237fc-02bc-432c-98f0-ab918f0d63c0", "value": "T1CE833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687107, "uuid": "28b6cd83-2561-4dc4-8da9-13bb2406229e", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LQWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Y82oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687107, "uuid": "5caeae79-47a5-4cd3-9ab9-14acfaf081ef", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687107, "uuid": "7d7ecf77-d9b7-4c05-b6f0-c0959194b24f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687107, "uuid": "0461d741-5a04-4e2f-9eba-431963c2e335", "value": "f26ba2a363690ad5f8b1c3eac00a4284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53271a1-95ad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645733464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733464, "uuid": "89fa1341-be41-4a29-96b3-b932a8b1748a", "comment": "Malware payload", "value": "ce9fef65f245b2744fa27e472c364268", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733464, "uuid": "25a6b30d-ca21-4baa-af84-b021cb31665f", "comment": "Malware payload", "value": "b0c8226dece2adf88c16588e2f06d386e53ead45f382ee3a83b456f6cb693902", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733464, "uuid": "4cf805ec-1e58-4c47-88f9-8f9e372180ab", "comment": "Malware payload", "value": "6409ea25dddbe9642214d9e1cb7bd819d5ee06f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733464, "uuid": "2967c744-01a6-4e63-98fb-1ab9416f384c", "comment": "Malware payload", "value": "3a3621490295158b62c2c28047b8a1b9853e780214e41db331950c5c9e61fd00cb988b5972a31b3ea4d139e1dd6fdb88", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733464, "uuid": "ccc62d13-e204-46e4-83ba-0f761553db7a", "value": "T158E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733464, "uuid": "8576720f-d52f-4614-a4cd-5524ed686d38", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733464, "uuid": "4959152d-0201-46dd-a6eb-a2248f83d6d8", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XmsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWma1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645733464, "uuid": "9afaca3b-7cb3-47d6-861e-1864da1c832f", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645733464, "uuid": "69c5e005-6afb-4ed9-a14b-ce67970f5551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733464, "uuid": "d2dff438-094c-4d1b-811a-331b09bb8bd1", "value": "LQI3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04517e74-951e-11ec-9275-42010a9c0029", "comment": "Malware payload (44CaliberStealer)", "timestamp": 1645671669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671669, "uuid": "dd4d845b-a23e-4e74-8e38-103df8ea50f8", "comment": "Malware payload (44CaliberStealer)", "value": "3909c36c9052af260e5f4c056ae4ba6b", "object_relation": "md5", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671669, "uuid": "aced70aa-6f33-4a16-a4fb-e748b23ce4e1", "comment": "Malware payload (44CaliberStealer)", "value": "b10d9e9aff4691ad76def8f540df62e7a47c04290250a1489ad4ba08102666e2", "object_relation": "sha256", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671669, "uuid": "1336abee-6cb9-4549-b036-824dd40bdac7", "comment": "Malware payload (44CaliberStealer)", "value": "4c31486f9b43720b865e1123945372736ffb094c", "object_relation": "sha1", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645671669, "uuid": "05902f38-c764-45bf-b46b-69df295cb5dc", "comment": "Malware payload (44CaliberStealer)", "value": "0c819d1a06ee954f9b6e33dc2839616f2e92f13341ee97fbf4c90f565ee7c64941c0f1ca4cb47348fbd7a406f6fb0dac", "object_relation": "sha3-384", "Tag": [ { "name": "44CaliberStealer", "colour": "#9FA835", "exportable": true, "hide_tag": false }, { "name": "44Stealer", "colour": "#11D02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671669, "uuid": "312a1f80-6148-4052-be97-9f4708954f7e", "value": "T15F544B0027EC8B9AF2FE4BB8D4B01265C3B1B466B83EDB4E6D4465DD2923740D945BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671669, "uuid": "2530996a-89f7-41da-bf43-37e344b4bf2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671669, "uuid": "32b689aa-6fb3-44bd-bd90-5431b95dc3b1", "value": "6144:1f+BLtABPDOZJc9VjFe6UlwYONlYeJalA1D0kqj:sZqA6UlwYylYe91Duj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645671669, "uuid": "60cc5814-01fd-4285-8531-8b1405c7f1d0", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645671669, "uuid": "928d021f-b432-47a5-bd0c-bbe7bb2fcbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645671669, "uuid": "69edf711-a42c-4f12-80d0-1d55932384f6", "value": "d0PtfMcv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5200d6-953e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645685619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685619, "uuid": "fe0f346b-d54e-4857-9240-2fa83e349e45", "comment": "Malware payload (AgentTesla)", "value": "ee3285ff67e332f329c9f09d98e1b9b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685619, "uuid": "31d31ce1-9582-4d0e-9dc1-4bdb13f7a864", "comment": "Malware payload (AgentTesla)", "value": "b13025ae25acf3ab1bee6f4651fcd0c4bf1b6685bbf40af3935caa5570ba11dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685619, "uuid": "8e9ee5be-f2a6-4532-972a-041dd6d71c43", "comment": "Malware payload (AgentTesla)", "value": "bc6ad5797773b508d853152227908af16b57eb4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685619, "uuid": "65fe8eaf-7937-4c5c-b555-f6391e81febf", "comment": "Malware payload (AgentTesla)", "value": "9f7c649fc560e10ac32ac2cd00a1008bb1f2a8141d5e4b7c6373f9015260a3d41134f5ce6a4621b6b34a41b1fedee249", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685619, "uuid": "b6403e34-6638-4cdd-b43b-c2f534de459c", "value": "T14205CF6039EB20DEF023DAFE9DD8FDB19D6AF13B220E71BA10460F564B09951DE12572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685619, "uuid": "90467c1a-dd59-4eb6-8c2b-48295827e3ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685619, "uuid": "4298f9f8-9f5b-4da3-939d-945528e92155", "value": "12288:HxkaqL0nuyDWUG2qPzz9ZujMz+P3D2YELxptMW4klqzrE1eWj7PEJgYnYz:HCtyWSC/ujRD2YELftSzrEwWvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685619, "uuid": "b49a900f-5429-4718-91d1-130b6ddf6473", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685619, "uuid": "cbfcc1a8-df05-40f6-8006-b1019afeed25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685619, "uuid": "fc58fecb-4b74-4b2f-9125-3a45e4c095c0", "value": "fq40nTqbrr82Ajc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf511b9-95b6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645737368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737368, "uuid": "a052f1c1-1464-4551-85a6-98c91bee5989", "comment": "Malware payload (RedLineStealer)", "value": "a4d3fc48e2a96e2dc10cf81acf99778a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737368, "uuid": "23b1b4ba-cabf-4d71-91b4-ef9c96655e4d", "comment": "Malware payload (RedLineStealer)", "value": "b17485bdb6b377c0c38ab3e2ab83572760ce6c09952506d9202a235b82021a68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737368, "uuid": "76fc81f9-7d15-438f-8c99-41c0e7b3e4b1", "comment": "Malware payload (RedLineStealer)", "value": "aed6c2b9e92e138d47bd89950b24c77692b243b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737368, "uuid": "3aa092df-c5cb-404e-8c4a-26b9a8241b78", "comment": "Malware payload (RedLineStealer)", "value": "b96b715929452288c22ab655820b584368e51289b9229c2719dbe873925cd5e97d7b2c23870e90f208f97c21eacf1bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737368, "uuid": "ddcd8133-3e48-4d02-8cc0-b92805c7b8fa", "value": "T18134AD517AE0D836D9A34E704834D7E4563BFC61BA60914BF794BB1F2E323A05726313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737368, "uuid": "cc417ecb-eb5f-4cbb-9c1f-ee43d8e52edd", "value": "907c8dc12dab258bb8f256a4965c3375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737368, "uuid": "c1193217-1225-4247-8a9c-7f1dbed8fa2c", "value": "3072:5YRNF2x6FE7jN6SkQF5Nzqey5sxkgaBChAyyM:urFRENH7N6+igavyyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645737368, "uuid": "9aa10d57-cf9b-43e9-9890-4c3fa07e845d", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645737368, "uuid": "b4e2543c-db86-4f1f-bd00-aaa61fc7e38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737368, "uuid": "1d3d970d-3c67-469f-b4c5-3ea21e1e83c2", "value": "a4d3fc48e2a96e2dc10cf81acf99778a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e3549f-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694170, "uuid": "50389985-f414-40ee-934c-1be1407fb6a2", "comment": "Malware payload (Heodo)", "value": "1433243e02aeb3e748511f2e9ed0806b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694170, "uuid": "f42f84b9-66bf-4dae-a423-de84547ddd91", "comment": "Malware payload (Heodo)", "value": "b17fd73ffc1756a3f41dbc32a12d886c00791f1faa40f791204aa9c5ec78e7bf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694170, "uuid": "8728d777-151d-4b14-9a9a-cdbbebbcf3e4", "comment": "Malware payload (Heodo)", "value": "1420c79e7e1c8adc34c854d81ae9760cde670a59", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694170, "uuid": "d0438333-70d1-4e7a-bfe9-26fbcfce7227", "comment": "Malware payload (Heodo)", "value": "d2fc7e4ad0c5a60da04f0b8fc0a2c17f66110bd8e8aaff571080b51b1d44f9ad0c2f8c644484e47595a263fc08a4bb99", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694170, "uuid": "2750bba0-a819-4102-8d28-5d9343e9a4b1", "value": "T11093022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694170, "uuid": "3eae65ef-e2ef-4228-a391-b469091cd5ee", "value": "1536:/QBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:WDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694170, "uuid": "a5fc8203-0fd1-4e75-ab82-605a70d8787f", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694170, "uuid": "d91fc65e-82b4-4af0-a852-fc401f8d1989", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694170, "uuid": "5f14f65d-102f-4114-a070-91062a5901b8", "value": "Opast Publishing Group_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac70e7be-95b8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738094, "uuid": "0216e1fe-3e0c-4ed1-b5ef-d91d99364ce8", "comment": "Malware payload", "value": "dd70760abff9ab2122cf281a7d3ec93a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738094, "uuid": "5fdbe3e9-65d3-4cfd-a870-a607aba4a3d6", "comment": "Malware payload", "value": "b1d789966f41ece032f3f523b73c1a4396a0161d68e9119d4f4dca2693b8e3d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738094, "uuid": "c1d65a43-dbb4-43fb-9f99-d4bcb0021802", "comment": "Malware payload", "value": "53caa3f798b06ba6bed80ca3d563c6fdb7d08aed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738094, "uuid": "6430ef31-db25-40ec-86cf-bc4f63a68c3f", "comment": "Malware payload", "value": "1719c6d5a2824e90e3cc0569dddf09dd6e347fb175eeb2f49f6104009332c0f960826a069802d47e730381c4bae39519", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738094, "uuid": "521ef836-1c99-41f0-a931-ddd8714256c7", "value": "T185E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738094, "uuid": "32fa62dd-26ac-42b7-b68d-83f4edfd695d", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738094, "uuid": "6c62f64c-5539-439b-9ee0-4ada88ef1c2b", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XhsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWha1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738094, "uuid": "211f23a6-7a41-4a1e-9f80-4545861a418d", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738094, "uuid": "ca870b1c-6734-438e-aff6-8e25e0d26231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738094, "uuid": "9cc4a8b4-bf3c-4d55-b20b-8eb86a8df193", "value": "dd70760abff9ab2122cf281a7d3ec93a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902afdcc-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645688654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688654, "uuid": "ccd0acd1-8416-4b88-b51a-7af946345f65", "comment": "Malware payload (Loki)", "value": "59eb8977725a1ca6e65b27c9b43e9499", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688654, "uuid": "7afe8227-c044-4c0c-82c1-f7fdb58bb5f6", "comment": "Malware payload (Loki)", "value": "b1fe058917b1d75aefbbf973bc920245ed4f2a85aa9ca577f22c2f57cd65f5c7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688654, "uuid": "5c30edf4-d9f4-4356-9698-d65741090da6", "comment": "Malware payload (Loki)", "value": "92e226cf2808397b870afe4cbabda5502c7b9f37", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688654, "uuid": "9770bd79-d4af-49c5-a75b-d8bdfe5e4b33", "comment": "Malware payload (Loki)", "value": "e01c77bbc1a0ceeb8a0c37c9204b45c3ef4bd648c5ec83d353ea5c4343102d6f50e38367f3f91ca55399a2bbdcea6995", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688654, "uuid": "24f5a82f-c308-4822-b8b3-6c707a5e9289", "value": "T1271402033FD93797F205AE39FE719562110ECC238665A93F9890B7A80FF156B1742B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688654, "uuid": "863d2194-f5cc-4e29-a02b-7a3618b72f60", "value": "3072:ymwKZdEHB90AroCqzZSx0BWwe5G9NsawrjPFW1/QBrDTlU84x9x1iZtRBh3BKSMC:ldk4zzTg0UXkyrDTm84x9xkZnnMSGn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688654, "uuid": "3497b1e2-7e92-4078-b8cb-e1a136048b02", "value": 191144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688654, "uuid": "2937c794-bec7-431b-8bab-5062e7b33033", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688654, "uuid": "8d03d95d-f1d7-4db5-8a3a-14f9f5fbbebf", "value": "USD111,203.00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df199b44-95c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645743333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743333, "uuid": "0421b6fd-13b8-4416-89cf-458e10eae1a6", "comment": "Malware payload", "value": "e55a051b4429447b5aaf2ad9c168212f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743333, "uuid": "f24cb161-b28a-46c9-bb4b-771fe4c24a13", "comment": "Malware payload", "value": "b1ff0dea7b88c3eb4d90f54b4ed11421deda0b79ed6f252b28fc9d399955413d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743333, "uuid": "83535c5e-e745-4267-a389-a74d9abb8d3a", "comment": "Malware payload", "value": "31a584e4f48e9bfe438bab1103f406f8941d914d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743333, "uuid": "3ce69633-ac00-4568-9724-bd38e5f2ac87", "comment": "Malware payload", "value": "24776fe2551b0ef7a539a2e4afcf1b30043836f79ac164a81ffac1c441ed61e93cdcf103b71fafdb97b127c66e3a97ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743333, "uuid": "4b173b3e-9b6b-48eb-b9c0-f9fcb1e1228a", "value": "T13535BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743333, "uuid": "8d21f0f3-c04c-49da-829a-e64af6323794", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743333, "uuid": "902de6d3-287c-4cf0-9800-d7224d75a5b0", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uSVOe528JO6PC:6iRGcUY0UvDYNFtui5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645743333, "uuid": "6fa71f4a-5143-43a3-bf10-6b355e19a960", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645743333, "uuid": "2e32c59a-f03a-494b-b48b-d0d0a0a5a84e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743333, "uuid": "3b127cbf-2e1f-4190-a3b5-cb4b7001ca11", "value": "e55a051b4429447b5aaf2ad9c168212f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853b88e9-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645723425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723425, "uuid": "ec977ea5-97e9-4230-99d9-e1cb230cd220", "comment": "Malware payload (Formbook)", "value": "312c90c5dd2f309e66f8886a79b0c972", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723425, "uuid": "885e4c8a-af15-4e2d-b003-f8da88f6dbbb", "comment": "Malware payload (Formbook)", "value": "b208a4a53f2622d6c62ecf258987a2038dad2255739f089e8994acc8f6ea0026", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723425, "uuid": "b63ccf37-b5cf-42c4-b123-01bce3e0be71", "comment": "Malware payload (Formbook)", "value": "511f01de6de6005e2a2e46cd8195b54f7587523b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723425, "uuid": "22605c5b-395d-44cb-965e-8cb8adad25b0", "comment": "Malware payload (Formbook)", "value": "ac2c4fe61049042235f7bcf5176ab9be85d5166e3331d66e75ed1b2dfe024dd381c8197e05512669abc237251fe28b52", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723425, "uuid": "990fdf8b-7590-453a-9d81-f33d2e1573c9", "value": "T12B25BF56BECA6EA1EFBF47B78360D6290126736E03A197CF7603049D3951EC2443EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723425, "uuid": "3f8f668e-3395-4d17-813d-3db8098ab91c", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723425, "uuid": "090cc812-bc0f-4912-a7eb-3f032131eea1", "value": "12288:E0WwOIMiR4ye8bzbBSrex5A3FgGdgzmJGuDUFRrQpZiMAV4EevSwI4c40NsZdGVu:E03XX13A6qgzdOORkRAV+VT0+ZgAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723425, "uuid": "826082a9-68b6-4d86-8f6b-1caf26fd3d7e", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723425, "uuid": "a60ac7ad-966e-40e7-9570-101d360c6b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723425, "uuid": "341cfd2d-2c22-48b0-b35f-a0613824e65b", "value": "Purchase Order_VP-SYM102021 P21060008.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5847cf49-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696291, "uuid": "e284e76f-7fe0-48ca-a9da-58e4b6a66d96", "comment": "Malware payload (Heodo)", "value": "7df3e7a4587d7dce566a9b67732c900b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696291, "uuid": "626b9b83-54e3-48e7-bb51-1658d02bbe13", "comment": "Malware payload (Heodo)", "value": "b29517f583aba8ddf296f988ac3ecd282485ef037a69a1941a67fa3169fabf17", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696291, "uuid": "62d91800-fd25-4010-b3e9-0a49e3a7e1b3", "comment": "Malware payload (Heodo)", "value": "fe2b4a1c5ce53fb4371a663ba10f90e16b4b462d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696291, "uuid": "0889e1d5-e394-4572-9f70-3cfa83e035ae", "comment": "Malware payload (Heodo)", "value": "e7bdbe17025a7883d2dca2f74c833649ce77ee1fac8180acb2a3a2702f00d33f03869e9301fbcbcab6a3d1d5b871bc60", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696291, "uuid": "3b4a5b95-356d-4f58-921c-00524b78173e", "value": "T101E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696291, "uuid": "2aa2e30f-ea9c-49c1-a2d2-e0350f18572b", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696291, "uuid": "28599043-4d18-4993-ae87-7dcb44c2f203", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK/e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK/LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696291, "uuid": "f74f5b35-bed3-4dd7-b67d-2594961ccdbf", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696291, "uuid": "7dc31ef4-4392-4417-b680-16cb31d2df6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696291, "uuid": "e55000c0-e485-4e31-be40-500465d98a8c", "value": "vsFwyuALFk2cHX.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0466a57-9595-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645723041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723041, "uuid": "897a80f3-0cc5-417a-af60-84bf3cc79ea8", "comment": "Malware payload (RaccoonStealer)", "value": "788b1193c1e4a09903258e199f701801", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723041, "uuid": "d4995c87-3906-43a9-99dd-f9d55b2cd790", "comment": "Malware payload (RaccoonStealer)", "value": "b3f6afb079d5d25bea3a043d033091d5a0a8fde399c900a6337bc5e1dd65d279", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723041, "uuid": "234954c0-fb02-431e-9904-5328078e7596", "comment": "Malware payload (RaccoonStealer)", "value": "1bac02c18a6f4b6c19cd6f312d39bfbc596a4413", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723041, "uuid": "6a7232cb-e60b-469e-bd11-182aff9a7b1d", "comment": "Malware payload (RaccoonStealer)", "value": "82840a9ddb4c86c1bdc03673eb53482f6bb996fd7396bc5ade97949042572421b99d550c0de5aabb6adf045852dd7f8a", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723041, "uuid": "3aa89d77-3f6e-43d8-851e-944e68a3492b", "value": "T146C47E57F7DBF6B0E6BE867A86F1851C52B774620260A78F664072886D23382453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723041, "uuid": "e40d629f-0968-478f-90bd-ed7f1f3c2e77", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723041, "uuid": "260fdfb6-e289-403e-b1fd-3857322f62a7", "value": "12288:8n/zDvGHAykH8vLW/4+8bzbBSreMdsBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqj:OzbGHAzHKjX17BY4ZyrE7K3yl8PeVoo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723041, "uuid": "8f8d80d1-8f9f-4791-99ac-e8a7c425307e", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723041, "uuid": "a6695190-24f8-49d2-95a8-2bcb60b91cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723041, "uuid": "7a372445-7a2d-452f-95af-7cfedbbce430", "value": "l1342_Inv.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fee3f8-9581-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645714273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714273, "uuid": "6424b52f-e43d-4cd7-bd69-9410db7e0707", "comment": "Malware payload (AgentTesla)", "value": "de1442e0be14f69534cdd2111b0aec41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714273, "uuid": "d5d86f82-ba48-42b9-990c-f32f21d48811", "comment": "Malware payload (AgentTesla)", "value": "b42a0c5da64521e1a866eac89f218bc3664e6b2af5fca1016d4af5e3414f1ff7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714273, "uuid": "d23823c7-d6a4-4bd3-b446-2a609b727c97", "comment": "Malware payload (AgentTesla)", "value": "89744d1494272fb3e84b6229a9c1ca26e3d41e11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645714273, "uuid": "a0ec7da8-872b-4709-8e37-fe8abfbc185f", "comment": "Malware payload (AgentTesla)", "value": "0a2d18fd61b920272637c7719cd4953b4f44a8c058a4f12f7cc043407349ed5ada91867451a7b4ff4ecdacf02498d0ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714273, "uuid": "46473934-5287-4c07-a76b-f2a299aa8290", "value": "T1A2F401283568BE77C53D04F8D862395503F680766092F2C96CC7B4DF26D2BDA0E62D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714273, "uuid": "b34a5858-f813-4d73-9f76-ac2444e3d0cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714273, "uuid": "81861627-b4d1-4b94-819d-490b3e1bedf8", "value": "12288:I9E/7RE3DgTdObeXPO+qqmZdLYXSnxAJ1e4P1sDHQgM3ZHFQ4f7Ka4n2FPdM3+da:H7C1bEPZCdLYCnxW06sDHQY0794J+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645714273, "uuid": "e75800ea-3b5d-41de-b54b-6e25062fcefc", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645714273, "uuid": "94d2133a-b8ac-4cb4-ae85-5ac7c3e08c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645714273, "uuid": "db354bb8-9eda-4181-baa1-813c26a54015", "value": "grJHFpMFgOUFi2i.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaf46e4-954c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645691737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691737, "uuid": "db40e947-74ef-4d8b-b99d-4b81ebfa0c04", "comment": "Malware payload (Loki)", "value": "34651275457c3d596c0c522b0e589191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691737, "uuid": "91cf99d6-79e2-4a76-a752-649d9d082470", "comment": "Malware payload (Loki)", "value": "b4aa7f42c90ef0d7aeb8e471510c20a1ef364ac16aa07ecfbbb80335a84d2db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691737, "uuid": "0bfabb76-ef98-41c0-948f-05b17842c9cf", "comment": "Malware payload (Loki)", "value": "8f2f2ba606e0352a43e33155beb5faca3bafc2fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645691737, "uuid": "771fc19c-9ad4-4f40-9a74-7a6cdf838bf2", "comment": "Malware payload (Loki)", "value": "11913926b73983a85ba7f831d382e80258ff359572a3671e9b38538f3c6f1d8b609de8584fe9d88fbe73f40d3a3a8d3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691737, "uuid": "6ded11f1-0f86-4e51-8b86-757e8fa8ced9", "value": "T10364122B29D48C67D261C13229B3E272D2F9A1F9093110275F805FAD3D165DA9F93BC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691737, "uuid": "4d037ae8-dcea-4580-b421-4a5b7397b7b1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691737, "uuid": "7557797c-0947-46ee-b35a-7a33185bd320", "value": "6144:TxD10sSrT4foz8FtB9KYV6zJ49hlxrKaqn8a7vs/xJt1EeS99lIJ8QLcgkLy:v0sY4f7trr4zaXlJs8a7v8t+eS9/Sggz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645691737, "uuid": "e2bedf47-da90-4658-ac4b-8fab6e54e5a1", "value": 318395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645691737, "uuid": "4429a777-8657-4c95-99d8-99bf1a8de857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645691737, "uuid": "1f368f32-9148-4f74-823e-0ddbde1c2314", "value": "34651275457c3d596c0c522b0e589191.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cb7d90-9561-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645700629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700629, "uuid": "06aa1458-2670-4ac9-a42d-e922fb7016a8", "comment": "Malware payload (Heodo)", "value": "43c92d1146828677cd9603018edae917", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700629, "uuid": "6c64832f-adc8-49f5-bf69-da18b1be9eea", "comment": "Malware payload (Heodo)", "value": "b4ad7cd31b58b58cb2a63d3a8d1e2ee84f1c711711133c825a1340a35bf4915d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700629, "uuid": "d6a9c54b-41f4-49ad-903a-dad66363c40f", "comment": "Malware payload (Heodo)", "value": "d0e5f124e960aea1c49e476b1d52d47f25ff4e06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645700629, "uuid": "85ba53bd-7d1f-4342-bb2c-784de6e9a868", "comment": "Malware payload (Heodo)", "value": "23189ef9a76f5d50f4a2be486e5e43b7ced2afedcc2983a2ae4b4cd410b6bb11d2994bfdb7e16edfc3e4006753614cf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700629, "uuid": "2ca7834f-d8ab-4c21-8ba9-75d1c552b523", "value": "T190E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700629, "uuid": "947afdf1-2815-4beb-a606-10204d5430ec", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700629, "uuid": "346bf01a-9acc-4c47-8307-2f8a2e761d8f", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKYe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKYLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645700629, "uuid": "6d827f5d-0a5f-4cb4-9210-ce6c930e4070", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645700629, "uuid": "5d43033a-4364-4b42-8d90-8ce7a89623b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645700629, "uuid": "2a96849c-089b-495c-bf4f-8417ceb69815", "value": "43c92d1146828677cd9603018edae917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b97f98-95b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645737364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737364, "uuid": "9fdf25c3-209c-47dd-9b12-64a4499c4e36", "comment": "Malware payload", "value": "7d0a6830be170e64211a292b41c8581a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737364, "uuid": "9c681777-3381-4823-b0e3-0706f1627211", "comment": "Malware payload", "value": "b4b06c1c41764fe5454d5193994e76b4de2d34086d5a346c82bbea42eb151d22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737364, "uuid": "63ba37c5-da2c-4374-a84c-74c8723a9323", "comment": "Malware payload", "value": "a0ee950c3a62888df39357b6c414e7c8efa7c14c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645737364, "uuid": "03593be2-caf8-49bf-b01e-f22bff17f182", "comment": "Malware payload", "value": "4c12cd5c5df3a02fe8e522124f2a8c07ee6a9536cb924af11967fcbf4f1fd3d4397a8025be34903646437e0beb5354a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737364, "uuid": "837e506e-ee9f-4092-9f66-7991fbb174e9", "value": "T1C0E4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737364, "uuid": "23db2203-baa8-44a7-be62-41485ec3f79a", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737364, "uuid": "8be10346-9207-407a-81a1-a3aafd535f87", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKLKDYjX3rUXY:ygHpbVy97I0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645737364, "uuid": "6c333b74-4c07-4d8a-ae5e-af65f6c6470c", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645737364, "uuid": "e878ac87-0288-4925-b09e-41bea1307cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645737364, "uuid": "0b9a7c15-cea5-435e-b396-4183421fb328", "value": "7d0a6830be170e64211a292b41c8581a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7fb327-95ad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645733316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733316, "uuid": "6eeb9ac3-b923-43d2-b96f-34eee6177259", "comment": "Malware payload", "value": "c02d03552d06176cf8a8aa3fe30be6ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733316, "uuid": "c796130e-a2cf-4914-ab78-f5fb9816492f", "comment": "Malware payload", "value": "b586ebdc4aa152278b9f39661e78dd9909d36dbd916dfddeea4d8f9faccb4f9f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733316, "uuid": "f6e3682f-5635-4047-a06f-69caa21ed32f", "comment": "Malware payload", "value": "2b8dc0896cb9557cebb3ce0b73edb16177b72e64", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645733316, "uuid": "6effee69-a7a5-4fea-972d-594b64e54dd3", "comment": "Malware payload", "value": "36b631d941f446e840d7101a36dd7767008706b7b0c21e976ae49640394e75b06e347a0f9d3a34acd6318e6b6c798b1f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733316, "uuid": "911faa97-ad27-4145-a8b0-caa930dd9af2", "value": "T13B93F11A94B1FC2DEF17D8B8D1600DF5F52B108642C1DF5C91A1BBADAE03DCA4B6E489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733316, "uuid": "c872975e-4be4-4901-be00-654b35b3bb79", "value": "1536:7DPXsQ5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVxW:7zeDsVhonV69o2bchgGaWBcpAWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645733316, "uuid": "b47c108d-9330-4f55-9b57-8308a16ca165", "value": 97088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645733316, "uuid": "c903e77a-1127-4d84-98b5-de40af7e15d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645733316, "uuid": "af4f4c56-15d6-43c5-b0ca-7bf36d6cad33", "value": "MAIL-5.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f483b83-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1645723254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723254, "uuid": "fff01f99-0d08-4a45-92bd-fa6ce6db1d3d", "comment": "Malware payload (AsyncRAT)", "value": "a50ee666ef98a5b05cfad2f996c3e2f5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723254, "uuid": "86362f6c-c4ef-46da-80b3-a863d13715ee", "comment": "Malware payload (AsyncRAT)", "value": "b5de9e20c383c72a07893a8652543db25dc7e42f0377da435123b13c636bd2b2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723254, "uuid": "68f9ee00-2fb7-43b3-8ec8-ef9bf613f813", "comment": "Malware payload (AsyncRAT)", "value": "a841becf01ba9fd6a43cb7cd361e738f25bc99f9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723254, "uuid": "ee2f9a82-7c25-48aa-a9f5-7515163841a4", "comment": "Malware payload (AsyncRAT)", "value": "3b94aba57575c8b69c977edd25c4f29a8968fea973f61b124d03b5e46650a38cc990b4aa6580226425d8994c8117dfea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723254, "uuid": "00aa281c-199c-49d1-bf0b-78672c8af466", "value": "T10EA4125AA85CEB37C1A0A734C0538BF72A745D22D900B78BB7447F4AF9B4F0858F9952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723254, "uuid": "3df5a594-a166-400c-8c1e-bad3f94e4923", "value": "6144:xt9ILyI28sdA+az3cZXxAucQirBxf0KB6KVXqt1WpVirWwmW25kof:xiWABrMX66DWpkrJm7ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723254, "uuid": "e28dbec1-32a0-493d-8ed3-5e6a4223d392", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723254, "uuid": "a2f5dada-a615-4638-9857-d1c925de142b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723254, "uuid": "b6f57f71-d7bb-4fbf-9bc6-25e3d6a04717", "value": "a50ee666ef98a5b05cfad2f996c3e2f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a68a0cf-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687705, "uuid": "39eafaf8-a1c9-4c64-a18b-f263535ac431", "comment": "Malware payload (Mirai)", "value": "1a8c7cb9326652aca5a5ae91fc63e822", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687705, "uuid": "5cd734e9-3ea2-4bae-a214-9a5f7fd22eeb", "comment": "Malware payload (Mirai)", "value": "b627992ac0d9082c3755e615383780ecd905cccc2ea4e912484600c84122148e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687705, "uuid": "6bf3bb48-57aa-4ca4-85ec-e00c918947cf", "comment": "Malware payload (Mirai)", "value": "d8dfe89e875118c6ce4c10b9090bd0744834bc36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687705, "uuid": "4c056e15-754c-4893-a49a-65c963e58a6d", "comment": "Malware payload (Mirai)", "value": "69310f017ea90e866ab4116e6af6c7774c87ed8ab112f678fd55066cb9930742f5c69cf5aec8b218415dfbbbacfb8e29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687705, "uuid": "ad59299d-b163-4462-bb75-2478a8934b4d", "value": "T12FE2E136E1ED4202C57F567215DB7E0E58D2D61BCBA0D2DEE9C4B0384D8AF1E262C3A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687705, "uuid": "be89262a-8339-4484-ade8-4ac4dc18a8ca", "value": "768:9mBN05wmS2ba2EMuCD8xBQX6N23WHjNZVW8OUaMnbcuyD7UHQRjq:9mBN0qoba+ZD83QX0zWFUaMnouy8Hy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687705, "uuid": "6eae7c1f-bb51-4802-a244-dc7b9edb780c", "value": 32776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687705, "uuid": "4b78fe82-0523-42b2-abd6-b8b8326a0d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687705, "uuid": "b426673c-4f59-47d1-a885-4e87c22d90ad", "value": "1a8c7cb9326652aca5a5ae91fc63e822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3976535e-95b4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645736183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645736183, "uuid": "bf822d2f-7254-4a24-83a5-02c805753068", "comment": "Malware payload", "value": "f493d784d06d6ecf87d38152146aa85c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645736183, "uuid": "9094a51f-df69-4bd7-a01d-10e6d2924ab2", "comment": "Malware payload", "value": "b6c115a3579945890f88e9228c334661cfd7568e37299acbad11c0836f71379a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645736183, "uuid": "03ddf01c-70c6-4f7d-8f8c-fe912ac3d72b", "comment": "Malware payload", "value": "bc426caedd1a210e8bfd8974a1efb5774823257c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645736183, "uuid": "17ef7868-0718-453d-b0b5-381e28671215", "comment": "Malware payload", "value": "15cfa1a1f1d582a283fb65ae3dfde4c8a09247d58dd59699498533e9ded9b8d7f860aff586c537ddfc508374064e1afc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645736183, "uuid": "0a394edb-818f-4710-8585-9fad755487c4", "value": "T116B5F183E386686FC9F7C33A46B5172E45974C56CB47D2938A75B33C68BB9C04B81B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645736183, "uuid": "089db9b0-f00e-4199-8014-5a795a2427d8", "value": "49152:YzL7ZBnlz6QWz9Ert9kWmNzQj4EYc5VZfuH9Z7ybg8058bdxZC+gSyp:o9Nlz6QWz9Ert9kWmNzFc/ZfSOg80yZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645736183, "uuid": "9498c5e2-359c-4728-8da1-3e2bbf8a666d", "value": 2354770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645736183, "uuid": "475fcf7a-1e2c-4b76-a702-32a39196c03d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645736183, "uuid": "aefb7043-4cbb-4144-8b98-61146125f340", "value": "\u0645\u0634\u0627\u0647\u062f\u0647_\u0627\u0628\u0644\u0627\u063a\u06cc\u0647.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5eb18ca-95aa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645732177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732177, "uuid": "6e924c72-fcee-4358-83a4-8d9e4b559de9", "comment": "Malware payload", "value": "e418c0748eb124ede9428b6eff1da3bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732177, "uuid": "19eb9717-a7e7-4c4e-892c-57f6da6de5c5", "comment": "Malware payload", "value": "b6ca6147d9a9129cc67d3817ebd878fad7b6a04fa1a0c6ea65a950a96683f534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732177, "uuid": "bd3be9e8-d3ea-4481-aa5a-85f7dd70a0ae", "comment": "Malware payload", "value": "1a5285cfe5644a16a392cc1c1e954fdb2eab2f16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645732177, "uuid": "250dd142-4dcf-47f7-98d6-04b51e67f7df", "comment": "Malware payload", "value": "288865e70d813c320465d4766f9a252ca27f4723ce849e8b632253498b19a710b4cfcec0cef548e75dd55af9b4ff7df8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732177, "uuid": "628b74bb-4662-4509-9896-4aa2adfdfb8c", "value": "T140E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732177, "uuid": "10be7540-b65f-4c88-9b9b-9ab044590408", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732177, "uuid": "40df47b0-a2c2-410b-a226-45e46b2aaac7", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XwsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWwa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645732177, "uuid": "3e533a04-562c-4ba5-929a-86256108ec67", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645732177, "uuid": "442db6f4-a3f8-4ee1-abdf-c2a6136f411d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645732177, "uuid": "5952f7d4-ff2d-42ed-86c5-ad2426ef8315", "value": "e418c0748eb124ede9428b6eff1da3bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce979b8-9554-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645694984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694984, "uuid": "2a5b6468-c6d1-488a-9eb1-7e5cb526be26", "comment": "Malware payload (AgentTesla)", "value": "5d541333cfa7862f18bc900c969700f7", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694984, "uuid": "bbd43156-5540-4d3f-8733-769313a1a27d", "comment": "Malware payload (AgentTesla)", "value": "b712c3d2fafff970527ea179c7adb8ce2319294e422b94bebe1c4fab00a3abd3", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694984, "uuid": "9444aa86-1179-4764-a818-bca9a12c8fa4", "comment": "Malware payload (AgentTesla)", "value": "acb8bf44020b81f4f33fe8260934d19c2077c617", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694984, "uuid": "706a33d0-7493-45ca-a735-05b257370a57", "comment": "Malware payload (AgentTesla)", "value": "444e62c024373b8c1a9267752e75c9b24e0ed675f5095595cf9fd7338685ac725f5908d0b8e461fea902d2318441b94e", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694984, "uuid": "36f2eb82-1ae7-41d0-9b24-d3c1f7d49d08", "value": "T112F43350EE0DFE6EE6325B19FF57170CAA5BB79A00149727F92E2B2C84604540F388DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694984, "uuid": "ff72749b-8486-400e-9805-3ecdca8a9e54", "value": "12288:9I2IKdgH9Q5aywON3o2l8+9ph/DW56UtoWyyQDlQyRsOGmn6q1+yEK4zg+WPkTQk:SXag+5HwON3oy9bC6wo3ayNGmZwzxzvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694984, "uuid": "d122a9d1-3b6a-457f-af71-fbe12947266c", "value": 733044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694984, "uuid": "64ccda9b-c5db-4d18-9a43-317d9498618a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694984, "uuid": "10b259d3-2cdb-412a-81ad-d10a0ae04d9a", "value": "INQM1376 ORDER 52032.PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ea11b8-9596-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645723450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723450, "uuid": "d7b9a21e-619b-44be-bdb5-41108d78c356", "comment": "Malware payload", "value": "24f6f9439b83ffe64004e9b3b2c46e86", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723450, "uuid": "2a557798-3d34-4e6e-b366-8403f71502a8", "comment": "Malware payload", "value": "b715ecf06a29721822c20c14ad6c6d4997996ad315a0556e5880ebb8568d2eff", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723450, "uuid": "32231f98-8d84-4b74-9843-274bb194d070", "comment": "Malware payload", "value": "f75d4840f8fa70953b1153ccb6db0e7924d6219c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723450, "uuid": "0e4a58ba-2924-4d13-89e9-e8beda38a9b5", "comment": "Malware payload", "value": "764a5def10b4ebc5f9014ede3e23df15c2c120b5008ae47ad7184414891db39b340c42491eed723516a287451f0b7cb8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723450, "uuid": "b680101e-4aae-4ebe-a828-2d03e293ba0f", "value": "T1E9E57B23B684A63EC4AF1A3A4537B7589D3FAB7169128C1B57F5088CCF354812B7E607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723450, "uuid": "9ac716da-3282-45e9-b018-5871c840f0ab", "value": "49152:gxCW60jJUbxi4deW2NDSLOtfIQIMrro6LTfmCbxt7OYyEA:mUFil2gro63mst7OYVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723450, "uuid": "63a3f77c-2ad6-4168-aff7-ddce794fadae", "value": 3156480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723450, "uuid": "7b420f8e-589b-4382-82d2-cb67ded1b349", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723450, "uuid": "66216556-6e3e-4df7-8f0b-f15277a6f56c", "value": "Archivo.FactEndesa2402.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab3ba6b-9515-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1645668110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645668110, "uuid": "ffbc4fdd-4f38-4d98-8c7f-0864f0ab19ca", "comment": "Malware payload (Pony)", "value": "0415e9e8594c110db1532e194f1e66ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645668110, "uuid": "d5d2f6f9-f3a6-40a1-8138-57cd3399bc68", "comment": "Malware payload (Pony)", "value": "b7c5c6d942e93d38b8ed16d04526050fd621fdb2c7ea9f0789446949653812da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645668110, "uuid": "3c967ade-398e-4fdd-ab0a-392775c3cb56", "comment": "Malware payload (Pony)", "value": "e6116ee06369e9229338eecee908d0da11900233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645668110, "uuid": "b8aff6ef-46a7-4499-979b-63e252e8f35c", "comment": "Malware payload (Pony)", "value": "912a16b888e9a4eed2115a1234aea7bffbd0f9fdea99c373b80f5169ffb38cf27a7689aa37a7914f5f8aad86d0f67237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645668110, "uuid": "eb691b32-955c-404c-a2bb-cec63469fe5d", "value": "T1F444C026AF9A8E00E4C5C3B548076AC0B715FDD31412FCA9B51EBEC61F7FB855249A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645668110, "uuid": "1e214683-e6a6-4a2f-a3da-1f7d6d439e2d", "value": "24164be572684904ab60135af8861146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645668110, "uuid": "da3499ab-4cb7-4010-979a-41035e438a4d", "value": "3072:SU7gSEokF189eyXbHChUlif+tHroJ+7nb1IIckNxSzZH:SmgbXaHOUl3HrXnq0Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645668110, "uuid": "39e3f8c1-fba2-4bfd-9d8b-40311ed2cc2f", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645668110, "uuid": "ce890de1-62ba-45a4-b57f-4880caafa3a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645668110, "uuid": "3f762069-1aab-4936-92fe-3451b8d4d788", "value": "0415e9e8594c110db1532e194f1e66ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c3d6a2-9542-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645687189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687189, "uuid": "65de8127-73ee-4a7d-9119-6657e80deca0", "comment": "Malware payload", "value": "1c4536318dd22418a7c404f2706f76b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687189, "uuid": "d2e8cb09-0844-4c5b-b1e9-4d8ac4922d06", "comment": "Malware payload", "value": "b92954435c64b6f4866b55f050c60b5cde23752839399bc7939a928f68c97125", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687189, "uuid": "fc6c2141-e280-40c5-9220-910ae121611d", "comment": "Malware payload", "value": "53ddd82744110f6d8197efdb02b8384a8244b702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687189, "uuid": "8b6b5528-5a2b-4603-b643-e16872ee77b4", "comment": "Malware payload", "value": "0a58bf2252daae1e8cf87f7734383589117f82e85649ced4ecb920a8552afbbef4ee36c4e348d8610dbd1a0e2e6a495c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687189, "uuid": "454719ef-913c-404e-9803-e5b555d4f544", "value": "T1D2E402E0F6919875C001323D89D2CEE1497EAC61CDA44B4772B93B9F2E222D177AD24F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687189, "uuid": "a68f90b1-fd5f-4fbe-8085-aea976ec7edc", "value": "917b0dc587f632b60bbe39ab8c418265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687189, "uuid": "bba4a868-239f-4097-af0a-72567f16e280", "value": "12288:zKy0Y6vmX/lgJyQgmi2H9RWo916B7lytxh7k5of:zKy0Y6v8Vmi2H9RWoIqQmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687189, "uuid": "4208c3d6-8139-4410-b1dd-8c359082e3e3", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687189, "uuid": "4ffbdf2e-dc32-4e2e-9cbe-10f6f4b57642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687189, "uuid": "fd1f475e-3f82-447c-b7c3-fadb8f086c51", "value": "rolle.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1801084f-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660965, "uuid": "8a60b239-a803-4f71-8b2d-9bee60a15d71", "comment": "Malware payload (Heodo)", "value": "a7fdc01026a6b434883ca09ae04c058d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660965, "uuid": "581b6894-07b8-4f25-a5a7-3bb52eb0f033", "comment": "Malware payload (Heodo)", "value": "b9695b3376dec2a53685b822ff782fda0f0b001ca60c13f55c5f5675271bb422", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660965, "uuid": "2b71c9fc-c91b-49af-a47d-b329fba1264f", "comment": "Malware payload (Heodo)", "value": "70f7d221255fa7b79674c320ac50d5b26d996a23", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660965, "uuid": "21cca64d-5d7d-4070-b493-417ab90882eb", "comment": "Malware payload (Heodo)", "value": "3651ec8c25cb808c1045c10188456cbbece838adec00312f58001f817db8deb29fb13b78c8720abfa8d2a942ebfd4134", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660965, "uuid": "af44bfd9-7eae-471b-86e3-d308422f510f", "value": "T104E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660965, "uuid": "45d4450e-8049-45ea-8f50-da88a63a3da8", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660965, "uuid": "4da940df-c7dd-45ef-a490-a50befe18f85", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA09hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfHPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660965, "uuid": "66ba782d-d32d-4533-86d8-b548b3b6eca2", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660965, "uuid": "00a5e6e6-57ab-41ec-8928-98d1452efe91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660965, "uuid": "87a89022-fcb1-4cee-bcda-90172beef00f", "value": "emotet_exe_e5_b9695b3376dec2a53685b822ff782fda0f0b001ca60c13f55c5f5675271bb422_2022-02-24__000239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26c1eba-9541-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687101, "uuid": "0886d315-96b4-4d26-ac32-879602c158f2", "comment": "Malware payload (Gafgyt)", "value": "3fa54d78b5e6631960cf1f571c8beb5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687101, "uuid": "276c2795-43bf-4abb-a146-684b6471f97e", "comment": "Malware payload (Gafgyt)", "value": "b9ffb9a4541023c3bcfd43a4d2f1ed459c7d49a4031e34ccad06cc593dc30c87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687101, "uuid": "cfb2c9a0-7a3c-43f3-a4e0-0c81cd2c32ef", "comment": "Malware payload (Gafgyt)", "value": "80c98ad90d1011e4d35a14c1e028505b644e8013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687101, "uuid": "ca696eb0-06aa-43b2-93a8-15e3a551a3fe", "comment": "Malware payload (Gafgyt)", "value": "fa67bc15256736e90d79ae3a91337e7945cb31d544170126a5ccf2235d3f89cdd19149792e2a841beff9a14ae176db86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687101, "uuid": "f70f867e-a7aa-4deb-a97a-2be64346d369", "value": "T12B734947AD659FB3C056AAB525A759300B13F8215F0F2B89713CAAF8430F8CDB80E765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687101, "uuid": "f09c0787-8ef8-4467-a98e-a0321b918475", "value": "1536:8wSZ9Yf0KepZ4tyG1NaEVx7Cc3WMxGyNmj9VqYLe8f26e:PAKf7eYyGl7f3XxrNmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687101, "uuid": "fb84e1c7-cd79-4292-b05e-eb973ae3ad92", "value": 77746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687101, "uuid": "6f88aec2-8365-4191-ac13-77911a6df91a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687101, "uuid": "e86cb971-cdb0-454c-a66a-7ecf776fbaf2", "value": "3fa54d78b5e6631960cf1f571c8beb5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4321494b-95be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645740494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740494, "uuid": "0da8760d-c1ac-4bf2-809b-cab4ab8ba3a7", "comment": "Malware payload", "value": "897b11ac6ecbaae790b51ea7dfdc2383", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740494, "uuid": "c80e20e2-bf7c-4445-ad85-0c3d34506add", "comment": "Malware payload", "value": "baa61d3cb557ade33202afbe88b653a739f7e930807d7341c7e149bd791e7fe1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740494, "uuid": "1ed316e9-0409-4934-ae96-b70478d66900", "comment": "Malware payload", "value": "e00d82827e397a438cf98c7fc4cab8e91a953f16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740494, "uuid": "6e781f23-f62c-4b23-9c39-1ed32a1a19c5", "comment": "Malware payload", "value": "c160bad01d2cf860bd046a8ede11a1bd1d54dc9b702efbeeaa8702de391fccdb6c810b900eefd933e3fe7d248c7a280a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740494, "uuid": "2bedf17b-7af2-4994-b439-191f9d84c2eb", "value": "T112E4BE517B81C0BAC25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740494, "uuid": "f452a7f3-f41d-4030-8163-7ed7f87d4ccf", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740494, "uuid": "437f91a1-845c-41e9-b875-61448f4eac3d", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKEKDYjX3rUXY:ygHpbVy97f0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645740494, "uuid": "f69f2482-269f-4482-85ea-b6bac6135224", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645740494, "uuid": "d1286e41-e634-4aff-b366-2aed0233afe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740494, "uuid": "05ec3ae0-82ce-41a0-93ca-264774f31c1a", "value": "897b11ac6ecbaae790b51ea7dfdc2383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e118be-9558-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645696740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696740, "uuid": "8dd0f949-29a9-4c5b-85d5-59bb91b388c1", "comment": "Malware payload", "value": "0f44dd9fba832ece0b481c394bdc00ac", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696740, "uuid": "e24e77f6-6e90-4f2f-84e2-3c6004629163", "comment": "Malware payload", "value": "bb03d42a1d47557a1c40e7fb259a90b58fe4895302aa3dbe4c3439e567b74f00", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696740, "uuid": "0b29215a-3910-4ce8-861c-589d8002ef7f", "comment": "Malware payload", "value": "e57dad80d9114e85b059f1f8d7af36ae273a315b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696740, "uuid": "0294a944-73cd-4aa9-827c-6e51cdb33fa0", "comment": "Malware payload", "value": "94c40508744b8970327ef819ed4fe00a0b3502ab47cf7eea7fe0b0a02ee4c1fd89c5dde3897729355c57f63855a7b4bf", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696740, "uuid": "a7232f9b-958b-4ddf-8081-ef317dd2d0c4", "value": "T10DD095659E30E8CC434EB060C985251C34D10120CF761B7CC6150457D81CB8CC71D4CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696740, "uuid": "f433746a-238e-4092-9463-e2e35b548488", "value": "6:hKX9tSa2jkzozaqEHiO6snaYpXkGVokOMkz/cVxWpCY:hKNtSjJ2qEHiqnaYuGPOJ/SbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696740, "uuid": "b41e044e-316a-4b21-8744-6c7246427133", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696740, "uuid": "c3cd89e6-68e7-441f-8218-e36d3d2be0d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696740, "uuid": "2ea66409-cbec-40b6-a646-6482da3136e5", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086a2d53-9550-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645693151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693151, "uuid": "e08e05ba-6445-4298-923a-f78eac7dde49", "comment": "Malware payload (Formbook)", "value": "939fd6eba33a8269d46bb669eec9add1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693151, "uuid": "892da70c-b29b-41d5-8a82-9101e3075aac", "comment": "Malware payload (Formbook)", "value": "bb3c7c8fd106ec093136d2c42378882252933a0a5b1374f335486733082bc1b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693151, "uuid": "e7993ca6-766d-4cf4-8ad3-2bea57ce05d0", "comment": "Malware payload (Formbook)", "value": "750ccc54cf5d02811ce31be9a7661f0763ba2a9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693151, "uuid": "bb805d2c-d66c-4068-9ea3-ff28e2604fe2", "comment": "Malware payload (Formbook)", "value": "532220f21d329abf63b7d1e2ff9491213d461db3a5013ab31c50c91ce4f4102da80a5fd8272fa2d56bd237448666d3f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693151, "uuid": "03f3d40f-fc7c-439f-ae68-586e2d4fe3b0", "value": "T10864122E29D41577DBA2457401B97D2CE3F3AB0A238F765713987B2B37322670E58217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693151, "uuid": "fa3d4696-9f01-41b2-9f11-ca0e9041eb00", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693151, "uuid": "617fd39d-359a-4953-b3b8-45d91894266e", "value": "6144:TxDR47vX+zVPVyQbC4ach5hNqyy1+uFCaeTMltbK/Zm9bFdU:KvAVNyC5PylgaaPRsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693151, "uuid": "c821f695-f58a-4e73-9e6c-723394ec55f6", "value": 322503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693151, "uuid": "8f54c97c-0011-418a-a610-76c18b7c1d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693151, "uuid": "e9cb6c4f-fc68-4b2f-9127-3030c813d97b", "value": "939fd6eba33a8269d46bb669eec9add1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b380a4-9548-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645689863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689863, "uuid": "249c1e02-9527-44c9-a0f3-4d132ea3bec6", "comment": "Malware payload", "value": "3d80e021503d6d2fdc2fe0a3276ca2ae", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689863, "uuid": "ce814aa6-f710-4d2e-a96c-78ff8c034400", "comment": "Malware payload", "value": "bbb44a9c5be7ef07c67ec90c8a95b37cfa934299e9b45b76277c292128421238", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689863, "uuid": "698aa56a-eb8e-4614-8769-469f7678a06d", "comment": "Malware payload", "value": "202689fa9d1564e40d0460d3c2f2a8b58ddadb65", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689863, "uuid": "74ff8e91-62e0-4b1a-b57b-2c668da61e64", "comment": "Malware payload", "value": "7a247f231f3d76c307cf4f0125f1d21916553ef2c7b3d0668595524079a4377247bb27ed9a93b2054db9162e7cdc63a7", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689863, "uuid": "9bcebb33-5ba3-4eb0-8b4a-8838984f40ea", "value": "T12E13BF18C001110AC173393EC83899E51D579C67A12689DFE1EA794B0FA5DDF2B0EFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689863, "uuid": "e1578616-9a2a-46d2-8532-8a491cdf15de", "value": "768:N+MRD4S0JS00SneSnjS0yS03S0IMS0bS02SxD/PoVK5Z1lDVn3QFTy1xqwVwxyd0:N+2p75eAGAwBo1/K8NytsR1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689863, "uuid": "d2ce0ecd-19a0-45d4-b66c-f4505e5eae08", "value": 42618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689863, "uuid": "7a8a26fa-d915-4f6c-95c0-df089a53ff7d", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689863, "uuid": "c839033d-fc66-42f6-9514-3dfd4eb73b8a", "value": "PO415-2022.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8447e39e-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710538, "uuid": "7c289e1b-de17-4fba-9493-98cdf522d415", "comment": "Malware payload (Heodo)", "value": "6b0e838741f6e96c1d2b90939eb512fc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710538, "uuid": "e8f1131a-d9c3-434f-888a-46cd527c5f51", "comment": "Malware payload (Heodo)", "value": "bbd8f1816021640817ac979ea40509236b5abd8d67cf362c9829cf9a27dd2a92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710538, "uuid": "65b278f7-3c32-4401-bffc-7bd626137d5b", "comment": "Malware payload (Heodo)", "value": "a0042b123064f14bd42eb1e9cc6bf9c210093e39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710538, "uuid": "3e80ee47-7cc1-46b4-9a34-a150003a4aa4", "comment": "Malware payload (Heodo)", "value": "f07935e8ab0aa7a3ccec352422401bd313f1c1215aa7229f32e65d03d056af20dc3e54467936b7f5e37103dc5c32a981", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710538, "uuid": "c8ec721b-b85e-40e0-b644-5dbcadf6fb46", "value": "T194E4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E781C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710538, "uuid": "2c4a426d-16d3-4b1d-add6-6d80fda12992", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710538, "uuid": "32bc0637-c5fa-4da7-a991-bb05e6306837", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKSKDYjX3rUXY:ygHpbVy9710YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710538, "uuid": "9e5b9657-adb8-4d3c-963c-33e7ac0744a1", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710538, "uuid": "5963386d-32cf-4d70-8704-b6aabd5c280e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710538, "uuid": "9c50ab18-2985-4549-9eff-7cf5250f1a3f", "value": "emotet_exe_e4_bbd8f1816021640817ac979ea40509236b5abd8d67cf362c9829cf9a27dd2a92_2022-02-24__134852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c71039-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645688588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688588, "uuid": "58404d06-1936-4d43-8a40-414e819354ce", "comment": "Malware payload (Formbook)", "value": "4fe931a24b5f89a257e87581cbb13172", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688588, "uuid": "0f326e1a-d34d-4a8e-b00b-dfc4e818676c", "comment": "Malware payload (Formbook)", "value": "bc355a48f78bfac424ed97382d5a091f04b043871187c7f8b816b17ff50bc1d7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688588, "uuid": "213a2e29-e71f-40d6-bda7-1e606bd2a9d5", "comment": "Malware payload (Formbook)", "value": "a7bc86b2fa875c6c432c6b0eb50ac781ad38082b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688588, "uuid": "c958c7b9-3199-4184-ad9d-2630529ec6e0", "comment": "Malware payload (Formbook)", "value": "3971bee726e8716088028ab71cdb205f08390a21537a7e91b449c8b9ded0121ff724db811f4b3f1a3b5ef9b545e2e166", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688588, "uuid": "1423c46e-4fce-49ae-a900-2d269deeac45", "value": "T1EB140291B3BCC037F7E89D7C552270E42339EC5F6FDE95894891B6EAA13D92190D8223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688588, "uuid": "77b54f17-87c7-43da-976e-70cf17d5d029", "value": "3072:otpBrNu25q++lBSXh9Y2p28uogVAoYMIJA+0A0Dk3jmhWUvqQ6LSFfGy/BL:EY2j+veZ28lSux0o6hFyVLgfGkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688588, "uuid": "aca9e9cd-8664-43bf-bc0c-92bd4d91f72e", "value": 191064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688588, "uuid": "327c5722-6069-4051-92a1-1756d2af7088", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688588, "uuid": "9c9e6363-c4ab-4956-9d3c-f15646b4b605", "value": "Fax_1118-081312-109.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25e7cd9-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645688362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688362, "uuid": "01020a55-df07-4b17-a3f6-024f7ef42351", "comment": "Malware payload (RaccoonStealer)", "value": "4cb40a5915b998c9c70b71e6b54de912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688362, "uuid": "cd4d5424-ade3-49ce-8e7a-e66efa64a744", "comment": "Malware payload (RaccoonStealer)", "value": "bcba37ea39dbe60b1dd38557aaccf5aca3d6e2d754fa6e6d81e07e18ff3d7e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688362, "uuid": "2a2bc679-924d-49d6-acf0-3575d0643c6a", "comment": "Malware payload (RaccoonStealer)", "value": "15bfedc171add539bcbb2ecf4a1fd9eef1fd97f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688362, "uuid": "059be640-f2c2-4593-955d-74d35840fd1d", "comment": "Malware payload (RaccoonStealer)", "value": "07f829fa9913e98a98ecc1b28421d8b7ad99ade6373c33336b738a83f7ad553bac5471c702d87b7c6809aa2910ca2303", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688362, "uuid": "117643bf-c2ed-4fcd-9067-fcfe7e96697b", "value": "T1EBF4226033C2C437D1A29D329474C5F484AFF89299A4950AFB90FF2F9EB13A62675353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688362, "uuid": "b1d024e7-6464-40b5-9e11-db41290cd857", "value": "ea3548dfc690687ffb93a7d9a19ce093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688362, "uuid": "f8f9f2ce-0de5-4f0a-a161-a293c31b295c", "value": "12288:CVzSWHyJc7O9+QlfAMHITHkBSHUS0A4N1kPbpbzYcPGOR6G5hjPG4l:CVSUQcOlfA7HkE0Aa1EuOJjPG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688362, "uuid": "6edf8f35-76f9-4758-a08a-ee5b7e91af37", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688362, "uuid": "70c1a16f-4478-418c-8ecd-709bc8a42b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688362, "uuid": "5cc4d96f-6a70-4e3f-856c-60cf4410132f", "value": "4cb40a5915b998c9c70b71e6b54de912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff36a3a4-95b9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "2655e2e9-2c02-4297-b135-cca20fdd7fd3", "comment": "Malware payload", "value": "3dcab351c634158c2f8426b87f71c627", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "4af8a790-3d81-4de0-9103-96ebace4e466", "comment": "Malware payload", "value": "bcd2954520a8f63aeb20725864da8641e1d04565e1d84ffd49a8449aa5502d1b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "bc1920cb-ced8-450c-93ed-5fa503ad15fa", "comment": "Malware payload", "value": "a54db922131ad49ed2d6b4990857e79919eb18a2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738662, "uuid": "cabacfaa-5e9d-4369-92db-1e3892f2d563", "comment": "Malware payload", "value": "562f785aa88aa37b0be09b9822f61d55796313b360500669c429af693c52618298cd96855d0b3d97c14cbdb15aebf724", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "9ed02acb-7edb-410d-acec-da8af128358f", "value": "T19E35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "d7a3935f-9ef6-4455-bb19-feb3bb773404", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "119e8bc8-8b15-4aa8-abba-eb7fe9295b62", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+u5VOe528JO6PC:6iRGcUY0UvDYNFtub5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738662, "uuid": "6f61fa26-f702-4568-9ab4-b426edfc3450", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738662, "uuid": "4b1fd2af-e58c-47bc-84f5-473a7fe27c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738662, "uuid": "e54d13fb-35d9-4b70-b9c9-c4ddfa0f9b6b", "value": "emotet_exe_e4_bcd2954520a8f63aeb20725864da8641e1d04565e1d84ffd49a8449aa5502d1b_2022-02-24__213734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856ed210-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645692931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692931, "uuid": "1e9dfc77-05c5-4886-a913-98c38515c7f0", "comment": "Malware payload (Formbook)", "value": "367e86de521465ea54f21329df1696ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692931, "uuid": "e495a244-1186-40a7-945f-50b68bda126e", "comment": "Malware payload (Formbook)", "value": "bdb1f97ff5dc37f7d789f3cdb9d5bbd4bd7d8aad3a8980902b658941485e9038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692931, "uuid": "b8ef0544-a65e-460a-a622-555c1bc9f7e3", "comment": "Malware payload (Formbook)", "value": "e024a05ccb3921442f4a2372a3d1348a269d008d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692931, "uuid": "1cf390a0-3c38-4422-8e98-de0dda18e773", "comment": "Malware payload (Formbook)", "value": "d3dc99c6a839525509107d98bcd73ab17b46360e044011c7bbd48eb25b313e44205d9b95d8e50a077f16cdc520103c19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692931, "uuid": "91ea840c-eb5b-4ceb-8506-fcb823a4c948", "value": "T133F4121467EC8A9ADAFF0BF96AB181105338B627E433D31D5A4050DC0E73B94CA967B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692931, "uuid": "c9b6a8a6-da01-4f64-918b-4af93c692568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692931, "uuid": "9363da60-c07c-4050-a4be-a89a6ca6e47e", "value": "12288:Y2ZXnLDntU0vurJMPTXdTBenpTK5/h2OTT8hKl4eRQuvjZcLYifSQa:YMXnLDnvWuPpTBupBkT8HeRQuRifda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692931, "uuid": "d7b88f60-79b1-4ff5-8666-6d0c0545eb0a", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692931, "uuid": "983afb8f-73ef-40ea-8147-8fa4afa3ab6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692931, "uuid": "3b181b65-2b55-425a-855f-8ec53994d6cc", "value": "367e86de521465ea54f21329df1696ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e0b99d-958d-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1645719532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645719532, "uuid": "b6aac20d-eeb6-4e56-acb0-e85f61779fdf", "comment": "Malware payload (Quakbot)", "value": "9b227909c1e1287f999572f15c37d459", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645719532, "uuid": "37f7bd48-1f0b-4709-90b2-0ec269be068e", "comment": "Malware payload (Quakbot)", "value": "be7e0c5b7566efa2d8b39bada9bd9e114f8ccc27c71327026f616e85bb2adb30", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645719532, "uuid": "b9b4646b-1820-4ca5-b18f-2167c2f1dd19", "comment": "Malware payload (Quakbot)", "value": "12e78f03a7f0e690bc5c0f5ce7afa7747194541d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645719532, "uuid": "d2da96dd-6730-4fc1-b075-cd4ff9d1fed9", "comment": "Malware payload (Quakbot)", "value": "01aeb40a69174c9d0b2409f5a4bdf20b6697e3634db5d0caaf43503d1844cc4789c96eeb994e5899306b50907188d9fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645719532, "uuid": "bad7088e-77a8-4b96-8eee-3be523fd3763", "value": "T14305AE1253724835DB3B4F38ED4B12A89C15FDF2F86898F5AED4A8687B386512C5B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645719532, "uuid": "5d0a5e76-dd92-4610-a35b-c4cfd493af03", "value": "c1121acfcf8b9aeea983fd06a6c0a74e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645719532, "uuid": "e2906a32-6ca0-4d41-9604-3907e7a5c6e9", "value": "12288:l9hhPVn6mBXIlb5oC7QMxkbWlV4AuBmzKT5NQMvNHgTJfnoHu:/XometXnx+WHTWT59O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645719532, "uuid": "9bf57791-5d48-4041-854c-48638fe29a48", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645719532, "uuid": "3550b545-a50d-4866-85e7-0e81fd6b6fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645719532, "uuid": "b0779b80-e037-4307-a0af-4b0fb4164415", "value": "44616.7186241898.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e4ed6b-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "81e6261c-afd4-47ad-9e58-bb55cda9103b", "comment": "Malware payload (Heodo)", "value": "c8bd4a66963de4d5251a4780514a64f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "6fed512d-8ede-4eac-864c-6a14777850ab", "comment": "Malware payload (Heodo)", "value": "bf38ffb11db92e2fc82de96b0c11500a7a856fb72c58c4f9e95690cbb9962a14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "c6b7b970-9a8f-42cf-af26-bc3107f6ac0c", "comment": "Malware payload (Heodo)", "value": "c6894e70b8c3222f71ff34b1fad2de1ee3c9f6dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "a42e8de1-cc05-49fb-bda6-3a7b8e5973ba", "comment": "Malware payload (Heodo)", "value": "cab9760510066e39ebb342b12884d8838b1d5d64527d7487aa5c602ef9feaca3d48ff4b120261b359bd91c992737b620", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "b0c19d37-6722-45bb-b36b-6d3e1705fa5f", "value": "T150E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "e50f0d8b-6804-4d71-9737-c343f8ac482c", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "d8b5b2df-a5a9-418d-925d-857f6f370fb9", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XAsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWAa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697894, "uuid": "2aeb12c7-fb77-41bf-b773-543ff045c7a6", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697894, "uuid": "5ed881b1-567b-4145-9d4a-66746c96c3cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "2e1f24a2-45f6-4a97-8aff-17cf7c605f1b", "value": "emotet_exe_e5_bf38ffb11db92e2fc82de96b0c11500a7a856fb72c58c4f9e95690cbb9962a14_2022-02-24__101809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cfae88-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "0016e2f1-85b7-4962-9fab-d483c6ad6122", "comment": "Malware payload (Heodo)", "value": "0eda06c28731c93fb3789b334fc64710", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "a664e9de-0fc9-4563-93fb-3ff618338ac3", "comment": "Malware payload (Heodo)", "value": "bf456c618ae09da35a83f1f514ed11a5fe8ae89f2bde91bd105ef461438a44b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "8c7b5301-f2bb-46c0-a326-d872c0d446c6", "comment": "Malware payload (Heodo)", "value": "7c3344a8eb17e31a016405392cfe034bc16391fe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697894, "uuid": "0ba1f676-b419-4b23-acb5-cb720cc620c0", "comment": "Malware payload (Heodo)", "value": "e31234de784757df7051a6e6b33aaa0f1bce7411d75b0a51744bfbceea7803bb8cd4fd3e25dc8b216815201287287643", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "d8545467-a95b-4201-953c-e28bbfc4c7fe", "value": "T137E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "ed220b98-3da7-4a51-a079-50bdae1600e7", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "efb7760c-d959-4411-8c49-3e0a4baac6ed", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XvsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWva1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697894, "uuid": "eec38198-1516-4f3f-a009-ed410af4c61c", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697894, "uuid": "ba47a6dd-866f-48aa-9102-51f859ee945e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697894, "uuid": "52ff3f46-bc14-46fc-bfa1-335230f41924", "value": "emotet_exe_e5_bf456c618ae09da35a83f1f514ed11a5fe8ae89f2bde91bd105ef461438a44b1_2022-02-24__101808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50186889-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696278, "uuid": "e657c772-3b57-460e-9dfb-aa0a86b9ff5b", "comment": "Malware payload (Heodo)", "value": "64f2bd2daeee4258f5416cc4bad39e04", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696278, "uuid": "f1c5a03e-b83c-4bb3-a472-cb86d3f63056", "comment": "Malware payload (Heodo)", "value": "c0330074e42f2ed79887f0fe873dd6653acbeab6689d41d82d66002490b9c2ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696278, "uuid": "9ae4bcf2-e377-45c8-8d75-20ce32a8b6bb", "comment": "Malware payload (Heodo)", "value": "c2c4234203b6d68ee0e86fd72b90d0e44556856c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696278, "uuid": "4fcce015-51dd-4ac6-bfdd-684e04e41f2c", "comment": "Malware payload (Heodo)", "value": "738d12305e5ec7252c1c8e3b61e7faab5bb38e7fe05fac95e97b94603ee217c8a56687ceb65ed0684cf66785e127ee6a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696278, "uuid": "7ca736c0-6adf-46de-9fe9-80e54f8d6199", "value": "T17EE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696278, "uuid": "3575c210-6e58-4a91-9f0a-09e958592d13", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696278, "uuid": "354609e7-9920-47f4-ad8f-b6988b66626b", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKZe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKZLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696278, "uuid": "8cbc7162-73a4-4f0b-af0e-ff9160da7873", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696278, "uuid": "5f8ce7dd-6b73-41cb-8e10-7c387980e8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696278, "uuid": "ff3daa80-0ab5-4bae-8363-7bcd17c6c288", "value": "DUEqmqNMMFG8UWxAN5eZ7dEXr2TrRj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b87897-9550-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645693165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693165, "uuid": "0ac52063-79b9-436d-b36b-53ef7449a106", "comment": "Malware payload (Formbook)", "value": "b6eabb4e26b14f48529f2a8e930c1267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693165, "uuid": "2f960ea3-e579-4d6b-8603-e6b5b6067a87", "comment": "Malware payload (Formbook)", "value": "c146576ec1b3b983291dfcc520a24f9e1f7a22ad33c49baef056ef1a8533a6e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693165, "uuid": "6b12fa14-a648-4a60-8fd5-f96da970f1f5", "comment": "Malware payload (Formbook)", "value": "557776b141ea228ae68cfda2e3379183301e5ee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693165, "uuid": "253ec1e9-65f2-4b64-a83a-1a6698b78326", "comment": "Malware payload (Formbook)", "value": "58e6ca148d6abf5bd1a3002e45468efcfbd3568fa7c3a020f7c7df05282dd19a0e3b53fa21f3b8afba901065743fa839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693165, "uuid": "ce1bf1f9-c0c1-46a4-a057-5ce9b0adb18d", "value": "T10E0512C4F6448528ED5F17356536DD721A23BD6E60305A6C2ECE3DBB3DFB6A208019A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693165, "uuid": "60538fa1-2834-4e63-bdd9-1c314230a891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693165, "uuid": "4025588f-ded2-465a-aebe-2cce51eb2eaf", "value": "12288:fSY4thjzOWyLSD0f2rJjr//HEUiJsS17I5JG7ck7PXge7SvwLvFVJQiFsJ9:63cLe0fid8OS1M5ilXcvwLvFk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693165, "uuid": "de0d7669-bf6d-466a-ab0d-ed72ec9de368", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693165, "uuid": "10b24c8a-efeb-46c9-905a-819fcd3188f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693165, "uuid": "02a508d3-2724-4964-af14-b6ce1d0fcb8e", "value": "b6eabb4e26b14f48529f2a8e930c1267.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2e9305-9545-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645688491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688491, "uuid": "d29ee04a-0f5e-4a67-95f5-b560b79f4b69", "comment": "Malware payload", "value": "b63b2ca5bd6cb257918779837817c262", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688491, "uuid": "b4177566-ee87-4d2b-acb7-1cd0accc1d1b", "comment": "Malware payload", "value": "c19abcbfc667243029655f8bfc7be87498c594333cea7b98558f920c8559622c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688491, "uuid": "737e842c-f8c9-4f38-8cd0-e3de17d3de50", "comment": "Malware payload", "value": "2114393c19626e1c9b12d9932a3a9a55a47c5504", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688491, "uuid": "541fbe78-154b-4587-ae3d-de6008dc6a39", "comment": "Malware payload", "value": "7fe1b142eaca31432804b7342a35182968d981ac84990b57c40b687247ddbe2e4da7418c4ac50b77550f5057bfe58ce2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688491, "uuid": "e1b46c22-9e25-4e00-880e-6c985831acc2", "value": "T1A073D008B7D7DA12E5D566354ED6C9E23A74BC467D82832B3511B32F6CBDB804A63B03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688491, "uuid": "21633e5f-28bb-48bc-aa24-63e825236b67", "value": "1536:Ulnf5h3ZJLmtPgz/85WkajY8Q1/ZsEVNJ/vDOcGe+/1UV63:GfpJ/z0OjUVD/ZM/1k6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688491, "uuid": "625190d6-0def-49d8-af43-c037ee73f8b4", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688491, "uuid": "7f069894-f758-41a7-a068-48213d75ee14", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688491, "uuid": "685f98ad-2bad-40ad-9daf-19c68344b82d", "value": "Scanned Invoice 8765-8765-9032-8124.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d58483f-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696273, "uuid": "5d0aae2e-4edf-4895-adce-f5a72cdf53fb", "comment": "Malware payload (Heodo)", "value": "01d2971000f37bff4be8fadb78ff913b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696273, "uuid": "ad4f3aac-748b-411c-bf88-ab7823e14e0c", "comment": "Malware payload (Heodo)", "value": "c1a1c190c3f9ce68cf0e50870353579738bcaa91d2523b336bf180594af82f09", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696273, "uuid": "fdd6da4f-2752-4a45-a39b-214a6223f5cd", "comment": "Malware payload (Heodo)", "value": "a3daa7ca79c79e5857de22d4da2b5a73395e6434", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696273, "uuid": "f08ce74f-4efc-4eee-885e-1932899fc477", "comment": "Malware payload (Heodo)", "value": "6c448ad5077278284b475bf3f9d95d7792fd839836f631aaeb8712a7243410e01e7e0020f8f4b96275fcf546c2cf9d13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696273, "uuid": "1a71d858-c069-4a70-b5cd-84849dd584ba", "value": "T1B3E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696273, "uuid": "8820239e-9fe2-4dc8-8583-97eb069e6191", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696273, "uuid": "d2e9a8c1-507d-4df7-a5d4-160a0aa44e7c", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0LhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfhPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696273, "uuid": "c7844fa1-d220-4df9-ba34-4fe4b589516e", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696273, "uuid": "258dab3c-54ba-4853-8ae1-cc8a288f74a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696273, "uuid": "b6a4d561-a5e8-462f-9fd0-5b7276518b68", "value": "8PBVAmR7dTs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b39505-9549-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645690517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690517, "uuid": "b33528b3-6018-440c-beb8-271efb6011e1", "comment": "Malware payload (Formbook)", "value": "73d77b3b9959f51e0ccaaeb38775ea09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690517, "uuid": "4324e50f-c02b-4cc1-b02f-be821d7b9350", "comment": "Malware payload (Formbook)", "value": "c1c5eecc6b6b1138ad43a1b2793d3872dca1c6ab4ec53d34e354e49e35d045d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690517, "uuid": "80b0640e-f033-4cd2-8eab-aab07e2de18f", "comment": "Malware payload (Formbook)", "value": "9036d0b6e73fba59c57654b3aa2c1d29dce8a142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645690517, "uuid": "bdd51b47-14f5-4fd8-880f-48b929aa6148", "comment": "Malware payload (Formbook)", "value": "cb020178255e1061ab0596143841188ce521121c4ac44f557e63ae336ef4d777fafdb9705db1a241f10721290ba7bf5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690517, "uuid": "6e803476-9712-44bb-af5a-b7e04b418cbe", "value": "T19F159D62F291D532D01B12388C6B92B99C257EF03D5CE84B3AE43F0D7E3954A7819E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690517, "uuid": "5ebd15a5-f92b-4f07-8b5f-476147714b0f", "value": "1c02903d270a37655f586f4aa8bf43c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690517, "uuid": "8d80230f-8832-47af-82a7-b100281f2c4b", "value": "12288:Cwkcdx+EleOmksXHxvkAhNSpCsJHr3A5WaS2x3pxjsppdTc:CBoxpeOmBBtQRJHrw5Wad3/j+pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645690517, "uuid": "f4d664e7-b30f-4de0-ab00-de7a44d44e91", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645690517, "uuid": "2b335700-95d7-43db-93fe-79d421e07a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645690517, "uuid": "9b9999ad-cc82-48eb-8400-545d885195ce", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cbc3bd-957a-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645711207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711207, "uuid": "f276cf1e-700e-4d79-b589-935833d75346", "comment": "Malware payload (GuLoader)", "value": "33a334d5dcb96cd24687d3ed02a839fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711207, "uuid": "b2053e5a-14f4-4c0a-8fd9-9c9cfec0140b", "comment": "Malware payload (GuLoader)", "value": "c1db4b9e091b0b3607a5d1df8ed9f2d42be1c2277428f10258be2c6df25c2efc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711207, "uuid": "094e8212-7127-4cc5-826a-6e6cfc346803", "comment": "Malware payload (GuLoader)", "value": "a58d91aa602d36ee8c760f6283711509acf3ad5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711207, "uuid": "70425dcd-c9be-49f4-91fa-c1a91bce67db", "comment": "Malware payload (GuLoader)", "value": "5bbadd44dd49db355d6ca54cf68ece17e0e994b9e73492abd3875e60ddf7cf5e859235c7e4dbe394df0441f568d74ac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711207, "uuid": "528ac447-838d-4ae4-b8f2-4d2d35712318", "value": "T1D8C42204A5E4CCCFE9934E3A58F1AA3603F6FE2925554F575B40BD042D363C2AA1FB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711207, "uuid": "dc191bd1-ea64-4e03-b46c-cb7ee6ae76b1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711207, "uuid": "6e6689d8-eff2-416d-a0ca-d8ce13c47ad1", "value": "12288:vbK2cUkYgyKcLlWRhIg/uBVelCej78cV6HqQq:vbpcQKc5WRh7YVelCej78cypq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711207, "uuid": "979f4f89-cb63-446d-82b3-be85fbb9747c", "value": 547208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711207, "uuid": "07bfcd01-4979-452d-b974-00596d8a2301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711207, "uuid": "1112d063-eeeb-4fcc-bedc-0d2eda6c905b", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7995739f-9541-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645686898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686898, "uuid": "3121f010-497c-452c-bb51-71ef989f4464", "comment": "Malware payload (Formbook)", "value": "71b447201210581c82cd771b1a890a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686898, "uuid": "7da6ba57-0225-4746-95a5-83303748d54f", "comment": "Malware payload (Formbook)", "value": "c1f75b77b9dab7a1f9681c139e566adf5cbc570c87cc2918a3c68d0471c43e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686898, "uuid": "091673d3-243e-4525-82ed-915a0c99dca1", "comment": "Malware payload (Formbook)", "value": "0795ec7e2c0d9ed0c4b54b8c11b9a40371e480d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686898, "uuid": "1bbe4471-3f4c-4401-b605-78c19e15cbeb", "comment": "Malware payload (Formbook)", "value": "6755d7f9d595f782a024b77cda5e1ae62c77d9268b7f6adf6bc353e0bd4e0c2a036d20b319b17b7aa5d0ec8697c1feb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686898, "uuid": "9eebfb1d-5a50-4957-b8e1-6a3e3bd18479", "value": "T130F4CF1039AF20DEF063DBFE9EC8EDB19D6AF13A260D35BA24420F574B49941DE52532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686898, "uuid": "123d20c7-172d-4c5c-bace-cc5b36d3cc3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686898, "uuid": "1f07adcb-07ee-4553-83a0-ab0924f0b9ac", "value": "12288:jCS3A17KHLs82rX6SePgO6ZznhvWVNZklQRBPJse6K0K8rZBSunYqXvmVvEJiS6u:OT7o2rX6xin5QE+RBPJsS0K8BSu6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686898, "uuid": "b83c58c1-d5ae-4b93-8418-b117b9c76876", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686898, "uuid": "54aaec73-e97e-4e81-9f49-f3d1adb93c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686898, "uuid": "12bae7fd-6950-4c0c-8fde-eadaa872ed9c", "value": "New Order Sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2174f38c-95ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645738719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "cfa2741c-7452-48e3-9c51-c6d1b7f7abb6", "comment": "Malware payload", "value": "a54d99f7f896d191ca79e56e375ba84a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "c903256c-6392-429d-aacd-31950a1b9a74", "comment": "Malware payload", "value": "c2d7c122ade5e334fdf937c066be6b4bb716f27a94c5a9a0b7bc0e6b81462dac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "67605287-de99-4510-9a81-d9fdae6552cd", "comment": "Malware payload", "value": "078741368f097e2e5ee7f09efa99a38cb64139e1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645738719, "uuid": "4566cbde-5d35-46ad-8a84-3014f8c74c78", "comment": "Malware payload", "value": "0fb24a4c490e8dc8be10ebbd37822057fe48f825b60661b9a159ca6e18e9a5244a1a284996b35337d460265aa78880e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "2b949d1c-0b31-41f3-96dd-60e7c32f025d", "value": "T11F35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "94b407c2-bda1-434a-a917-5deb0848ed9c", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "5b58abc0-4e7b-47e4-ae17-99907b4d4a82", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+udVOe528JO6PC:6iRGcUY0UvDYNFtuP5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645738719, "uuid": "271da723-d062-484f-8875-093ab1724696", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645738719, "uuid": "1bb65ada-9e64-4cb4-abbf-76a0b9ffd1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645738719, "uuid": "e3248e64-0186-4443-b5d8-9ea33f7b7a85", "value": "emotet_exe_e5_c2d7c122ade5e334fdf937c066be6b4bb716f27a94c5a9a0b7bc0e6b81462dac_2022-02-24__213830.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d640f40-9545-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645688435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688435, "uuid": "849102f3-674c-4a51-8484-c3098651e90a", "comment": "Malware payload (AgentTesla)", "value": "f617650ce840eba8b275a20d4d35fe7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688435, "uuid": "bee48f33-404a-4352-98c9-f25f1c3eee27", "comment": "Malware payload (AgentTesla)", "value": "c309b47c8506472577d90220af4f29c962e308b15b6759244e060cbbb3a288a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688435, "uuid": "3c40cd9a-592e-4023-a6e2-6d14ad61b04e", "comment": "Malware payload (AgentTesla)", "value": "a9960d3a1f6e3341637c690dd2d9513b66b197c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688435, "uuid": "fb3713fc-260a-484d-94f7-d7612bde7e2d", "comment": "Malware payload (AgentTesla)", "value": "fd339284e1b1bf5b70f1eec6c081cd8a33ca5d9de54bd2017d9756d1c8151dca80f60749b000beaac47ab8c137f95891", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688435, "uuid": "d65f8d6b-0fbc-4bee-9d73-9399aa0df0f1", "value": "T11305CF2035AB20DEF023CAFE9DD8EDB0DD6AF13B261E75BA24420F164B49D45DE02576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688435, "uuid": "85a18d9f-621c-4c94-95c1-f955f6e3164e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688435, "uuid": "571ff151-a95a-4e5c-aa30-29b3206ec128", "value": "12288:VPLh/y3Bgi6WGifIvsgiqWtRQHMEBEHAnaUjzBtivKC2bSWYYTdeDGMaEJgszYw:NiBgiyvs17QHMHAaeQX2z3T30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688435, "uuid": "a4b5d698-9d65-4614-9589-570c404518dc", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688435, "uuid": "0339848e-5b76-4970-b4e4-79fe7e7a97ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688435, "uuid": "8b073190-205b-4603-a8ba-4712f5c9b7f2", "value": "RE BLX RFQ- PR 21120772.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2885168-9540-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645686564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686564, "uuid": "928a08e5-1b75-40c4-83ef-f5e567a78e73", "comment": "Malware payload", "value": "d6dac4cab42f8f0af7310926e2c2c2bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686564, "uuid": "1ec6dda3-83ce-4483-adb6-12cf29570ca8", "comment": "Malware payload", "value": "c36839fdf6f7caf1100e74c4b7976645f21468a467def6ea29f034398061fbe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686564, "uuid": "72f4c935-861c-454a-86b9-ad4de17bfdcd", "comment": "Malware payload", "value": "138e724857c57a77ef024d7751d9fa15f5e829c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645686564, "uuid": "32bfb1a4-8106-4ee0-89a9-5dcb52346936", "comment": "Malware payload", "value": "1275e47b5f90a6745dd398ca4242c6619d686fed9f7fdffe7f4b9f78a22113a194522f034affe01878ace27a91dfd0da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686564, "uuid": "a6b8008c-e66c-4d98-ae13-15c283d7ef87", "value": "T17295E119E147E2BBFCED08A3495081D0C39C7FAA7F1289CDE97AC586141F442B7B6D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686564, "uuid": "f89c7d90-50f6-49d2-89b4-370b9dec7251", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686564, "uuid": "088e072e-6110-464f-8d8b-04856244419e", "value": "24576:hZ7Xar2VsBq/OebkMpf5lqlGQerxpxfG7b2K5hit0WIFP:NsFMpfWUxv+7yK5E0TFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645686564, "uuid": "4ef11793-2d1d-4a2e-86ff-57fba05c4c48", "value": 1952007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645686564, "uuid": "3aace51c-efbe-4e12-bf5f-cb98b0c743da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645686564, "uuid": "8fc54636-5581-49c3-bbad-7a09093d2ce9", "value": "data64_6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f597a3-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "180b0c03-6a6c-423f-9554-5ca0e7ecf640", "comment": "Malware payload (Heodo)", "value": "79f07ed597ca127fd335d3a9e4604c6d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "54442834-7dd5-42f4-97f7-49e4aa5ce0aa", "comment": "Malware payload (Heodo)", "value": "c370b05d1a1c25abc0b824fd500a83f7df6d8e3d660ec1a965fc51e4e8a61154", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "2a2af5c2-cd8c-42c0-96e0-89a1d3fedfbe", "comment": "Malware payload (Heodo)", "value": "d9d5e5bc98984864fe94df93c1062dfe33356822", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "595a6421-55e1-4ab0-8445-da3c63d7ce9f", "comment": "Malware payload (Heodo)", "value": "1adeaf195853da60b97c228138b65906d693a4f270aa311b02397392e30d4747f517b2777fe59bffebe887c1e553b3ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "03e0ea59-793a-43f2-b52f-afd86adf08fa", "value": "T1C2E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "1f6d43d9-416b-436a-9c33-47d043008549", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "4960b33a-57c9-4a58-a332-e90246859969", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKJe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKJLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660941, "uuid": "852807c2-110c-4f61-b1af-fcf71f795840", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660941, "uuid": "9c8e0590-ec70-4788-882f-9aad6aab257a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "892099b5-3579-42a9-bf61-d83ce3fbe973", "value": "emotet_exe_e4_c370b05d1a1c25abc0b824fd500a83f7df6d8e3d660ec1a965fc51e4e8a61154_2022-02-24__000212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4e9b5b-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645696221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696221, "uuid": "977fe22d-f8fe-4eac-9a8b-33d37d082ba8", "comment": "Malware payload (Mirai)", "value": "b1301ffd53a356d5a094271d199ff8f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696221, "uuid": "9e7a6d6a-ac67-4b8b-a8e8-17b7905c758d", "comment": "Malware payload (Mirai)", "value": "c3f1b86d419be2d0118acc88bf72d203f0eb4fd8ec31b6452bac8a940d879b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696221, "uuid": "ca041577-502d-4970-bdcc-1c765ab70507", "comment": "Malware payload (Mirai)", "value": "69eb5a02157dbcdb972e1ce6cc718f662100ca84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696221, "uuid": "0850d62d-50b4-48fb-a7fe-26db1662ac97", "comment": "Malware payload (Mirai)", "value": "7598e9dc5134b1b24156375e39a86c5ea52fc9023021c1ec3d0c9a13d9a560e53d7a0f8075cb5351f875dd8b0cda0316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696221, "uuid": "2ea61f35-b459-4a8b-b309-2752beff21e5", "value": "T1CCE2D0B1513AA6F4C6B02833ED7DCBCA95560BF9A3FAB0613B014035564FCC3617A59B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696221, "uuid": "4fb8670d-802f-4f77-9fdd-edf9a3e2d414", "value": "768:a9Lyhzas3E7xRzv5RKWf+J2rO78SpaC/s3UozY:4GhecE7v/K0XhdzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696221, "uuid": "e1278e1e-7aac-4b87-a4f8-7c702d2127d4", "value": 32420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696221, "uuid": "66f92231-d38f-4cdf-9bb0-541dffeeed87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696221, "uuid": "b2373181-447d-490d-849f-e90964f7045c", "value": "SecuriteInfo.com.Linux.Mirai.919.9712.22366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8202ceae-9537-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645682617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682617, "uuid": "ab37d337-b13e-4aa7-ae7b-9ade97c39c1a", "comment": "Malware payload (Heodo)", "value": "bd12a75b1a49a83019f0b5b16657f3a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682617, "uuid": "14838a53-5cb6-4b27-afae-09d3bb10cdbf", "comment": "Malware payload (Heodo)", "value": "c4963bbfbf5fa31208080650161444a9de21f9a4bfef1c87ef427204a3ff09a9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682617, "uuid": "d454ef67-39f3-4b57-8362-70354ee02df9", "comment": "Malware payload (Heodo)", "value": "fc4decab8c697cd429f4daa86c787c6012183cf4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682617, "uuid": "0471d135-4d14-4fca-92e7-1c75ec71d24c", "comment": "Malware payload (Heodo)", "value": "d2139440594bf2b5d2f64de36ea1716286211c5ddd7fa363366f518ea26cd669645079c0c8d8f0e5992c044b9fe39122", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682617, "uuid": "4642550e-84b8-444e-8684-f15d92b2a7d7", "value": "T14293022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682617, "uuid": "4e002994-3269-4bda-8d0e-4ecde72d6264", "value": "1536:vQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:GDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682617, "uuid": "bd8a25bc-a650-4dc6-94a3-b2f84118be43", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682617, "uuid": "24e409c3-9698-4851-839e-c8cc1b43bc99", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682617, "uuid": "ff84cc4a-27e5-4ba2-bb62-ff4e4a40d4f1", "value": "INVOICE 24-02-2022_1050.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2e7c05-9539-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645683685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683685, "uuid": "95d4acbe-a773-41cd-bd4f-bd758b818bb4", "comment": "Malware payload (AgentTesla)", "value": "fbcea968a4fb1a1a464ff4779daf7eef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683685, "uuid": "2d34dc0c-b0e7-4467-90db-0a3e11537c02", "comment": "Malware payload (AgentTesla)", "value": "c4d63dde38a7198a14e7663a0dd46406f777d03c48887cffd2c79c68ce1bb042", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683685, "uuid": "bae64390-e6c5-4b24-865e-a7802895fd2b", "comment": "Malware payload (AgentTesla)", "value": "dc5518fdaa0dc55852b0794e2528731af853404f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683685, "uuid": "454b8b7b-fba8-4a00-84ed-e8ce05fe6aa9", "comment": "Malware payload (AgentTesla)", "value": "5f497fd1a80688053532c166adbded3739c026ff26a293caa3535b4472eec240d2c9d84ee8b073f7f1e5199932f86a16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683685, "uuid": "85c87976-b550-45da-adc7-e40f039edfff", "value": "T16605CF6038AB20DEF063CAFE8ED8FDB1DD6AF53B260E71BA24460F164745941DE01276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683685, "uuid": "4c9b7362-e3d3-40de-9cd9-0d9b8fa32ec7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683685, "uuid": "e0d1574d-162d-4ca0-8639-981467d04ea2", "value": "12288:0wdZ75ymnoV79oy+bcNKRm6fsYPRUCj3JY4esMl9Z5f/QKwj/X5DmEJgBBYS:575Jk7+NcQRZs0LssC6KwMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645683685, "uuid": "85e711f1-b688-40d3-ad43-bf0fab88cb23", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645683685, "uuid": "55d54b1f-0ac4-40b7-8142-04d05601c6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683685, "uuid": "5a3d08a6-2974-40bc-b818-2a1a7db8c8e3", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc258c7-95bd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645740079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740079, "uuid": "e15809ec-18ab-4d5f-8ab6-7d8def6be4b9", "comment": "Malware payload (RedLineStealer)", "value": "a3ab6f9a6640d9713b847e7e95f2eb91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740079, "uuid": "30496432-00b4-4476-b12c-0207d20e9f68", "comment": "Malware payload (RedLineStealer)", "value": "c4e1a605afe024bb020bb043c2309f593b01a81490f78faac5f9492c7b5c0337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740079, "uuid": "7977098c-ac54-4f21-b0ba-04611bb5a9ec", "comment": "Malware payload (RedLineStealer)", "value": "e100ddec8275e37b932479b5e5f2d50460d9423b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740079, "uuid": "6ed0cf0b-3b60-4501-88dd-6571afaa05e0", "comment": "Malware payload (RedLineStealer)", "value": "c440de8818b0ebc25a783160850f63195d4cc9e39eb83dff24ccd55b132a23a19d63b2cc2d70139f602ce5d0cdad634f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740079, "uuid": "0b2cc3c2-7f22-437c-8335-f9c07870ecc6", "value": "T1E2151251BE84803DE2E912719A7E3F7C4ABCDE24072621D757E078256EB84E3B638357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740079, "uuid": "3878f86e-a6b4-4fbf-9970-5b0b06d037cd", "value": "07d01df7a4dcda0b6d5a5f3bdc8aa070", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740079, "uuid": "92e1fb7c-b246-4f05-aea4-87e4f4b1513a", "value": "24576:jOC1FJwWlj++WfQWr8Cd2Z/w9SmjcnibkHcS8EXl6rF:1F96bACd2u9YibfEXcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645740079, "uuid": "823b6551-3dde-4a7c-bcc1-2f5db8f76e46", "value": 911906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645740079, "uuid": "6a9d88db-6039-4228-9c92-6d43caf30bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740079, "uuid": "894df813-c831-4a32-a19e-8ffa0861b88e", "value": "a3ab6f9a6640d9713b847e7e95f2eb91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ace9bb-953a-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1645683778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683778, "uuid": "846580cf-3a48-47d3-8b24-830738873962", "comment": "Malware payload (Smoke Loader)", "value": "26d975ba6e82d9065fd57a6167c7529c", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683778, "uuid": "8225c70f-33a8-4822-9644-736cae8c1afc", "comment": "Malware payload (Smoke Loader)", "value": "c5061cf2961513f91ee1b2c0f50bf8a11928ac068b02ba825b3b0410de507224", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683778, "uuid": "56f9b8f5-92c3-4ed1-95cb-ec1c4e318f88", "comment": "Malware payload (Smoke Loader)", "value": "6bc2c9ba8eabbe20aa085a98650e650c93cb2d80", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645683778, "uuid": "5165a189-c129-4359-83fd-55778a9bcf02", "comment": "Malware payload (Smoke Loader)", "value": "3db1799df0e79c26857179525174b2c9c943ab89c2e3a0876106f508dd0039fc73e2b638b05e62f6bdb7565b28c097cc", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683778, "uuid": "e1e17956-c36b-4815-94e4-be1b140a9d28", "value": "T1BE5633982728F513C9DB8337AB74C27BB25FA82E2CE9C221A95505FC315B9111DEC6CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683778, "uuid": "39dc5c71-d3c3-451b-877b-94bb70c85aac", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683778, "uuid": "6ebf38a3-e7e2-486a-9abb-6920d4eb519b", "value": "196608:J2Fc4DaxrhVRuRMXJXO1peG4i8hPCDTlFAq:J3VFVRUUG458gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645683778, "uuid": "337f706f-eb30-46a3-8617-9d3a58a44d1b", "value": 6303502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645683778, "uuid": "77ce4e6c-f7b4-450c-bfd5-89c8ad4a11c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645683778, "uuid": "c31afa06-ebce-4cb8-9187-c8e979ed87c1", "value": "win_setup__62172037f1144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcf05b3-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694153, "uuid": "d2f34c3d-fb42-4dde-9c17-6da5fd67006b", "comment": "Malware payload (Heodo)", "value": "00810f69d4ba90e929e3ec2c2296d3a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694153, "uuid": "f0fd5862-76ff-49dd-92d2-ce716143303d", "comment": "Malware payload (Heodo)", "value": "c5ed67309a8a840a918729718397f1311fcb8b0a3ecc053beeaa43c3e379e7f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694153, "uuid": "95097ffc-3868-4679-bacb-964d951d3548", "comment": "Malware payload (Heodo)", "value": "419cb5a000dd5193372d0e7848497ed9957c6bbe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694153, "uuid": "f943425d-1dd7-4939-91ac-e59a06f39e24", "comment": "Malware payload (Heodo)", "value": "f4962b3b9899ed3e80e70e823f2d603aca54c8dfcc6ad4bc21fefcde702b9714a1932f1f80adb5eaae72cb3c50eb9315", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694153, "uuid": "5c5ac0fd-4c3a-491f-956d-e08784ce8b81", "value": "T18493022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694153, "uuid": "dda16346-6f94-4bb3-ae2d-1151e26fefff", "value": "1536:/QBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:WDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694153, "uuid": "78b1a0bb-e75e-4884-ab6b-5d3c7e03f8d8", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694153, "uuid": "8f11c42d-4409-439c-a915-9e893a71c1f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694153, "uuid": "1f8ebb3e-0540-4b2a-9a95-118d03c78cca", "value": "OPAST GROUP_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac70dc5-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "5689b588-4fdd-417a-83ac-c3997374c2b7", "comment": "Malware payload (Heodo)", "value": "df4cae01b818f6a3d9c0b457edbda45d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "9bbd4ee4-0db0-4b89-bf74-67ffc9af8499", "comment": "Malware payload (Heodo)", "value": "c6d9582c600029adc0688eeae9c467490891e02e8e2828335c6d54c304d1eab4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "b8de72e8-cddd-430a-8aa3-265a5704a6a3", "comment": "Malware payload (Heodo)", "value": "72ed7db52eadb47d4ab379412fe6d5bf965c7d5f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660942, "uuid": "ada23e28-0b08-46ea-800f-63503d90c4e2", "comment": "Malware payload (Heodo)", "value": "07c70765a928e8a1b4d07cb97632e2c6f2523516adcf195bea15c783187c150cd30b11dbb1412062268595f4f0b7fbd9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "3a175592-ec14-4528-915c-7c8dfe8b5300", "value": "T144E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "d21bc001-2f6d-4862-a5a6-598a7554bcfb", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "2e43a70e-bbc5-480a-9923-428cf012cedf", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKXe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKXLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660942, "uuid": "8d1246b0-9474-47b0-a14e-be4347fc991c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660942, "uuid": "f374a6e7-5051-4c99-8a96-10b9c7bcb0c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660942, "uuid": "808a0239-4e4e-4296-9dc5-7443d56e4991", "value": "emotet_exe_e4_c6d9582c600029adc0688eeae9c467490891e02e8e2828335c6d54c304d1eab4_2022-02-24__000216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b00b04-9550-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645693282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693282, "uuid": "f1167ab9-9f05-44cd-afbd-3bf0ca101359", "comment": "Malware payload", "value": "fe44a36082379b8b3309043fa8cde0d5", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693282, "uuid": "940ef545-0d78-49f5-ada6-585af523c819", "comment": "Malware payload", "value": "c6e233eb7c8bfa7db6fbd0753f2460e40cdc11f478274126e4b42e3dcab65722", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693282, "uuid": "c3b49559-8497-44da-aea9-f8f42a03f8b5", "comment": "Malware payload", "value": "9a6d1e213c3c62eb8abfd2aaa03c082eddb8d310", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693282, "uuid": "6fb2392f-0808-454b-98ea-f86171f28147", "comment": "Malware payload", "value": "6a1b33ffb0e5becce73d660b9eb1aa6514e0c7c39d1a74472cdaeac94701a73c1cb41b55337797d84baa627f5aecccca", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693282, "uuid": "5ca365b7-ef75-4996-a669-da53a9ee2dd0", "value": "T19C4119B461E683B2F00309FE8A9380D0E99636E6C4F197FDC4F65CB092532721621F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693282, "uuid": "fb1e3f69-e26c-4653-817b-5a959f84824a", "value": "24:9XxoRkZBioJw6Dfp7irUhNlNW6yjdhsrWgKIF0+H/vmeVuV/nxDWRSMrTAY44O:9XxviOw6dirslNMrsrFKIFRZS/hGTyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693282, "uuid": "61f9875e-bc50-4311-b844-833b18727f51", "value": 1926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693282, "uuid": "536926ac-1531-486e-9035-c70a00718dca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693282, "uuid": "bf1526b5-992a-4b2d-8188-a12a4a36d663", "value": "atto_80.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7683e00d-9566-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645702784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702784, "uuid": "0abf867c-2f47-4776-a651-65fc271771a8", "comment": "Malware payload (AgentTesla)", "value": "483786b503dd252e3b1e22b31226ba77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702784, "uuid": "d56aa4e8-a5e3-40a3-a4c3-93755e5d1e20", "comment": "Malware payload (AgentTesla)", "value": "c79c2d8ccfbd05196340d13ee9698179e18c82960ab1c457ab8b09c92d4a02c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702784, "uuid": "e79780d8-3317-4fc0-9012-46be048ec0f4", "comment": "Malware payload (AgentTesla)", "value": "c467b2ceb202ed8ee3ab27bb5398cae13952f1c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645702784, "uuid": "5c4d198d-3e7f-4607-9afb-2b871f9befa0", "comment": "Malware payload (AgentTesla)", "value": "9175c5b8ed849231af7fdc0245c23c096f8782f96a9fb6bd3310971899d00bc23d7c874dbaa66e778b7ef2e1e2bb2703", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702784, "uuid": "7bd4f266-8e85-4ebf-8ae8-27a7c5a2049e", "value": "T1A2F4012831282D77CA6C09F99452358403F5456A34E6E3C4EDCB74DFA2D2BD9AA11FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702784, "uuid": "132b203c-adb9-4516-b924-97c241a1e501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702784, "uuid": "470dc5d1-ecee-4c85-b1f5-3c473ace0312", "value": "12288:BeUSW1ZWS4Hz/Y3XCIeAIPfR6k8x6k0J1iXPugGiNt7U/viKWBQr7RdGPIcN:mWuNbykPfRcxV06mg1FgviKWOr7PG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645702784, "uuid": "58b31dd4-7a12-4e57-90d8-df457c140b21", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645702784, "uuid": "f3a5e541-e602-4949-8670-0b52fa808041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645702784, "uuid": "da99c314-5e8b-4eeb-8600-d5d3cff01143", "value": "INV02827262626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896c75a5-9548-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645689931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689931, "uuid": "af275e65-351a-4050-8a65-977644e4cfaf", "comment": "Malware payload", "value": "82635806ed66a90acd06e7c9cc040abc", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689931, "uuid": "eabec462-d07a-46fa-a34c-2f1d3ad1096b", "comment": "Malware payload", "value": "c7faf0f06d10f226a5b31d056098602b82e12636f23fcedf9c7085f198c81a74", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689931, "uuid": "e52e1058-1b12-42dd-8be1-58b30b9489ed", "comment": "Malware payload", "value": "988e142bea88acab0bcf03ac669c1e438e172757", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689931, "uuid": "67a14536-06db-4ac2-87e9-5fddda3908c3", "comment": "Malware payload", "value": "d04f7f71656b51bd524d8df25b22486d7641ee178a6823a35618012ede0112b3838ac67e76bb35d3756659764d1f1605", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689931, "uuid": "3e990ed3-cf44-4320-b5e2-7bfbec908740", "value": "T1A923CF1CC5416606C2B3593DC478D4E169A69C17B110488FE5EEBD8B0BE8E9B274FFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689931, "uuid": "26054d3b-8e01-4a88-bf02-0613959dc65a", "value": "768:j+spRD4S0JS00SneSnjS0yS03S0IMS0bS02SrHlHFYiyfXgCLym4B5GdKmJJJCnX:j+s3JqHt7NJECQFfqAQ3PA51/K8Nyts5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689931, "uuid": "1946c762-734d-41be-9206-e55e74c7b339", "value": 47979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689931, "uuid": "9cc9ba88-dc25-4658-b4e5-c37c220cb88c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689931, "uuid": "bb17b749-0144-4724-9f54-7d38bdddc498", "value": "SKM-C308-0318110516550.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db23d613-9559-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645697370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697370, "uuid": "0ec86fc4-fe22-4407-86bd-d3d42c57b26f", "comment": "Malware payload", "value": "33f612338b6b5e6b4fe8cbb17208795c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyarmor", "colour": "#6034A9", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zeon", "colour": "#5E52CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697370, "uuid": "f2507d35-81ee-4a04-8625-28cbb3e203bc", "comment": "Malware payload", "value": "c860bf644bd5e3d6f4cae67848c4fc769184ae652fcb41cac670042b185d217a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyarmor", "colour": "#6034A9", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zeon", "colour": "#5E52CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697370, "uuid": "37acd0d4-6b75-4a5d-8def-5207c677a98e", "comment": "Malware payload", "value": "66535700bbce7f90d2add7c504bc0e0523d4d71d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyarmor", "colour": "#6034A9", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zeon", "colour": "#5E52CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697370, "uuid": "986336bc-4b3c-4b86-8ce3-e27576522e24", "comment": "Malware payload", "value": "7e6072befaa9e15476f9388f48ab1c569f46547a50a8ed6031d6924ea02d5cd42933c731f3ab79b084db5a03c62370e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyarmor", "colour": "#6034A9", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "zeon", "colour": "#5E52CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697370, "uuid": "dc07d85c-30e9-4cf8-85fc-2d91f36dd33e", "value": "T14E86334497D0E0E1D86C583121F1F7BADFA9B1214799A26F4778C3B98AD3361C43BD2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697370, "uuid": "30b01001-a61e-4602-be53-44d5c3f76eda", "value": "bdaa4f11fa75ae7944b223ba584c1f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697370, "uuid": "96b65d70-2ed4-406e-9844-778d8361f53c", "value": "196608:2SdJhhiIbZg4T4hac7p6eDcGRYTOzBVUuuB1z5:2SdJhVbehacQeHt1VUuur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697370, "uuid": "1024d857-90a1-47b4-8214-dccc58a1b0c9", "value": 7920263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697370, "uuid": "88ce9738-283a-47b6-939f-2340710c6ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697370, "uuid": "9ed28cd0-535b-49f5-aa28-2af72105a081", "value": "c860bf644bd5e3d6f4cae67848c4fc769184ae652fcb41cac670042b185d217a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dd6e6d-9527-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645675562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645675562, "uuid": "1d9904a4-a4c2-4891-b23f-e64bac495f9f", "comment": "Malware payload (AgentTesla)", "value": "343df2292e675417c6ff16fc647da34a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645675562, "uuid": "375cb62c-b6eb-4095-93f4-94da6a89395b", "comment": "Malware payload (AgentTesla)", "value": "c9200cb5d55018691f1b7467f90ba449d85272f2952847aab726ce53d14a63d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645675562, "uuid": "d8735188-8999-4212-88f7-5b3e021ad058", "comment": "Malware payload (AgentTesla)", "value": "c6bd4caab3584eec2d59c21d526f6d7c7d97d161", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645675562, "uuid": "7257d372-7958-40cd-aad4-bdf8feda06cb", "comment": "Malware payload (AgentTesla)", "value": "0d52cc446985c2b89a8d31986edc1bb453d63bf6763ce527752b2aa424226ba8ac410d67772b14004b5dc14f1086c81f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645675562, "uuid": "f5bfd5bb-f4ba-4816-9f7e-27da93a99b04", "value": "T14D05CF1035AB20DDF063DAFE9ED8FDB1DD6AF53A220E76BA20460F164B49901DE12572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645675562, "uuid": "e9ebae98-8e00-42e9-8165-b21ecd619840", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645675562, "uuid": "f054dd98-09dd-414b-9128-f80111823687", "value": "24576:XCyxiEyfK3zY9so9IxInUCtR/GnPSeknOKDy:SdEyf2xo97nr/GP+Oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645675562, "uuid": "7aac5083-671c-4117-9694-1394ae990fda", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645675562, "uuid": "5ad38864-7653-4983-ba1c-93edccbf5210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645675562, "uuid": "47b7f660-b518-4a07-a69c-5313fd85958b", "value": "JJD202202240500100026901_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a909f7e8-950b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645663785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663785, "uuid": "1176c5bd-997f-4a56-9a9b-be451fa1c1d9", "comment": "Malware payload (Heodo)", "value": "a656807ce8dad6e26ef37be8b0c317a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663785, "uuid": "b9c040b5-530f-4d9d-a8e8-66d4f9b51da3", "comment": "Malware payload (Heodo)", "value": "c9559e1ae7a09939d86b1985aea9ed86774a71ac39d5cf588b024f819e568a26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663785, "uuid": "0f422893-f23b-4812-93b0-04148cba00ff", "comment": "Malware payload (Heodo)", "value": "7155a3fdce48e0511ec84ece6099d3f70d84f757", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663785, "uuid": "7a2b12e8-f5e6-417d-899d-9a8161f12e7d", "comment": "Malware payload (Heodo)", "value": "c1eda88403732f4848606ed5b072720790009acde921e88e2c7231a03958d9672c623c0746922b21f732d58fd210c864", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663785, "uuid": "7d07de74-b735-439c-a28b-537e8c02456a", "value": "T179E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663785, "uuid": "2018a649-8eab-4d9d-8bee-f8b0a1206d42", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663785, "uuid": "0ec1b9c1-66f8-43c2-97ea-c4e39009057c", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKCe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKCLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645663785, "uuid": "5a865d2f-c80d-48f7-83e0-945c67eb9d2d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645663785, "uuid": "ffecc07b-9984-4002-892d-36c4dfb8b8c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663785, "uuid": "84533c71-8f1f-499a-8aee-051cc73e5801", "value": "a656807ce8dad6e26ef37be8b0c317a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fbef13-9573-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645708506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708506, "uuid": "574bec13-4872-456d-af18-8d74a262545f", "comment": "Malware payload", "value": "83ab2898efcf8e4d6d6d2f58287e7fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708506, "uuid": "6a09b06e-6862-498a-b4a4-3b577aa23338", "comment": "Malware payload", "value": "cb6e44395fcd0ef62130ec971d0a447dd4f103bed538453d3234cb402e0af5da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708506, "uuid": "5f67f75e-6498-41af-81c1-877e8c326eaf", "comment": "Malware payload", "value": "8d1e5bee74e50a7a9e454075389bc4503f56ad18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645708506, "uuid": "29703e84-1f1b-4c81-bb5f-1aaf9fd7fc4f", "comment": "Malware payload", "value": "b235704de478ec5281172edb8e434b5161659a091055d7728626483a09c8d70461ffb6d114ab352e08c5be61da0bebf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708506, "uuid": "8a585206-de91-40ca-8912-1f48348b63f0", "value": "T143F27056BD388512E119CB3B8B9381F802B8AF11CC57D10BA4EBBF1EB5F2755AA31135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708506, "uuid": "e6aac235-21ad-4cfc-a6a7-462ccacb60ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708506, "uuid": "242c5d87-0320-499f-96a7-c72bd20b8f8a", "value": "384:SlFCXYR+ohoTxw0GxMn69Vhe7bKnK603Rgm33i66s07wwwwwwwwwwwwwwwwwwwwT:SfCW+UL0uMuKbKV0533pTQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645708506, "uuid": "ee247a8d-b864-4e29-b5eb-1b2ba0f68eb7", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645708506, "uuid": "82884292-15a2-40fc-a8d0-cb2403c19ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645708506, "uuid": "a9c7fee8-e02e-4d17-a3a2-826e895da194", "value": "ENQ50856010003.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d796cb-95be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645740505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740505, "uuid": "42849368-f117-4bb9-bc9f-812ae05b3f95", "comment": "Malware payload", "value": "52d6014a53d787cdd8aae59e66c32294", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740505, "uuid": "8c065a0d-243f-4108-9b9b-6c6ff9fc4300", "comment": "Malware payload", "value": "cbb6cacbda69ff4beadfd0018bf4665f191f94b0e3bb58da02f473c38b94bce4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740505, "uuid": "6adca28a-693c-4855-976d-ac5b7fabede3", "comment": "Malware payload", "value": "9d09995418f30f61358a0c656d1cbb965fa83950", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740505, "uuid": "543d63ca-a411-48ab-bb38-8ed831020e0a", "comment": "Malware payload", "value": "d765cc56a94b3aff77f1a75b3a5290abbfd7cdea428e00508f4ef46b9bccd02d8968793c5235388e9999b6e4df62b95e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740505, "uuid": "b465907c-c4b6-4795-85ba-d9567e70674b", "value": "T173E4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E781C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740505, "uuid": "8f7ce0cc-fcd0-4a16-8998-6f262af005fd", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740505, "uuid": "c3732a36-7947-40f3-903e-6415a6e69611", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKRKDYjX3rUXY:ygHpbVy97W0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645740505, "uuid": "02bf212e-e122-4b20-8ffe-42e1878ac7f3", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645740505, "uuid": "25adf55c-46ea-4c1f-8f83-18ff58cae194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740505, "uuid": "3b43e07d-37ae-4d0b-aa31-cf7716184bd0", "value": "52d6014a53d787cdd8aae59e66c32294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04dc820-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729134, "uuid": "918cbda2-c98c-4d0e-aaef-e8dec9dae027", "comment": "Malware payload", "value": "e118a1d7bbf4325151c74d4a6efb32b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729134, "uuid": "4d922fbf-9a97-4a12-8e2a-813ea206d60f", "comment": "Malware payload", "value": "cbe60fd82914adaba830f4406aba6ffe15d4fe3a1cd9993d0a16b0003b090058", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729134, "uuid": "4277ed15-7516-4803-b338-ff147bdf7cd0", "comment": "Malware payload", "value": "bd42f42eaffe36ca6573ad35b8d0f4cc7acd9980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729134, "uuid": "0571506f-ad11-4a1b-9f5d-30cff4df649d", "comment": "Malware payload", "value": "6d66304aaa7f6579d87d0b73a47312653bd78059f3dc79ba1dc54e72a79e4562d867434c319afba42407201a88c43e4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729134, "uuid": "6e464d0d-58a8-49c7-9317-6a79618eb8b7", "value": "T16084CF50F3948896F97F67B2D4768510036ABD6D997BD70E298B7FAD08B33820443B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729134, "uuid": "756953b9-79ca-4e67-bba0-d323c34dcbb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729134, "uuid": "40435a56-ed25-4d8b-aa15-8d449b650f02", "value": "6144:NVSctpz7e/N7fy36mt7tHJXt5o3uai9BJ8f/W8ewIoGAlkNLdLvN34Q8a6:NV1pURfy36oZFtW3uaan2/WU6DNVFca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729134, "uuid": "28c4683b-10a8-4b18-91f6-0e7b942d98d3", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729134, "uuid": "4b6caffa-f728-418a-b0ea-121a453a29e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729134, "uuid": "1de9e069-8df6-4cb3-9215-d30c4bbecc97", "value": "e118a1d7bbf4325151c74d4a6efb32b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1489c3cb-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "9423399c-5491-41bc-b322-f2d7c90d8681", "comment": "Malware payload (Heodo)", "value": "0172d2b545acd87b6b1248417ca65fcf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "2be0f518-e135-4c4d-9986-4e5cafd2c08f", "comment": "Malware payload (Heodo)", "value": "cd84ef50f9c1916c2fe68be675a91b5254d93028445469ac27319862fe7ce829", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "08c7418a-dca5-4877-862e-299a10125290", "comment": "Malware payload (Heodo)", "value": "4512e1d04dbe6d5296bf7f8917a902d6c6a34684", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "e376b19d-59a8-42db-9db4-86cad9528bc9", "comment": "Malware payload (Heodo)", "value": "bae56c04ea6ccbb043cc3adb499a6a1665f006e92f6ccdf047094723edd46d04f95751e2c06741b0b6bd3fbda7a0ece0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "6a552298-e717-413c-8392-1ba7bc3900d4", "value": "T182E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "1e1b2f29-1386-4884-b426-852f127920d0", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "81f36afe-afa8-4bad-b19b-90666893d9a6", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XDsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWDa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697896, "uuid": "e0d89219-6e3f-4b28-90ef-b852f82cb89e", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697896, "uuid": "54c58899-9dee-40ad-ad1f-98959bf1284b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "65072038-08a5-4c9c-8f61-80b8a7e357f6", "value": "emotet_exe_e5_cd84ef50f9c1916c2fe68be675a91b5254d93028445469ac27319862fe7ce829_2022-02-24__101811.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96bd417-9558-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645696937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696937, "uuid": "f85257c1-8a9e-4b86-8372-f2b5b7080413", "comment": "Malware payload (NanoCore)", "value": "ad21005195136669af3a644f73e7197f", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696937, "uuid": "383804e2-91ed-4d1c-a7e2-5ce7488c5f57", "comment": "Malware payload (NanoCore)", "value": "ce1d3b3e25fe04d6c8a26b3b0dff5960e987700f9df545e43c0871b5f821ee98", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696937, "uuid": "d739a639-d7b9-419a-b559-a1f5f985dc4e", "comment": "Malware payload (NanoCore)", "value": "f046c81d878577f46175d9ca39c054ff163ef5ea", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696937, "uuid": "a61bdf63-6c32-4b96-ba42-97c12742d50f", "comment": "Malware payload (NanoCore)", "value": "684b0e6a84db6deb0db6e220ed4b0b9ad2eea76b601c018ca648b6b5ac53da7e6799b2142aa92c82b7b1457ed87575e8", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696937, "uuid": "f87c38a1-e957-4700-9363-b03b33c29621", "value": "T15BF4238800902F2CF2647A7AA1F424F5C6B47A2D330B277D2255B75ECD93D95F06A2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696937, "uuid": "ac44a31f-f311-42eb-a39a-4f341f46475a", "value": "12288:4cn3XO8zajc/K3jnogTijs2/rgaaqJm6KOYREZA4dBWopzhOGw824/wEd:HRz7/IjnogTijs4clQm6/YRuZiiVO38F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696937, "uuid": "b892b7af-7ab3-4ece-aa5b-12dae59d9c73", "value": 741068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696937, "uuid": "247d0ed6-57c2-47bb-b453-6cc5d2bbc4b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696937, "uuid": "b65e4e39-ba49-4e34-8781-0d37959e00d9", "value": "Quote.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb72628-953d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645685402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685402, "uuid": "b9d268a9-e4c5-462a-9ed7-7f4e813d4a24", "comment": "Malware payload", "value": "71f9bccf6ad1935ff4f8bde777d9b401", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685402, "uuid": "93bcb0cf-436d-4d08-948b-e1066dd7282a", "comment": "Malware payload", "value": "ce2928ab5086fe869d7b16ffb0e01519fd7a735253e40e40983ad03f33f80600", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685402, "uuid": "f311df8d-9a76-474a-a91d-a25a66ad1c15", "comment": "Malware payload", "value": "35af4a25f5e04e0da63e6684ec809a11192bf984", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685402, "uuid": "c1ad608a-934c-4905-be64-65acd1cd29ee", "comment": "Malware payload", "value": "41de1fc2a6c9c98bafb8b51ca82c0ba10016ff96cd18cccdbb0c6ba48bf549a08e6147bd0ce5a8ff8a93aeabbc6da60e", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685402, "uuid": "a52eaac5-10cc-4c92-b3aa-31ba1430da70", "value": "T147E0C0B0825E372508EF5054C89F8A214348910C03866054B22655C2373CD0295434C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685402, "uuid": "3b4e78c7-c1d2-41db-a985-48c9e1191d96", "value": "6:SAm/GYPpdz76VU2y2kRNalFycrgoa/cDtc0x0Wk/e9nn7lY7fLo+G2GSoRGUJ9v:zgzPpdzW+HralFxsYtFx05on70PhGJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685402, "uuid": "7ff774d2-3f70-470c-991b-486475f47fb3", "value": 350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685402, "uuid": "4be502f8-e432-43f4-8dc9-af8d6c148e24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685402, "uuid": "b8a67f44-3668-484b-b603-4eec9949ac08", "value": "3T241K53_704.91155959.745380.98145.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69871b30-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694173, "uuid": "703d1a8f-2a4e-4a54-9756-9f3a14fb066d", "comment": "Malware payload (Heodo)", "value": "61585965c10b4afd602403dbe1bf22f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694173, "uuid": "435fce1f-dc09-4f7c-a8fa-75c87d32168d", "comment": "Malware payload (Heodo)", "value": "ce3333475ef2050c5a6c8dc8cbd539024ef5ffdd43073093d081e3859abfe1a5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694173, "uuid": "5c4c33a8-e51b-4014-9e74-6d4f9dca7953", "comment": "Malware payload (Heodo)", "value": "b13f0a2f1b0b9d7d59aa36de2138e3d34a0b6f36", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694173, "uuid": "4c1170d5-594b-420b-9cc2-d584b9fe7388", "comment": "Malware payload (Heodo)", "value": "446fad57a71bb26a4898781d4b84b5c1905dc3cda4a3fcfda2f99d8c2067d3c6337d0f9bda8e7062fe508bd37cbf07b1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694173, "uuid": "f2dc906c-448b-4290-915a-ed18effbec77", "value": "T1C893022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694173, "uuid": "e623831d-168f-4db2-9c55-5380239eb4fc", "value": "1536:DQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:qDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694173, "uuid": "79776933-27c9-40f5-85ac-23298589d90a", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694173, "uuid": "05053da8-0412-4eed-b6ff-e277f7b7c562", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694173, "uuid": "951ea260-d8a3-40c3-a9e0-450e39f0a341", "value": "Opast Publishing Group_5.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d197e761-9553-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1645694777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694777, "uuid": "cdd4a28c-2f08-4e8c-8c23-7ffaf613b112", "comment": "Malware payload (RaccoonStealer)", "value": "fab6367673f63857ed3a74731657c3df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694777, "uuid": "626589e8-d490-44d6-b37e-7e308d73d09c", "comment": "Malware payload (RaccoonStealer)", "value": "ce6f0ae83b8633dca1eb926b922c1f95b0cfb6f7701705c5032e025434f20dc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694777, "uuid": "c0c4911d-acd1-4484-95ec-dcca24e1a322", "comment": "Malware payload (RaccoonStealer)", "value": "0f7aba66895dede489874beeb1e77bc9219bb2d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694777, "uuid": "70c6c7f8-b1c7-4d54-9531-7b5bfed5340e", "comment": "Malware payload (RaccoonStealer)", "value": "2cc75478786d51ce43f8ee8304d1d29bab1e8e927fc2b84b5116b52033210a43d4e6925b3fb16b08b42ba63028953b0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694777, "uuid": "e2a28645-3387-49df-a811-4b634520b0c7", "value": "T1CF050210AAA0D035F1B752F899B9C3ACB93E3AB15B2464CF23D516EA57352D4EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694777, "uuid": "e41642ca-95ff-45d5-a116-c5e58f2dd60a", "value": "90f4cb1f395a200889984b389a9496a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694777, "uuid": "32c6c74f-18d0-43b7-b41a-793c5a82bc6e", "value": "24576:uYPcZtnbBMQXiB/FESYgft8mcfo8Et4/dR:gSvLESYgFqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694777, "uuid": "fef03120-069b-4bd8-a172-49b5e980168d", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694777, "uuid": "261d476e-0e7e-4eea-8ab6-f17528345446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694777, "uuid": "61b7fc0b-3cdc-42e7-927a-f6053528e87b", "value": "fab6367673f63857ed3a74731657c3df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bfad80-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696284, "uuid": "74da3bdb-1863-4e92-981a-434f1f4bde86", "comment": "Malware payload (Heodo)", "value": "aee729d0d87499005e11b506047514a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696284, "uuid": "7fa0615a-c628-4fa1-bac1-0aa620438aee", "comment": "Malware payload (Heodo)", "value": "cf43707baa28593534489c0ecbbeb3d2f53e59f28271238e1a6d8747452077f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696284, "uuid": "8aa7464d-f5bf-453b-b0c2-680b732f201e", "comment": "Malware payload (Heodo)", "value": "f56ddcfde2c1be756710bf8528eb0515ff41b6c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696284, "uuid": "022cbd93-63ae-48f0-a851-2eb1b3e71ebb", "comment": "Malware payload (Heodo)", "value": "1b63e65e2da82436ea2cc499cc6926179343170b5fb1d54f4a0c33aa14bd4e6e524c0b299d7e37181fb75d845aef4511", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696284, "uuid": "a3d8212a-4f41-4e1e-81a4-7bf37b3f3da9", "value": "T128E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696284, "uuid": "7f7de3a4-4232-49c5-8a67-83fee8726fd4", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696284, "uuid": "89d1d790-9539-4bd4-a90d-e3d11f71c7c9", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0jhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNf1PhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696284, "uuid": "11e168fc-3e5e-4843-9d89-6d3098064730", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696284, "uuid": "edb87a0e-1c54-4a96-93ad-85cf6b08523a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696284, "uuid": "aca797ef-ba17-488f-b4ce-3bff14462359", "value": "KQv8f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252048d6-957a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645711238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711238, "uuid": "1dcc8d69-308b-4f2a-ad27-c60ca698680e", "comment": "Malware payload (Formbook)", "value": "3317e27e66ccb9ce293ee386d1d5948e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711238, "uuid": "cf569cda-825a-4c42-a9cf-865bb269280e", "comment": "Malware payload (Formbook)", "value": "cfaa85b1b18971d5e6cc132ecba77f2fe07290f1b8705086ac6a263acae6c26b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711238, "uuid": "31026301-feff-4513-8051-6b599b29bc0a", "comment": "Malware payload (Formbook)", "value": "6867da61e6aada3cc4f41172bff419355f00b8e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645711238, "uuid": "30c135e5-1bd1-4c41-8d50-b1ef42f66867", "comment": "Malware payload (Formbook)", "value": "43955adbc37e0d6d21cef83d7a823d73cb2c853f52114c0fd7ce15eb8a576ebaedd0cfb5cf2fc0867cb3f7a8c39eba41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711238, "uuid": "fb340c1e-c45d-419c-80de-351eda4e1f40", "value": "T1F625E1C83E55AE86F8498B3801325D6630F37FE56D2DBA0E9954B672677378B2B41C03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711238, "uuid": "079eb8d6-64e7-4cd2-a1f0-cc313b07e60d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711238, "uuid": "aefa9eab-bdf5-4e64-b2a1-03896b30cc38", "value": "24576:/ofSRDlEvgokH8qfGtQdkmembzxZKNqgDux:QfkDlEvq8qfGfpE3KN5DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645711238, "uuid": "6a8920a3-ad90-45a4-81f7-978cbee3bf35", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645711238, "uuid": "4ce7342d-663d-44ad-865e-809e304fc16f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645711238, "uuid": "23f11303-a284-4391-8020-3da9bc863475", "value": "Ref_SIPPOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63474e1d-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694162, "uuid": "81db8021-c4b5-4cb5-99dd-b3dbb64e4eab", "comment": "Malware payload (Heodo)", "value": "96d9fa73c7bd1b5ea03a7bfb79fb908a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694162, "uuid": "0b09c60b-7cc0-4593-b8d2-a90104dad432", "comment": "Malware payload (Heodo)", "value": "d03dd305b00c8293a674235d056823b078b61fa398e5851c2d00e8bec9cfe068", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694162, "uuid": "16f8bbe9-0faa-4aa9-843d-fb26b542d2a4", "comment": "Malware payload (Heodo)", "value": "088cf83fe167f32a9c9a1f6065383ece728f6f2e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694162, "uuid": "977cd06f-327d-4f3e-be8e-e83988f85125", "comment": "Malware payload (Heodo)", "value": "d2520dbfca0efc2478c630dafd00a1747a08ee769a2c401ec33e78ce29478858aa270583bdd3c1d9fc8b0b2470e9b237", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694162, "uuid": "94b3391b-b76e-4c2b-a6e1-30ae6ac7f33d", "value": "T1CF93022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694162, "uuid": "64d8ca15-399b-42f4-84e2-b9b0718cd9e8", "value": "1536:/QBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:WDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694162, "uuid": "32da7184-6f16-45f9-9c1d-6991a4c8673f", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694162, "uuid": "d2328067-5f79-4c0d-8f4a-0cb3c4557f5b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694162, "uuid": "3947134e-a62e-430a-893c-a2ff8d4b4bd1", "value": "opastonline.com_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094d3aa2-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "e7041cf0-50e6-422a-bf1d-f4d9c8c322b0", "comment": "Malware payload (Heodo)", "value": "57b2a20b61e40ef0f5d5361db6bffbd3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "cad85d8c-a2c6-46b8-bec0-3fc3906ecc18", "comment": "Malware payload (Heodo)", "value": "d0962f6182dedf58cd77af1bbe0d0d56bfcaa1bee10c8c432a36970fcf72baa9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "042f8c81-5a2e-4296-9235-3d20d0f48a5b", "comment": "Malware payload (Heodo)", "value": "40324c112852eb4791c5ae9ebe15843925769ea3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "772b29dc-ebd9-4ac1-a7d8-1c3772c2a61d", "comment": "Malware payload (Heodo)", "value": "8b2c2f8c12fd26213532d0f3e1341401a44fe7b970fe5fcb18887e14d3878226b4b249ac305b1048979788ff62977d6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "8bcb9b2b-50fa-4fae-aa51-6bde34b4c8e2", "value": "T11FE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "65ffe82d-d17c-4b7b-9932-75015c746262", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "a00087f6-c9c8-4a2d-b49d-f5b84961a286", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKbe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKbLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660940, "uuid": "e7cc0e75-7317-4f1c-b52f-7173f8386877", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660940, "uuid": "a8c21172-40f6-4f4a-bc9f-af3edb6c1d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "c8ec3fc6-aabe-4505-9b20-9f768548628d", "value": "emotet_exe_e4_d0962f6182dedf58cd77af1bbe0d0d56bfcaa1bee10c8c432a36970fcf72baa9_2022-02-24__000211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2f9dd8-954e-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645692295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692295, "uuid": "ff56b248-16d5-49e8-99b4-ad3673ee36de", "comment": "Malware payload (Loki)", "value": "53605dd3b268ae0241bec5afc33981d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692295, "uuid": "913a17f6-1899-4fca-bd5c-e8e75a8fec48", "comment": "Malware payload (Loki)", "value": "d138c827679964991e1090c8a5eb99736f00008876d560544a110d0213bd6f1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692295, "uuid": "a2235156-3705-467e-8d10-d2ebd8a11d4a", "comment": "Malware payload (Loki)", "value": "597048144bd6715a9419cd214da25e2528f9c855", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692295, "uuid": "6d7f5dc1-72c1-4632-a18e-7132bda75514", "comment": "Malware payload (Loki)", "value": "4395624fb488b1193ee0518a7b81665d67d9740c1bcac58bb4afa2b28af0a76264483b6409dfff046e84abbbec3c31da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692295, "uuid": "e8415dd4-def4-4a41-97d6-5b9414647f9b", "value": "T10464125A2AF4807BC6550871243AC37EE9AAEB14365259A72BB17FFB3C201C75D1078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692295, "uuid": "524a451c-ff84-4509-99ac-41d64840e38c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692295, "uuid": "570364dd-2c69-4ecd-a6be-7777494e0e9c", "value": "6144:TxDsS2iGKGoX9CTydAQctHGS3MV1j5aDspEsGaXZkWA/KGg:P2iGDoX9C5QcZ3MV1gDsCaJcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692295, "uuid": "091c138f-81c6-4072-8207-eb2203848e2b", "value": 320277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692295, "uuid": "a696d61b-1bdf-47ef-96ab-49896f318dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692295, "uuid": "6ce20ecb-43dc-40d7-843b-864980b87e3f", "value": "53605dd3b268ae0241bec5afc33981d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4405e224-95b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645734912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734912, "uuid": "13adeffb-3065-4c56-959e-798bac6b89ea", "comment": "Malware payload", "value": "0f34b510a372624d481cb3968b366eb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734912, "uuid": "24e303ca-478b-4b8a-b21d-85293ddda2b1", "comment": "Malware payload", "value": "d15b9a79b89820e982b4e2011842c15f8239ca020519c457093aa180ead92e0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734912, "uuid": "ce621012-023f-4070-b9b5-28f335cbc2b3", "comment": "Malware payload", "value": "ce0b536f45788bbf19b88a0b31569966c9a2dd7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734912, "uuid": "6e3f839d-1590-4cfb-b75d-251e7322cbd0", "comment": "Malware payload", "value": "d13d9e5d3377b7777d7b81d72a3da05a2eed8d9800ca0244aa0841db68d034e19f8ce5fa09d87afd491d3cd500275d9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734912, "uuid": "95acaf0e-3cf1-4b6d-b23e-f209e9c6919f", "value": "T12DE4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734912, "uuid": "be59e65c-ffa3-402a-8ca8-4f6ccce30d7a", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734912, "uuid": "4fc84bcd-64b8-45a1-af41-55afe49d9c94", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XFsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWFa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645734912, "uuid": "486a5230-e597-4a58-81bc-b1c781e910d7", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645734912, "uuid": "539b47f3-b694-4d75-8f4b-b2dee2ecdce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734912, "uuid": "34c0cddc-e649-421c-a9df-b5bb8dca3391", "value": "0f34b510a372624d481cb3968b366eb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e74453d-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687739, "uuid": "eb18fc85-3f7c-41e6-9f39-5de64db4c252", "comment": "Malware payload (Gafgyt)", "value": "6b11972210527ba234b3dbc09f3a7e93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687739, "uuid": "85f87efe-2568-4f6f-9d6c-2cd80297902a", "comment": "Malware payload (Gafgyt)", "value": "d1baaef5bf872fd19b7f64b6e257936b2028d1771de3a4c9fbeb2bbf918d8b85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687739, "uuid": "ecdb8056-b07f-46d9-94d1-2c6762c25dfc", "comment": "Malware payload (Gafgyt)", "value": "dfaeb8092f4090392246389dcf09c685f1facc65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687739, "uuid": "02844287-8c92-4f7d-ac46-7248af0de541", "comment": "Malware payload (Gafgyt)", "value": "59ec47ebebf2e1b8f77127cd0d1111f43bf44ce92a986f1961d650cbbf893a5e277fdffcef10d951707b2649bc97b2f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687739, "uuid": "aeb2281d-7129-4f54-a976-41d526b0dc0d", "value": "T11FB3842A7E22EFFFE668863107F35F7087D5219226A19385F26CE6181E7128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687739, "uuid": "1f98a23a-75b1-45d1-b516-a8715c6cf45c", "value": "1536:q7ju1TNpq+XvYe2rKO3eg5PGEEeRYYIjIvEC7ZXA4PUmkiSFxfC7xbXe:9Dg5PGEu/jRs64PUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687739, "uuid": "cdf8ef16-3ed9-46f5-a398-682d02e46e37", "value": 113268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687739, "uuid": "f150f90c-7830-4e5d-be96-73afd86aaa8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687739, "uuid": "057cb7b3-fdeb-4a19-ad1c-54c474090ab2", "value": "6b11972210527ba234b3dbc09f3a7e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b27f81a-956d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645705691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705691, "uuid": "143d8d97-4fe4-4dfe-b304-19a09c1c5a93", "comment": "Malware payload (Heodo)", "value": "93b902e1a9ef85eaa91f36f56eddf6c9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705691, "uuid": "bd3a8223-3683-4af3-a052-ea707335c0d0", "comment": "Malware payload (Heodo)", "value": "d1e8cd09c69f6f17313cfd24f981c28ae9bf90428a449f126c973e78112c3eae", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705691, "uuid": "0c86e05b-64c1-4f0c-ad7a-cdb72f8f3b9d", "comment": "Malware payload (Heodo)", "value": "eefcf9d7ef7351b9c0ed3bd49e2921e11c766931", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705691, "uuid": "8d5278e3-1c70-4909-bcf7-0fdc96756b3e", "comment": "Malware payload (Heodo)", "value": "ded66fd92918715c108ffe18e98fe0c02cca56897b0acfbe20e6dc74ceaaf51b6fdd0adcf0a04aa9e8d1d6337bb05dc9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705691, "uuid": "f623a4b1-1753-4528-a0c1-eebb9838016c", "value": "T1AB14A4434D494B97D11C83F4BD5B4EAC2F4A6B1CE8C6BAFB05661FDA3E652160C8D02E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705691, "uuid": "efb33a1e-9fe4-4e99-bdca-86b2622e6fef", "value": "3072:TUzWNX3hRqo2wDtStV6ofIWPQZzzjqlHsgGgYGfnKFmD:TUWVxwoNDtiMofIrZfqeFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645705691, "uuid": "fc1450d1-3c08-4d45-b089-7fe5361050d5", "value": 195282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645705691, "uuid": "c5a33c49-9ade-4327-9908-fdba114d47b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705691, "uuid": "3e0b4812-4ad6-4396-a729-94673684c38c", "value": "DOCUMENTO-8152040270.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9919f2-9580-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645713832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713832, "uuid": "6488a516-9263-485e-b727-8c78c0a0478a", "comment": "Malware payload (Heodo)", "value": "e95e7ea118f3078b16444f808fc698d6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713832, "uuid": "8cc698f9-9d2f-4d5d-9341-348a294d6989", "comment": "Malware payload (Heodo)", "value": "d1ff364cae233ccb7ef06ea7581cfe3840ebd09c65a699d528c4489ce170a170", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713832, "uuid": "a9d26d7f-d850-4d5c-860e-ee4686768a03", "comment": "Malware payload (Heodo)", "value": "f935c5d797609e0219ff57f88b1e41b4f817de6c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713832, "uuid": "9deeadf6-09ad-4669-8dd2-a65038bcdc99", "comment": "Malware payload (Heodo)", "value": "0c9fa44e195e486b501f049a9a05cb1db208bff501770450c763a529bb2b5bc5994c7c25a7f5a86814054bcc99c733c3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713832, "uuid": "7ad6a4fa-0646-45c6-808a-7689ec39cf49", "value": "T1A893022E832E547BDAF54475B10890EB6A0E0D034508EB9A0895F39B4B7D5C94FBECEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713832, "uuid": "21e376c6-9c6d-4498-921b-274e410b0cf1", "value": "1536:vQBrnXpnyV+ns1BVi/IEh2hx0Lx3bKhllGGx0vKCEjdQjqEk+xXPd:GDpyVEoBo6hKb4llGsQjbxfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645713832, "uuid": "d77c0e8f-9702-4ec0-8be3-2d8361137834", "value": 92351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645713832, "uuid": "7c36fd84-a977-46bc-8a20-81ca70e87ca9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713832, "uuid": "d5cc9c8a-7fad-4cb6-9f9a-b8412233808f", "value": "XRN926914873YZ.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fb08e9-9531-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645679963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679963, "uuid": "54302af7-db85-4507-86a4-e45794b9d1bb", "comment": "Malware payload", "value": "9246b822f94eb24b49bac245153c7fdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679963, "uuid": "63b97354-b0eb-44a4-8836-f9163a1f8ba9", "comment": "Malware payload", "value": "d21908dc0c08da389aa9e4829aa934ab7f250fece1430ed5a644e0590d8876f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679963, "uuid": "d984bbd1-b5f1-4cc6-9c1d-8a87b4fe1da5", "comment": "Malware payload", "value": "1a341d88ca000dd9fd28b460c6899bb4aae1091b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679963, "uuid": "3dc12422-a378-4ccf-9e31-563a34d0a7fa", "comment": "Malware payload", "value": "cd68f4feae13556af61c7a6d68a767c69fb57f08c33da5ca086e874a1c72cc606eee7bb6975a827f41428df609c9bafa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679963, "uuid": "3604745e-573a-4249-9c74-af64316ca601", "value": "T109647C0AD7E0946BECB249721778C7A6C13D77302A5441BB6358BD3D6FB42A2DD22B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679963, "uuid": "1baad22d-c309-4c4c-b47e-fb85990f781f", "value": "5d864b8b615b63f215b51bfc1775e9e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679963, "uuid": "19a340cd-38fd-4a44-9a04-f79e20652af7", "value": "6144:QPc5sFLQmwi0uyuHga0j2AUyysC2N3NM/X:75siYSUgauxUyyJi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645679963, "uuid": "9f0c2af0-da2c-49e1-88ac-86023bfeb6b4", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645679963, "uuid": "e3bbc828-7d42-4d40-bcd2-112e19c734c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679963, "uuid": "f32c940b-d23a-428d-b3ed-5cd26e2cc302", "value": "d21908dc0c08da389aa9e4829aa934ab7f250fece1430ed5a644e0590d8876f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711e8ddf-95c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645744437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744437, "uuid": "bdf8b27c-77ca-43dd-8f0c-fe428aa298c3", "comment": "Malware payload", "value": "e71ee360046edc978c002aa6c232342d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744437, "uuid": "001dbf62-0380-4bcc-a713-4023206130b7", "comment": "Malware payload", "value": "d2ac49959ceb23e87f642bc89f2a82f93f9effc4e397a152c531fe8c75e17e4e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744437, "uuid": "033d4f6a-bfa3-4f50-ab1b-842062f9b37b", "comment": "Malware payload", "value": "59af8430b0a1c2117def102eacfe3b02ba381e24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744437, "uuid": "dad0eeaf-2f47-49d3-8d0a-dff1a6a5cdd9", "comment": "Malware payload", "value": "404bc435e5a097e1788b842092cd0b9c8738238357584eedd061a9cfdda3a836647b44293de2398f7dd5caa17a7c850e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744437, "uuid": "7373de9b-da1b-444f-a813-079aa98a45a1", "value": "T12E35BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744437, "uuid": "0aae143a-d69c-4398-adac-44fcbf36f923", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744437, "uuid": "0aa68386-74e0-4cd6-b711-ccdac8170a01", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+uNVOe528JO6PC:6iRGcUY0UvDYNFtuf5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645744437, "uuid": "e3ad4c05-360c-41ea-8e2c-ca2427c405b1", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645744437, "uuid": "7aaf6838-55fa-4ed5-a462-6033fbd1823a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744437, "uuid": "97afda26-53b8-4be8-a441-16de40b57d33", "value": "6KI1zon7xFq7JZ9o0lh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58f8e26-95c4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645743317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743317, "uuid": "c17ee237-3ca9-49fd-844f-6462ed1eb107", "comment": "Malware payload", "value": "19a6f9fb8bde5e452977640d233684bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743317, "uuid": "2dcd28b9-2471-4d81-b44b-488e77051eec", "comment": "Malware payload", "value": "d33490ada3b8c9d07713c525f937078f1dc60ddfe3eccd8f73b593192fdc9b1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743317, "uuid": "c352911f-db12-4a14-814c-27b2be2d11f7", "comment": "Malware payload", "value": "feaabff0f54fcb8f7e94612195e3f22263591be2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645743317, "uuid": "30456162-3952-41be-98c5-30712a5c48ab", "comment": "Malware payload", "value": "fc76b991e7d8ca95b257648a5c2b5ca7a9bbb2fba33534556eaa4a9ec0ec8253eba91dade440e1b93598bae184e0023e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743317, "uuid": "13af2dbc-0d5b-4123-ab45-e6ac6f610279", "value": "T18635BF063696C076C3AE17344E1ABB6D63FDED604B718AC7B6841F5D6C31AC2833635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743317, "uuid": "c9a82ad0-ab90-4b31-b9ba-03365c5c364d", "value": "7252dcd30aac014a5d2524c33764b13d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743317, "uuid": "0616f974-25f8-4a46-ae2e-c82351ec3b85", "value": "24576:6iIiGcU0Jmk092WkcEYNFs+upVOe528JO6PC:6iRGcUY0UvDYNFtur5Ro6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645743317, "uuid": "9a64a027-b923-4bdb-9e02-775767de6cf1", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645743317, "uuid": "7191e366-7e76-44c9-9146-b2e49a50b454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645743317, "uuid": "091bfae1-4bec-4dfa-9f89-dbf0b47fef91", "value": "19a6f9fb8bde5e452977640d233684bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6844bdf-9553-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645694839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694839, "uuid": "da2f4261-3a60-4d97-be87-b75316535182", "comment": "Malware payload (NanoCore)", "value": "b01fae13aba85c530381386db986dec5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694839, "uuid": "ba42780e-ba7f-4758-923e-8012bf395019", "comment": "Malware payload (NanoCore)", "value": "d3b98080f72fa85e0a5e91e178aca7cd01cdbbff0690514b0c682ce8e1a6956a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694839, "uuid": "3be31073-e96e-45ef-8b49-c4e2b3d249f2", "comment": "Malware payload (NanoCore)", "value": "c7563277b5f66771a3b9ea47c8b91fdf3b6c8ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694839, "uuid": "0e121716-57ff-4bfd-bca8-f1d131a40968", "comment": "Malware payload (NanoCore)", "value": "a6e2035aa11cb71ec87326f82dbb122179c9f8f35f715816426c1794608a9247ac4acbb0b43fb850bfecdcb162fe45e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694839, "uuid": "403e6e42-2935-4f59-b0cc-91dfee659f00", "value": "T18845AE0273D1D036FEA6A2738B66F27157BCBC654533812F12982E79BD705B1263E263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694839, "uuid": "cab51370-b7db-42f0-9c1a-b04c148fd4bf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694839, "uuid": "9565cdc3-58f3-405a-8f4d-e8ca8f82bd9d", "value": "24576:dAHnh+eWsN3skA4RV1Hom2KXMmHaEb2p0w10AS1aUGkV5c:8h+ZkldoPK8YaEc0w10AWpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645694839, "uuid": "55e187bf-d11a-476d-bb42-704a833365aa", "value": 1211680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645694839, "uuid": "fbcd5f37-cf83-4eec-b31d-6a2395828951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645694839, "uuid": "8ba7651d-c1ad-4007-b712-26abffd889a9", "value": "b01fae13aba85c530381386db986dec5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31fe5f4-953d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645685384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685384, "uuid": "d45b8d25-a354-4c8d-9ade-d5e66f7a8850", "comment": "Malware payload", "value": "e269326d931aca0cebad81b852dca512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685384, "uuid": "d61a1028-740f-40f2-8c34-56054bf0ceea", "comment": "Malware payload", "value": "d3b995fbd615a14281921a62d7541cf8fbfce0a21b6056d96f0977d73ed9d423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685384, "uuid": "c52b38fa-39d3-445d-8aff-c4a9717f9f3d", "comment": "Malware payload", "value": "b0b15dc572003f36d003ad47eb6bb643a99207c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685384, "uuid": "4b1776d9-4620-427a-8582-ebf51bb778a4", "comment": "Malware payload", "value": "ea22790e99a03efe5d2faffc6ef62e7ae07956d6e620261735da8294b3e2ddc014709450ca370a0b350c29e2fe92a577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685384, "uuid": "c43d5a22-f745-4f81-b878-f78ac262f5d3", "value": "T1A3D633CDAD66EA7FF83A523146D84DFF6AF32C602D483014AA633ED615B7DD02912634", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685384, "uuid": "5cf4c8bd-d9cd-47e5-913f-9e7777162e5c", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685384, "uuid": "27167f69-35ba-429d-8ceb-0451395872e9", "value": "393216:ne7Ua9ADF2rrz1ko7NIVthNd3WspFaA0MEbwg2jOWB8:OUa9ms0fx9pFaA0MEbcjj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685384, "uuid": "48f33e4d-6374-4ab8-a4ed-78ff4078d0a2", "value": 13092742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685384, "uuid": "4a025aaf-fb6c-4bf1-9a63-db1bb178919a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685384, "uuid": "303db22e-ac2b-4a17-bfe2-fae33312625d", "value": "autosubplayer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab041527-9537-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645682686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682686, "uuid": "d4a08619-4034-459e-93db-0d0a733b5ce6", "comment": "Malware payload", "value": "1a31ed337b869629042d4a5cfc17df6a", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682686, "uuid": "d7d60d98-9a82-4485-bb88-fed1bfb87226", "comment": "Malware payload", "value": "d3bc27832facd166370f3018cc93e804f624621372c2faca19aba739438bf959", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682686, "uuid": "83b55d4f-0c73-4937-a556-218c601d961c", "comment": "Malware payload", "value": "40a62a1bed2971d7643251e1381e22ed60d672fa", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645682686, "uuid": "25807b64-619a-4271-a0bc-de6a36cf2342", "comment": "Malware payload", "value": "f1820751c5ef1ce3a8967736e0fbe345a89a802d4bb36a7612711b7fec8a59365d5edc6899597be601f9e20c8ebf8d4d", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682686, "uuid": "c92b4154-29a1-4b3b-a5b1-d7eb7472f94d", "value": "T13D221ABCD0ABC2E8CFC96374A829BE4912D837ADD3C9A05375B823713B43E1954174B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682686, "uuid": "db7d09e3-b182-4abf-922b-2b89787e5fc3", "value": "192:rP1R2Yzbt1DUceMz/LnQQr3QFI8ErbmGLPor8ovpe/cihHXFsBLqHETEB:LvBt1D9VzDQyZ8ErlLgQmI/rh3SBLqHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645682686, "uuid": "dfcd5fd1-b30f-47eb-93e1-894a82a88dc8", "value": 10721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645682686, "uuid": "7fe9b8a4-6278-4fb5-94bd-684be20380ad", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645682686, "uuid": "f71bb6a6-e8f1-4391-9e3c-64b4227d061c", "value": "CANCELLED PAYMENT SWIFTCOPY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f10502-959c-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1645726129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726129, "uuid": "19d78f52-fade-4831-bcf8-283583c47737", "comment": "Malware payload (AveMariaRAT)", "value": "816409e4751720bcf6259505f5e0ffd8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726129, "uuid": "26d3b6d8-ed15-4182-940b-17de37a0c4de", "comment": "Malware payload (AveMariaRAT)", "value": "d423d7edf718ca00f8410a93834a6f9c99216c3a60860700f1fc6e493fedcc43", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726129, "uuid": "70c82950-23ed-4d4a-9699-fe1ce992d207", "comment": "Malware payload (AveMariaRAT)", "value": "d526db9d16187a823df5ed649985a7e02fe8d041", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726129, "uuid": "7304109f-b61c-4dc2-941c-810439272e79", "comment": "Malware payload (AveMariaRAT)", "value": "11bdb5ab5023daf6512c156962f69a03bb93856301ffde723eb50b45061cbe8f48fa3745c00253b729533a37779a45bb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726129, "uuid": "3353f7fb-55a7-4933-9241-a7b755b1e42a", "value": "T1A015AF12F191C532D02B26349C1BA2A89C25BEF07D6CE9463EE43F0C7E3A7497919D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726129, "uuid": "f6e5c2ae-3be9-4f7a-98eb-e4d128e27670", "value": "1c02903d270a37655f586f4aa8bf43c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726129, "uuid": "879fe765-7acf-49ee-9758-4e5743499053", "value": "12288:Cwkcdx+EleOmksXHxvkAhNSpCsJHr3A5WsS2x3pxjsppdTc:CBoxpeOmBBtQRJHrw5Wsd3/j+pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726129, "uuid": "70022cba-2684-42c0-bd40-ab69c18ee820", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726129, "uuid": "2c4e752d-9a81-4e6b-a8f3-db07efc4779e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726129, "uuid": "1b6c90b5-bc2c-4935-a9a8-6a7a3e61d127", "value": "816409e4751720bcf6259505f5e0ffd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56254361-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696288, "uuid": "7c58adcb-5137-49c6-81fd-c39952297736", "comment": "Malware payload (Heodo)", "value": "98ebd03a6fb996cd5415e370e1102673", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696288, "uuid": "a3fd7ba0-5d40-4702-89af-99381d415f53", "comment": "Malware payload (Heodo)", "value": "d424aad4518bdece0f357866031f9950b59791fa8dcc2acd5ee96b0b52de9d8f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696288, "uuid": "126c72ac-ca1c-46d0-8019-be4b3a1e4892", "comment": "Malware payload (Heodo)", "value": "b97ca3ed322c7567f4acf19ceb72220bf6332915", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696288, "uuid": "f67ceff1-adc0-4931-8afc-c5d70211faef", "comment": "Malware payload (Heodo)", "value": "d7e427fe87daa60862b916f057a78c487ceca3c6aabe7fcdd21b32e65391ba7a38aaf965420b79878f4d084e8844fcb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696288, "uuid": "660d05ed-7674-4b02-b15d-b2b35ceb6ed6", "value": "T106E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696288, "uuid": "d47768e9-e61f-4873-829a-2aea4676c403", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696288, "uuid": "c5735188-372f-47c0-9259-16118ae7a158", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK1e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK1LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696288, "uuid": "e7919675-f212-43c8-b0ac-fefe2e29ed92", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696288, "uuid": "f378dfea-b869-46b1-ad56-b48cc3a7077f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696288, "uuid": "27ae1ad6-bb17-472a-8096-f73c84935b2e", "value": "pv9iOcQVRtvYrNnU.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8760e8-953e-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645685725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685725, "uuid": "2a33e186-914c-4e41-9915-d890a8e42b4b", "comment": "Malware payload (Loki)", "value": "24653af17927e10fdf2be623589fa564", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685725, "uuid": "2bd74ba3-dc24-4ed8-bcab-50d0b2fbcad8", "comment": "Malware payload (Loki)", "value": "d47ae4f4dc0c0b8381f7f13bb64c4cf2c04751790763da3777ab99f75a6521b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685725, "uuid": "162643ee-91fd-4f02-8308-c6527ec1856c", "comment": "Malware payload (Loki)", "value": "8d45074565d73f10b11bcbbaf436f54ad0ab0094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645685725, "uuid": "9060e982-cab1-4c6f-9b77-71bae5e66d47", "comment": "Malware payload (Loki)", "value": "e5b9b9a1471d2a0f47a7c29eada3ead378182666ce38c6005fd4827fab044c57d0e62ae3fbd35a6e752bce836b26b105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685725, "uuid": "d862b703-630a-4b3a-8d23-709e579f8c59", "value": "T15EE4BE1039AB30DEF063DAFE9ED8FDF18D6AF13A620D71BA20420F565B49941DE12572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685725, "uuid": "c51e626c-8aba-479e-b05e-4b04f0e11a06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685725, "uuid": "05d15868-15fe-4828-8424-fdc422569c22", "value": "12288:cKEJ33JIAKcxFxODroolmmqRrxbgO+fPm2w2X1z14UVUI98+5BttpCpI6EJzM3X5:DeniNMFyrDaGm2w2X1zitq8+T8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645685725, "uuid": "cdafd11f-76ec-46a6-ac75-161c4c5f1908", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645685725, "uuid": "355d5dd8-6787-4fcd-bb30-c0f5cc6f5850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645685725, "uuid": "343e0b70-9eec-416e-8dde-4ada5591a095", "value": "RFQ 0640674876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e9440f-954f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645692907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692907, "uuid": "be7ab04e-9644-4e71-b609-de4fe09176ef", "comment": "Malware payload", "value": "6f83b8ab7b7146a3d60635c7cfbcd621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692907, "uuid": "2124e142-18b3-46bf-bc40-c089f9e77929", "comment": "Malware payload", "value": "d47fb2ff69549ce70bf24ec5b930a1d8f9d46dfbbe0b5f84fb2096cba10c2863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692907, "uuid": "ba1606ca-15a2-4545-bf87-b3ffeca3803e", "comment": "Malware payload", "value": "72d6f5f64c5ccbfd63c132412c58f4bd14661750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692907, "uuid": "cfdab478-4e68-46e9-9735-52c49b2dbd9d", "comment": "Malware payload", "value": "cceb8a3669d8a0e468f229389e9e05cb924f012b6f55a3553950abc0129361e6470453c690665ee6d6a9e96d28242a1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692907, "uuid": "c5910dd8-706d-4549-8920-c3113aa42af1", "value": "T11EF4BE2435BB30CEF063DAFE9DD8FDB19D6AF23A261E31BA20460F164B48941DD12576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692907, "uuid": "1258fddb-8811-4f9c-b89b-52e1ce95491f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692907, "uuid": "344831e8-7e5b-4b7f-8eb8-fe49c64de4cd", "value": "12288:arLNcj6mnZY7VtJ68lNqjKydnCiw3gyoifkLRPWIkudfIe38d2iXc8E3EJgl7Yk:/1MVt8ONZCnC3NfwWIWf211R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692907, "uuid": "8bce16b4-cb52-4a82-b7e0-d9527309c255", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692907, "uuid": "a1cc4ce6-dd34-4a89-9a24-380a145fff79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692907, "uuid": "44b58a18-74d1-46ea-9e6b-4361f54c2718", "value": "6f83b8ab7b7146a3d60635c7cfbcd621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e548d32d-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1645723586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723586, "uuid": "92ad8348-d2c3-4ce2-86aa-afd51a9e63e5", "comment": "Malware payload (njrat)", "value": "a27f72884f11c4966deb98f6847ca58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723586, "uuid": "88679bac-b8c6-4ba6-9115-71e2bf0283e0", "comment": "Malware payload (njrat)", "value": "d4b11972358cdbeebe4c7e1b8242a9318d2767fcef6f255376643a7e9e1ae9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723586, "uuid": "ccd3144c-8a36-4a28-9c54-15be767126d6", "comment": "Malware payload (njrat)", "value": "e163bcd83bd2aa746a0bdaa4b149a517313b1905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723586, "uuid": "ed20c2e6-363b-4cdd-8e02-9268f70043c5", "comment": "Malware payload (njrat)", "value": "a643201f5d0e6cb9e09906570ba62780be3320e251dfc27ecef298b353e97c38f27509dcc956a46f15993e7c0ce917a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723586, "uuid": "b780b957-c131-46ca-b2f1-ba3b8d35d6e9", "value": "T12364C002FDC195B2C6210D325629AB61253D7D201F248EEBE3D86E6DE9341D0FB35BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723586, "uuid": "159af0a3-a436-4f46-bfde-5ae7c45e7152", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723586, "uuid": "876d1b7e-b6eb-4e69-9c8c-2383ef14d1ba", "value": "6144:H8JsLcpjzTDDmHayakLkrb4NSarQWtT+tG1X98s:8zxzTDWikLSb4NS7ET+tG1X9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723586, "uuid": "6f3294a4-59ef-46c1-b49c-b5c52b3b4609", "value": 334355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723586, "uuid": "94baaa38-1be7-4ee6-9f77-9479e15c2b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723586, "uuid": "e0ce8de8-f686-43f5-adc1-8dfe156f4d38", "value": "a27f72884f11c4966deb98f6847ca58e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdcecc1-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1645723223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723223, "uuid": "e6c511a3-4b80-416b-9dab-1f6952ba02d1", "comment": "Malware payload (NanoCore)", "value": "0cb6a6f1ba3f7200bcde990c64ba102e", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723223, "uuid": "45726ff9-7638-400d-8d4f-36c07ac3463c", "comment": "Malware payload (NanoCore)", "value": "d5821a8b4b1fd3ff8a0863d7edc06e4e197696638bb8538d830f7ae747a15eba", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723223, "uuid": "69923615-9645-4a9a-9a87-559816d52e82", "comment": "Malware payload (NanoCore)", "value": "9a606f6cb7b63838a9e7b79d42e37d1b3ca31223", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723223, "uuid": "16eea404-3021-4428-af48-5df834aca452", "comment": "Malware payload (NanoCore)", "value": "d2b4312c2ee883473cddbb9c184f4a396a39569dd9fb4830a149675a45a90f3a6ea7cd4eb133be1ddf17564c3069a1c3", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723223, "uuid": "38cb1351-d289-4bf0-8200-899ae387374b", "value": "T18F141219BBD3DC8BD8729376E665E622BB51CDE5FD70EC29081430543BF8B254A0E42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723223, "uuid": "c0d933f5-1555-412e-9bee-bd6ecd178f47", "value": "3072:89mDU+8JeoEF5C/W89/RLQEeVnev3oeqC0RSgPTjZZLU3/UvLW8CiIa9h9rlB3Iw:T5IebF5mSEeV6olFkgPTXU3/UvJrP9rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723223, "uuid": "081ba756-4497-49ac-8455-ca4ea7e4f637", "value": 190552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723223, "uuid": "b0adc944-304a-4938-9ae4-e53e9bedb746", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723223, "uuid": "5bf66579-2a0b-4aa9-8118-fe9b866b8571", "value": "RFP for Jetty Materials 001_SAND.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a46dc1e-95c1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645741929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645741929, "uuid": "02694ab0-2930-44a4-8cb5-b046ce1e3c0e", "comment": "Malware payload", "value": "aeaa7dae9ff2bfd588b26dcf612ab1c0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645741929, "uuid": "11b82fe3-c6ad-4c26-acbb-667b8b48b763", "comment": "Malware payload", "value": "d5b4d58b11807dac84c5ddd482daf075a66bca33af1a5db547dfc30a7ee85c85", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645741929, "uuid": "0d9dca45-8b48-459a-a9b8-5c4d8cc5450c", "comment": "Malware payload", "value": "5d13dcd5a2a66294c505b0453de00509fe0f1c37", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645741929, "uuid": "f45b9931-8268-48c8-83ba-b8b3c6b5bddb", "comment": "Malware payload", "value": "cc29693a7c5f3773bfefb54a1d878a1e23a5baf392e959e3ca54bc173153002da1879b740bd0d22a2a93366ec913821d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645741929, "uuid": "b91d4721-f16c-4bdb-ae4f-4eb34d3b77ac", "value": "T17B93F20A54B6FC7DEF27C8B8A1640EF5F12B00C605C2DE5890E0BBAD6E17DD64B5E488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645741929, "uuid": "13a1c60f-23c1-48a0-a738-bb6bd3187a84", "value": "1536:Z+nXm5MB5Dg8cVoioFh+fYFl69oXiZ5bcvJlqGiwIWx1BcVXzAyVZF:Z43DsVhonV69o2bchgGaWBcpASF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645741929, "uuid": "8826e7c0-4265-4a23-a892-7ec8f047a9b7", "value": 97550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645741929, "uuid": "99f061d3-2bfb-4296-9490-c12056c331c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645741929, "uuid": "780e2cc9-94c3-4980-a3ee-bc553de5e6a4", "value": "pi\u00e8ces jointes_8044045.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84567a2e-9578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645710539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "d255c253-7784-4665-b216-37697b89d1d1", "comment": "Malware payload (Heodo)", "value": "f559fd02571c0cb7eaaa6f3abfcd4c21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "add302e7-f5c1-42a8-acaa-1a9e62a1f136", "comment": "Malware payload (Heodo)", "value": "d5f69dcbf1b24add174c77f671fffc11e702a3c545925feefb5280db8db48766", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "2e912284-fc4d-429c-a3e0-67264bfc7fa9", "comment": "Malware payload (Heodo)", "value": "27a67be50d735bac1bf8039d59aff8871ac97546", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645710539, "uuid": "15d3de97-ef66-43fb-b676-6c55f30a6b13", "comment": "Malware payload (Heodo)", "value": "dcc9f57cc0bb18183325af018cad01bc7556d4446b6b4b41e1a29624ebe0fd44d1368736088120f67eb5a89e7890b668", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "47807918-2c68-426c-a159-f83a8f09e487", "value": "T148E4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "db9e0d61-49ac-47e4-950b-0be0ad2101cb", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "aabd4cff-8033-4b3b-906c-eaa92a5dd78f", "value": "12288:y6f5tUaLG1iZuyzbVysg1wuKtKDYjX3rUXY:ygHpbVy97e0YjX3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645710539, "uuid": "ea77b1b6-0d5c-4cfb-90d5-5395cb22dbfd", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645710539, "uuid": "dac0628c-0276-4147-9d3e-8100f215ed09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645710539, "uuid": "42e34b56-3c47-41cc-ac03-dfdc9e2d3faf", "value": "emotet_exe_e4_d5f69dcbf1b24add174c77f671fffc11e702a3c545925feefb5280db8db48766_2022-02-24__134852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074ec91f-9550-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1645693149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693149, "uuid": "68b85279-e2bb-4c3f-ac76-0b7a01397d9d", "comment": "Malware payload (Gozi)", "value": "0179f7b0bd61f06d3705812e50583b20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693149, "uuid": "4ac09463-afa4-4743-ba05-d5382eb7d544", "comment": "Malware payload (Gozi)", "value": "d61ee5e7b17684983ea9049f719beb05978a813638f53f7625e970bae1c2abd7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693149, "uuid": "01567067-fe25-49b9-b686-ba7151fd1a85", "comment": "Malware payload (Gozi)", "value": "c640e2e26b783093c8b1d418af11f468c828458f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693149, "uuid": "63bba197-404b-48eb-9b88-1bf9e214b530", "comment": "Malware payload (Gozi)", "value": "ca09ece34ef2ea1386261e8979d4aae7ec6bf49abeec07a749b913307c9a81769f31b8fa8564e9baa5cd38eb8c82f695", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693149, "uuid": "ec96ce3c-ce1d-4739-9da0-35300dc40205", "value": "T15E84E85EE3D019CDF1E72CBC6564639A0FD50FB20E3EA0B7A013288925715F89D2AB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693149, "uuid": "c778c5a8-8542-4ebe-bd44-c5fdf83c863e", "value": "c311ddd1f8a9ea5ca6b95a50e682512e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693149, "uuid": "e396dbfe-b14f-4dc5-8af1-96ce24d4ed18", "value": "6144:dtukWLu3M+uqn3F6vPNZAdSEJayJjVSSfz2y/huNT+:bWLuc+uKCqdSEJPNVSSP58T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693149, "uuid": "aba70928-9030-480e-bb5e-0a85b6ed0daf", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693149, "uuid": "4e8b3927-a53a-414a-ba0c-d42c1ebdd09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693149, "uuid": "cd47874f-19f8-469a-9b89-ca24bf47aadb", "value": "0179f7b0bd61f06d3705812e50583b20.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17ed501-950b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645663772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663772, "uuid": "c07d158f-06ee-46da-b7b4-907c9ce98219", "comment": "Malware payload (Heodo)", "value": "69987ce484964fe6f595ce0c4d6f799e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663772, "uuid": "2ce33380-ab32-4238-a19c-a672eb85bceb", "comment": "Malware payload (Heodo)", "value": "d6327125cdc91a9173b201bad2b1dbfaca982473fef0cb575f6a65b4a805a07d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663772, "uuid": "ebe31f63-87e0-4d0b-89ca-04b75ede2e9e", "comment": "Malware payload (Heodo)", "value": "1c776d9abd9580b689068d5939da69b932ad9dc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645663772, "uuid": "3840e685-64a4-4ee8-950b-acd45449534b", "comment": "Malware payload (Heodo)", "value": "6df8e19138e5b604b5a76da0872e12294a738b4df51c93fc76072317e571ecac6e8895c7b320d085016f8dfbe6e6297c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663772, "uuid": "bfaabee7-930b-4167-ad84-2dbf24de7374", "value": "T1C4E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663772, "uuid": "d8e71c30-0e32-4e52-a82c-633d50c5b66e", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663772, "uuid": "babb05fd-83eb-42d1-befc-061efd13750f", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA08hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfIPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645663772, "uuid": "09fad5cc-70bb-45c9-b10e-9957a436d229", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645663772, "uuid": "359b8425-7387-4ce6-afd6-70952e8e0699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645663772, "uuid": "1f91ec4d-b608-4564-822e-2c9eb2edd7b9", "value": "69987ce484964fe6f595ce0c4d6f799e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5ed38b-9544-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645688352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688352, "uuid": "c1b5bb25-e90b-4155-add3-fef71598b3e1", "comment": "Malware payload (RedLineStealer)", "value": "e581a27aff9ceb5073f07ba9a4f73852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688352, "uuid": "191fbc35-cee5-4137-8057-b8ad0b01c337", "comment": "Malware payload (RedLineStealer)", "value": "d63c19155af0a329cd61cd832d7c4d2d5bbcb61067ea764283b664605979864f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688352, "uuid": "ca59b406-4276-4855-bf39-1da0ded1df71", "comment": "Malware payload (RedLineStealer)", "value": "68b2613fe90507947cf554daa931eba6795be69f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688352, "uuid": "9921a002-3813-44fd-a5db-a6a914ae3302", "comment": "Malware payload (RedLineStealer)", "value": "f03a0a45c7093af9a4442edc6e2ab7cf614e6de5d4cf91db5926535dd20dec1170d3379904cc9f234eeaeedabbeec749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688352, "uuid": "f7f960ea-be30-415a-aa92-7ca4964dc876", "value": "T19DB4833439FB9019F1B3AF75DAD87996DB9EF7632707E84D205003864A03B82ED9153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688352, "uuid": "e1c82a70-26b3-4f1a-bb10-f8a6e2b24d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688352, "uuid": "f0525b40-236b-49a4-ab0b-e0f608fb2b68", "value": "6144:/Umwg/C/umSslMvsYnaxfXryUlXq0u2+0bw3EvdOJnI/un8:n/7mSkvYaJXuUlXTu2/bw3CQI/un8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688352, "uuid": "0c0fef63-96ba-4927-a4fe-3f4faf9e135f", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688352, "uuid": "086a3852-0b46-4b55-903b-c7572ec76919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688352, "uuid": "b888abe5-d301-4feb-ad65-5218a7210408", "value": "e581a27aff9ceb5073f07ba9a4f73852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14897fec-955b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645697896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "a535de5b-7daf-4a6d-8b50-97fc8485bc9e", "comment": "Malware payload (Heodo)", "value": "b8fce6924c9b54c522fadd1ea9bf9a44", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "84fdd28f-54ba-43c0-affc-522eb0f85fe9", "comment": "Malware payload (Heodo)", "value": "d64a896ede5a621a83a2c459649806096bb0af470954dec11ab4078c353e2185", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "023da039-d24d-4af8-948d-e6d4ef8f6115", "comment": "Malware payload (Heodo)", "value": "a55e405d05d2949a68c32d3fbf5b1085faafeab4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697896, "uuid": "122e2289-dcb2-4fd7-9d62-51d71d804547", "comment": "Malware payload (Heodo)", "value": "2dae427ec68eed3cc5676661831729429d8f3aaf83bb65e4fb5da850bf3ab46a247caa50a35babf5fe23314d70533092", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "7d81f7ac-a68a-451b-96d6-a290d442da8f", "value": "T1C7E4AE607B81C0BAC31E30B50517A37966E9A9709F3897C7BBD46B7F6E740C19D3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "f9a2dd3b-afa8-4ccd-a54f-2e64d9e3e6df", "value": "cca9170027b8a1c09e4e49e3efdfdd6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "5d04691d-aedb-4e90-a1d6-e3bd0d15ddef", "value": "12288:JzpSPnEifD6xu1XRiTFIy30ZKm0XAsD12m1yMu0mPVOXNZ:JzpSPdDBQTFIy3mFWAa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697896, "uuid": "7c800053-aa6d-49ef-9901-d96bf05b427b", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697896, "uuid": "6ae57766-990a-4892-8cc9-3edf3cfceec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697896, "uuid": "24597061-dcf9-4af1-bdf7-0e989380318e", "value": "emotet_exe_e5_d64a896ede5a621a83a2c459649806096bb0af470954dec11ab4078c353e2185_2022-02-24__101808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1524c22f-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687159, "uuid": "b6d5277e-dc06-44b1-ae01-3d1fccb00c4a", "comment": "Malware payload (Gafgyt)", "value": "725381a760ef0ef2776ecc269150cf9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687159, "uuid": "a840aee9-38a0-430b-b6ef-ad4ae44c4f9e", "comment": "Malware payload (Gafgyt)", "value": "d6c84d83eee072df9af44e28f2de81d0a4de2750f7b7f68a24c0c55b5bc5f822", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687159, "uuid": "cee113ac-1a34-446a-9dd6-57a78dd5880b", "comment": "Malware payload (Gafgyt)", "value": "dcc6fd7ced0d73ec253c7bd9d244e278234ff4e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687159, "uuid": "2d970fe5-d1be-4ded-adfe-f6e6435e4f7f", "comment": "Malware payload (Gafgyt)", "value": "09b48fd908dbc3f2d7c7fe5f9be0a9d752d57b57ad9997a8c921a6c97e3647d53f2aa308f43db61b8994da806bd9259e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687159, "uuid": "d52dcbc7-51f7-4020-b972-e89daae16bf4", "value": "T151931941FD418B27C2D237BAE78F435D37366A54A7DB33116A356EB42BC27982E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687159, "uuid": "08db0431-6288-4e0a-a4b7-a78e3807bdfd", "value": "1536:LBkl9VQPA+S7YyEfgcqpq1innPTxHOxliPuseEH7mmREqQ4b/X7XSee:GQG7YBv1WTciPudmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687159, "uuid": "842bba2f-581a-4106-9944-b58627fc5bbe", "value": 92441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687159, "uuid": "85b88fcf-4837-4cf0-ac2d-51196216cc2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687159, "uuid": "efb52577-da23-48bf-8600-4cf7668184df", "value": "725381a760ef0ef2776ecc269150cf9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4fe7f4-9523-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645674077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645674077, "uuid": "02895d2a-5330-4f93-9970-8a139fbb0585", "comment": "Malware payload (Heodo)", "value": "8043ccacb5b0171758a5ec2a4ef3ef08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645674077, "uuid": "8dbb10b3-e6b7-4e7d-a382-10ee88a6eb49", "comment": "Malware payload (Heodo)", "value": "d781146da9c50236228f15b285ed51e3a591c132f0b57140a055ea44e6dce322", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645674077, "uuid": "a4f5de20-bc40-4169-984d-c70fdd2c91ac", "comment": "Malware payload (Heodo)", "value": "e25750dbfddbd2eba8b4a8961d31cdcf82891092", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645674077, "uuid": "a936f724-a622-46f9-a986-010ff0b248dc", "comment": "Malware payload (Heodo)", "value": "b1c32bf38b86ead4473b8330fe6773e5f4d862d2378b009da6b9b272c436dd3d3a271ebe83513fb6f16e85872fa35848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645674077, "uuid": "75c5545b-7cd6-40c3-80ea-c8d5f71ee08f", "value": "T117E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645674077, "uuid": "915504e5-9300-424d-90ac-97110f95cc4d", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645674077, "uuid": "78039d62-03e9-44ff-8cd5-99ebf4b8078c", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0ChR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfKPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645674077, "uuid": "5566073c-6242-4bf7-b96e-6945404f97e5", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645674077, "uuid": "9ae1ba8c-e504-4e66-84d0-f048bfeefa40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645674077, "uuid": "9fb8f6fd-d9a7-4b8b-a3f9-6ef1f19de9e8", "value": "8043ccacb5b0171758a5ec2a4ef3ef08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab5cb84-959c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645725957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645725957, "uuid": "a74daa16-e707-43b5-bc22-d388410fcada", "comment": "Malware payload", "value": "908eeae1bea71478054141099e93c101", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645725957, "uuid": "cbe6ed90-0861-4b86-b84b-2a7976ae31d9", "comment": "Malware payload", "value": "d78b37b951aefe24cf72c5d633b1417dacf2bc3fc5fe713769cb955020270664", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645725957, "uuid": "2ff6991f-41dd-4c0e-bbe8-08d3375e0c9a", "comment": "Malware payload", "value": "60dc53d96d2a7808a8583b6dd28b9371af05fc76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645725957, "uuid": "901c6780-fae7-434b-999b-d4c5d219b1b5", "comment": "Malware payload", "value": "3f6ccf3c5e5c0229bff8afad827322c25e5646750d87d5921176fa60fefc1dc3e76d00ec040ff08ff903fe8f6ff6106e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645725957, "uuid": "02c28f5b-d2aa-4785-95d8-eb6f136b3435", "value": "T1E951ED11BAA1DD4AD8006F364CA1D3C83336BC40AF22E6833680733F5C3B2C08412032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645725957, "uuid": "c808709f-fc77-4edf-84e4-07baad39333d", "value": "6:j1bxc+CF2DqbXbEGR1/CX22qQNR0/UA4EH3zlGtrmyG81Gje:pbaF2uLbEY/iLNR0/yEHjst1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645725957, "uuid": "03494ce2-29b3-4596-968e-0a992b1afe48", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645725957, "uuid": "fe8f4acd-7dea-4546-9cce-461b112542d8", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645725957, "uuid": "569e7298-7375-49aa-8bec-2882e2db8d73", "value": "SecuriteInfo.com.Exp.CVE-2017-8570.OLE.35938.17020.1895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096931cc-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "b165053c-726b-4dec-abb4-ff72e3feb21d", "comment": "Malware payload (Heodo)", "value": "4c497f3867177eea806a8eb9cad17e08", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "3ba4886c-d243-4ce7-8583-ec8fa0809685", "comment": "Malware payload (Heodo)", "value": "d8522ff6ce9e116e3e1a3da09b292d5a54805d496cff46c07421126cb6b010e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "f8be201b-7393-4894-93d5-fe2437467130", "comment": "Malware payload (Heodo)", "value": "9ec6b1e95539f87019d3ba3a4a6e9dc78cde1f5f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660940, "uuid": "be5c782f-4062-4a19-8e2b-eb6ea041dd70", "comment": "Malware payload (Heodo)", "value": "5be2e103fbac75915189d87fe184a7b2b5f748c3900af3b381b1f147f13fba0d9a3cc95ba1aabe5e3da640ce45031f82", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "7f495ec5-f554-43e1-bf51-24bb9aab0f84", "value": "T1F2E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "d7124a2c-a5de-4f94-bd64-b8c13e5ee5ff", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "8d4820c3-cdba-4f37-8a21-eefa692e7457", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKYe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKYLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660940, "uuid": "12705e1f-99e0-4011-9dc8-d77513bd6df4", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660940, "uuid": "6cc9e3b9-422f-41f3-ac44-547d776b1247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660940, "uuid": "2f8ce070-c8ff-4d25-903e-daf672545fa5", "value": "emotet_exe_e4_d8522ff6ce9e116e3e1a3da09b292d5a54805d496cff46c07421126cb6b010e5_2022-02-24__000211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b20500-959c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645726159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726159, "uuid": "86831b56-8cde-47d0-9a11-5b287ab12f09", "comment": "Malware payload (Formbook)", "value": "9572e695a50ea24517e2414010e10b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726159, "uuid": "d29c19f7-706a-42ac-8c3c-0e59cc08489e", "comment": "Malware payload (Formbook)", "value": "d8f888158556fe3971ae3904db9268b95c1d7f3ee1991dbd04002e018b65750f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726159, "uuid": "5c70a969-7b4e-4781-a4e4-964bc774c455", "comment": "Malware payload (Formbook)", "value": "ae079d5e44e8b797dd8c29a9f9fd13d9466bc97a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645726159, "uuid": "06cf6c03-dd6a-4e88-96b7-e2453ad2eff6", "comment": "Malware payload (Formbook)", "value": "bd8c58cde504897fc0dd594db59aed69efec84603cbf291f3bc749cff3ba60f65b2a90fd939919023d431d071110c8c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726159, "uuid": "e9caf332-6aff-406a-a18f-004b51365d4d", "value": "T1827423B937C5885BF61911B2C8B2DB72EAF2F3002672651F9B485FFE4C2B2469F41065", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726159, "uuid": "4c5b1a74-ab16-4e85-9410-684a72ea3826", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726159, "uuid": "f6365e9d-e6f6-439f-97f7-a19ed7820525", "value": "6144:TxD7+ihfubpqe6ZFBwZlt26euWhXlUCU0Ch5dlGBkV8Vd1vBIZLlGs7:4guA1ZFBilIpuKChNV8Vd1MLo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645726159, "uuid": "7ae9cf14-7512-4f8d-a391-5e162a63e4f6", "value": 340590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645726159, "uuid": "34cc356c-fd44-4b9f-976d-e7efe25472a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645726159, "uuid": "95881aba-d51c-48a7-bf72-b92f3eaeb1e3", "value": "9572e695a50ea24517e2414010e10b46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de12bc78-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1645693080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693080, "uuid": "8f9a9764-40cc-4552-b05b-5d8abc137294", "comment": "Malware payload (RemcosRAT)", "value": "260c8dfbbfc36444b9cfe91c67490563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693080, "uuid": "b9c62be5-5aca-455c-ae0f-17509ec0aae5", "comment": "Malware payload (RemcosRAT)", "value": "d9e5dcac1e680220887d90b7a8afa0c8bbdd0f8f569bad470c8ec1cc5f6b5a72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693080, "uuid": "e1d10bad-9743-4835-8b33-0361e82bba83", "comment": "Malware payload (RemcosRAT)", "value": "4a3a2488a46e73df76021c1fff53d97159b59f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645693080, "uuid": "bf010f0d-be46-4416-99b0-4ab392fc2ce3", "comment": "Malware payload (RemcosRAT)", "value": "037dfc8a392fba52653f7794a784550c1e062e7593c0a5f95f8f4a29dc5397927220b8f776bc3a551596adc0c85717ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693080, "uuid": "89ea3fd4-1d19-47ac-83f3-5888d90c5f6b", "value": "T178A4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693080, "uuid": "f0f6f9e2-d2ef-471d-b25d-5eff68b85e2d", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693080, "uuid": "2e1f290c-f82e-4ab4-ab6b-d9dc34117986", "value": "6144:nOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUAyg:nOFtiNBuFgawDB4NOmuwsfZP3yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645693080, "uuid": "72aecd41-1ac5-4f3a-ab1c-df8cb629c24c", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645693080, "uuid": "ffef9a3d-d9bf-4c1c-850e-2853ea71bc50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645693080, "uuid": "2ebed84a-8ae4-4126-800c-ce305ce4f9e6", "value": "260c8dfbbfc36444b9cfe91c67490563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826c5f1e-954f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1645692926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692926, "uuid": "d3a86b8b-7181-4ab7-8b39-f064cf7f8ba9", "comment": "Malware payload (RedLineStealer)", "value": "680c959f748d59491b0aded313510433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692926, "uuid": "efe0e0cc-cbdc-4f51-892b-af95f1e208a1", "comment": "Malware payload (RedLineStealer)", "value": "da3327ca4050b09d47f2e051887e14d4f6e4a7b8e058f591c4dce84f7ae7cf48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692926, "uuid": "42cd9664-f72d-43f5-b12c-ca3adfbbdfb9", "comment": "Malware payload (RedLineStealer)", "value": "289c427cb41204496eb2f8aac955b3d6a7ac63ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645692926, "uuid": "cf0fc700-38c5-4c8b-a7e2-52c4d4cdc691", "comment": "Malware payload (RedLineStealer)", "value": "367a950e520cfc1600df740a250e0de9cf296471420c688b5af2e69793ebae1d3fb93ab0e8ec63b105ae1307d9110b84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692926, "uuid": "7e4f6e95-b49a-4e35-851a-bd58e1cd6254", "value": "T18654121069914032CC53903475BDC060EA5E693226B666DF9F025769EF301F3BBBF6AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692926, "uuid": "5570291b-a0e6-4122-9905-fd545d24c2c7", "value": "6144:hXRT0e3zutjXetpgFmYYor9LbdeYpKGTzM3:hh4S6tjXetaYor93dPcGTzM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645692926, "uuid": "691824d1-6625-4fb8-9510-f901f4fbd4d4", "value": 300417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645692926, "uuid": "682cd13c-07af-44f1-9b2a-5f363cf0c30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645692926, "uuid": "f8273539-7642-4d0b-92db-4afe2efacae2", "value": "680c959f748d59491b0aded313510433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02694a78-956c-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1645705167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705167, "uuid": "89a58c31-e1f4-41cd-acb3-ffa5f855de1e", "comment": "Malware payload (GuLoader)", "value": "8ac5479e32a15b2ab61ffe50dddf46ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705167, "uuid": "4dcdcb53-1af8-47d2-92fc-e1dc86b4f771", "comment": "Malware payload (GuLoader)", "value": "daee56890a36afbcf2044b66bfa96ad24c6de67064ccd49d02df3f8d7cad3548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705167, "uuid": "9b4cbde2-8e12-4658-bb76-b7ca2b6d2c2a", "comment": "Malware payload (GuLoader)", "value": "f07bf042fb523444660b20b472383b87f4566479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645705167, "uuid": "14285dc5-2c98-4b36-b42d-e8648775e5eb", "comment": "Malware payload (GuLoader)", "value": "4942e69719f1a3e05cc3eba302388105ed2e6a4e4dfbd71443ab4870b1031a3122eb99ce4473a954c56bf1dd3e628a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705167, "uuid": "8238564d-7e96-4b13-b67a-c8cfe9e812fc", "value": "T17BC42204A1E0CC8FE8675E3658B2AA3303F6FD3931464B075B81BD147D767D26A2E71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705167, "uuid": "c855c6c9-a1d5-468d-8be1-a28752d6cf16", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705167, "uuid": "05753dd9-93a8-4a09-982f-6a594bd46d17", "value": "12288:RbK2cgYRUwgyKcLlWRhIg/uBVelCej78cV6HqQlK+a:RbpcLDKc5WRh7YVelCej78cypo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645705167, "uuid": "0728a0cb-2a2a-42b1-a924-291f6be2d6a5", "value": 547168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645705167, "uuid": "6d3aa040-a37e-434f-94d2-1b7b4066b27e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645705167, "uuid": "7832923f-4135-4468-b98c-8173a7e6075a", "value": "Spares quote #78585 (500KB).pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb19efe-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696272, "uuid": "00791332-7fc4-48ad-b290-89bfbfde5a83", "comment": "Malware payload (Heodo)", "value": "d7a4678fb13942990b8f094bbd7811b1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696272, "uuid": "fa26326b-5f54-49ce-b10a-c17da3ff1354", "comment": "Malware payload (Heodo)", "value": "db5720b70338bb33748afd5f554dd7929eecd577ac685967e112956f9f96392c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696272, "uuid": "c1445a68-5221-493c-afae-e2e88dbe57ec", "comment": "Malware payload (Heodo)", "value": "7f7b2be9cc51bff2312a45b357da9d9c2cd3d965", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696272, "uuid": "027bd651-fa1d-49fd-adc9-e0b862d0bd79", "comment": "Malware payload (Heodo)", "value": "bfef815f35340d2dbb04139017cd3786ffdd4771736fc8a7a9b58398a77b509f5e8bbb529df7e56c1e1aa7c9dd9eb126", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696272, "uuid": "84d3f03a-88ac-4a81-a763-c3efd3b60fd3", "value": "T196E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696272, "uuid": "9efae0cb-f1ce-4153-a018-124cec3ab93d", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696272, "uuid": "08d2a48d-44e7-42a2-80d6-f792888d4825", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA06hR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfePhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696272, "uuid": "2a5d985b-338d-48f2-b14f-fb8bf4c91f9d", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696272, "uuid": "56794fcc-07f6-4ca2-8d47-5a2f67b8f2d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696272, "uuid": "caa79a0d-ebb3-4b59-a0f7-4e68635f7c0c", "value": "8i2V.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb31a8a-9547-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645689323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689323, "uuid": "585bd9be-04b3-46ef-82de-8d6d831411d7", "comment": "Malware payload", "value": "fd24149b7ab03151a399654803e07db7", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689323, "uuid": "7db1cd81-a8d6-452b-b075-5aa148cc7405", "comment": "Malware payload", "value": "dc0b049e31370d61a3195c5e0528237d4120ce72ae3fef4ade59c016e18157fd", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689323, "uuid": "2adfd661-58bf-4f0f-bbf2-358320001572", "comment": "Malware payload", "value": "dbfd70bcdb7b271fa2ff8ea1aaafcab0e6c497da", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645689323, "uuid": "d3aca8e5-f3a4-408e-a7f0-5c50e21ef101", "comment": "Malware payload", "value": "34038a44e74896c079147f187071e6c2680d7fe28c94c1842a2680a11b2c0cfbb7a7264e86bdc053f8e30a18156fb7aa", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689323, "uuid": "8ee19820-48a0-4155-8229-8c659ffff926", "value": "T1D013AF08C051250AC273663EC83888E51D979C57A11989CFE5E97A0B1FA4DEF3B4EFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689323, "uuid": "b770536e-7e38-40c3-8c04-c2c29b1de5fc", "value": "768:B+25RD4S0JS00SneSnjS0yS03S0IMS0bS02SxD/PoVK5Z1lDVn3QFTy1xqwVwxy/:B+2np75eAGAhNeIrO1/K8NytsR1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645689323, "uuid": "ecbf7b85-ddc8-4fde-b34e-ab96534933db", "value": 42629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645689323, "uuid": "2732f0a3-76e1-4225-9d72-1554aa8f971a", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645689323, "uuid": "68a28441-2b1e-44ed-8aa7-06312c164cb1", "value": "RFQ2107798.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523b0832-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696281, "uuid": "67082572-08ff-4462-a536-7a7b1d9e8a54", "comment": "Malware payload (Heodo)", "value": "b5c1ab324a2b44a35d3561333cb0c713", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696281, "uuid": "8c2f028d-8deb-4251-b05c-e1117b5aa797", "comment": "Malware payload (Heodo)", "value": "dc7e8f9dc8a83444f6c7dfe14b01524458e1f6ddf715e7dab09a8bb07e0c504f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696281, "uuid": "ba8159ee-f3b6-454f-ba71-5b1ec9eae2ce", "comment": "Malware payload (Heodo)", "value": "7eed40b5dc592993273d34be668c3037470f08d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696281, "uuid": "18bb928b-36c4-4ac3-87c1-24f99ca9cbdb", "comment": "Malware payload (Heodo)", "value": "7713c030f7e2da09efa92ef4aa95c3af39e134c6a4e7bdf00773cf4b781f861262bc5fc04fff83c1b2f74dba6869d1d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696281, "uuid": "688fa58b-944a-424e-99b6-76f5ea76d172", "value": "T129E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696281, "uuid": "baae5218-3a2e-4448-ad2c-791c479e0a0d", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696281, "uuid": "1724dd2d-79e2-4b4e-bf63-b0f40ce49413", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKCe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKCLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696281, "uuid": "0cb83889-f785-493d-9d68-7493de6e82e9", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696281, "uuid": "925ecf4a-9388-4782-9899-68c6676145a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696281, "uuid": "ca79a154-bba1-4113-aac8-75326a8e1b47", "value": "KDbFxA40o9tAFDX9JJvwcCr0Qbwk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196ed25d-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1645687166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687166, "uuid": "54087cf6-0244-45c8-8687-a2474e0088ff", "comment": "Malware payload (Gafgyt)", "value": "0c425ce1cc7193194c0517ab18baf02a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687166, "uuid": "78466773-785e-40c1-8d4e-060f078c24c3", "comment": "Malware payload (Gafgyt)", "value": "dcbf53283fba9d45e72046a2026aa7ae06e1a62ecf8e442d568f48682c6c426a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687166, "uuid": "2d0d6b7b-35e8-461b-b237-eaeff1ce069d", "comment": "Malware payload (Gafgyt)", "value": "f5504489e229200cf0ae269084e8a62df23aa452", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687166, "uuid": "ac09a6aa-04b4-4cf9-993e-9d82ce26ef01", "comment": "Malware payload (Gafgyt)", "value": "ee471b52b9d977d547e847a4e3492eecc96e01d8c7c31d38daed63f544423500b90ea305e893274699000266a198a788", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687166, "uuid": "b8691d3d-c806-425a-8d88-47060621d43f", "value": "T1F9931A41F9408B27C2D227BBE78F439D37366A5497D733026A257EB42BC279D2E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687166, "uuid": "caa7d49a-cbd2-4c3b-a5a1-cba9dda13aab", "value": "1536:EIkg9VQPA+BJCTEb82Mm3xDKMsF0rOLcvgZPzRxQMHYesuW3R98SmCVrQAFW9OXs:dQFJCTDWWFGgZPB2uCISmCVrQAFiOXkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687166, "uuid": "d183bb0a-8aba-405f-b2f7-26e793ad3d50", "value": 97531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687166, "uuid": "4b4dc576-c964-4860-a039-9cd078159653", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687166, "uuid": "e6a81217-62e5-4ca4-bbe1-18f0401e007e", "value": "0c425ce1cc7193194c0517ab18baf02a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973a27fd-955a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1645697685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697685, "uuid": "379b224e-cfee-42a1-9d87-f0402da97d77", "comment": "Malware payload (Loki)", "value": "9a32ebcf61984d3c667adb5c14330f37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697685, "uuid": "de9edbb7-c98f-4b9a-ad55-0819db9ee6b7", "comment": "Malware payload (Loki)", "value": "dd555b4b4a68ce3505b66201f994671b3887ab2ff4b3278f2098a20d6057c918", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697685, "uuid": "db99fc24-0266-448c-82a4-48c8b70e6f21", "comment": "Malware payload (Loki)", "value": "fd3ea3adf08a8a3b8bd0bfbf59679930c4beec5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645697685, "uuid": "7407fd79-8505-4085-a181-4d0ef6405324", "comment": "Malware payload (Loki)", "value": "70b0bd04461a30779aa975a84929e2db7e6433a98404129ef36cefe38f4f0486090c6c15eca9702571a784362bb5fb29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697685, "uuid": "f56b5e35-915e-4730-925d-219580ef1a64", "value": "T1E4F4AC1024AF66CEF0369BFE5DD8A5B18FBAF53A3509F1BA18811E860B51F41DD11A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697685, "uuid": "fe16c9e8-50a2-4073-bf46-c36016121a1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697685, "uuid": "51916338-3101-414a-93f2-392cd6a3a088", "value": "12288:A0pbEJgYYz0+cSV914drfqZrxnAkhdJA8vsSpvNFjGnfKbFxjENzT4hQIA+:T9wqurfq5xAk3sSNuKbkNzT5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645697685, "uuid": "1fc08ce3-f4d4-4703-854f-8010001f757b", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645697685, "uuid": "692dc924-a9ce-4a99-8989-141fe5026326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645697685, "uuid": "3132ffe7-d408-4c40-b583-6f5900acc2ca", "value": "9a32ebcf61984d3c667adb5c14330f37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d494a4cd-95a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645729142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729142, "uuid": "a2b8cbda-663b-4394-a4a1-4996a84af6e0", "comment": "Malware payload", "value": "db73de377b65213640e910db6f18f33f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729142, "uuid": "8e6a19d7-f14e-45b5-8940-4e8a5de5c44d", "comment": "Malware payload", "value": "ddb0822b3ff456aa4d91bf7356b01193a63b0e333d1a4c281e7b7c18733b8fd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729142, "uuid": "999044d6-b78a-4381-a381-46ae3ff3875e", "comment": "Malware payload", "value": "b5d30bcb05b536b7736be7c49502a39c24281f82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645729142, "uuid": "dec34813-c4d1-4571-a38f-6c7bde8ec302", "comment": "Malware payload", "value": "13455005dcfdb23ad7515a499873f67973229838de42aa94ad8c03cc63768740ff59862e20ccd9ba4d0efda72616a8f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729142, "uuid": "d51fc124-b563-4f8f-88bb-923cb91cdf50", "value": "T1CAE47C48DB5345C1ED98667AD9F667123261FFF09ECBC60B31AD283D82B67593E8024C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729142, "uuid": "b00f09cc-5dad-4f07-8127-7d71b404044a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729142, "uuid": "e688f540-1b36-4bcf-9b22-266eeebb6176", "value": "12288:suMFtEVwLEXH22qla5w/yXbx0jH38X4ffPfGChs019TBPrGS:sbEq6H0MW/IbxeVfP+CaW9TBPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645729142, "uuid": "15b33d97-e33e-48b2-951b-8fe973786796", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645729142, "uuid": "31517d05-f374-4c73-9721-969fa491b2a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645729142, "uuid": "25aa0904-ef65-4eca-b9fa-e25dfbac55a6", "value": "db73de377b65213640e910db6f18f33f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d82b80e-9580-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645713909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713909, "uuid": "d660eea8-1bc8-4188-82b9-e43f769de0da", "comment": "Malware payload (AgentTesla)", "value": "843678eae73ab2922fde36533ffb6062", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713909, "uuid": "edf2320c-5479-4c8e-8cad-3e73a707dca6", "comment": "Malware payload (AgentTesla)", "value": "de3e75d038d425ef1a2767a45d49788264e5c14e6ce16566faaa08e389f8876d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713909, "uuid": "d045d86a-442e-47d5-9fa5-086b9b0a0bb1", "comment": "Malware payload (AgentTesla)", "value": "1e182ced2732597a06bc90417e5244ad6a8457a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645713909, "uuid": "9d769342-2126-40d0-944b-521978bca471", "comment": "Malware payload (AgentTesla)", "value": "4935b2293414ff6fd52ebbe10830fd559692b22aed6b2a5781a8b0e965bb7e91624b63136af61a2f6bbd853b6f42c08a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713909, "uuid": "417d9df0-d2cc-458d-8f4d-1c8ea4479183", "value": "T16AF4236221B55D78F5A2C27827D346DC3A38706FA212F88D795CC9E21CAB9403F37276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713909, "uuid": "60cbc8eb-cd22-4e6e-9891-cd9690f2c4c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713909, "uuid": "c5a37324-c495-4295-acc1-f4ad9f056e09", "value": "12288:u4hvf9z7ROarRV1M6rZL53S0st8d3oSimlf0sUwRSn6WBFT5zzPN1UgHuNzFsxU0:u4hvN7Ea9V1jrPJoSzfWwRsFT5zzPN2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645713909, "uuid": "1f02762b-b384-48b1-a615-b05aa955eb76", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645713909, "uuid": "1ce8acb4-69bf-4074-b2b9-9c1189da6212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645713909, "uuid": "4931a06c-92e2-4fac-8ee0-0c8d2a60babd", "value": "Invoice009287374mm_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdc3dd9-9511-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645666347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666347, "uuid": "2e07b5bc-753f-4083-bfb0-8762603224a8", "comment": "Malware payload (Heodo)", "value": "ed6efa1d0c23b733e8bae5d372b5f5d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666347, "uuid": "054b8c30-021b-4ffe-9188-7c40d07a10fd", "comment": "Malware payload (Heodo)", "value": "de9257f46189498d9465dbc87612e2f16b17d97410f59832b98551cbf74f8856", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666347, "uuid": "0f62c43e-7b34-489e-a2de-19b33713b4d4", "comment": "Malware payload (Heodo)", "value": "c87898bd19616131155c45de5daa279d92a37193", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645666347, "uuid": "4631fac7-4af2-4d89-8208-3fa77e466cfa", "comment": "Malware payload (Heodo)", "value": "423274fec3806085c0e5ea4827316458557494f2cbd95dd9729f5450d21f1845574b1764e216ec1bdf218929ad43b245", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666347, "uuid": "e0012c54-3801-4bee-81a5-05f5d6aa12e2", "value": "T1F0E4BF4177C2C0B6C15E017A5982D35D22F9ADA1AF3996C3ABD0BABF7EB40C29D35311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666347, "uuid": "fd21b6a3-aa21-4c9e-a224-ab624057d6e4", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666347, "uuid": "9a8e9fda-49ec-4f93-9a19-f5ab56f47c01", "value": "12288:hr7tPMgvzJAHX/18nLrOo2HYJnfA/QCwirzKA0OhR3Hm/zZe+sB9qF6+Z2ncwH2i:ffdA3/18nLrOoaYNfqPhabS10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645666347, "uuid": "5238832c-0297-43e8-8bcc-d9c1bf560ebf", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645666347, "uuid": "fc7ab891-5949-4504-9df3-fb8fe91c5ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645666347, "uuid": "61add91f-182a-4b7e-9ce8-63e35fbdb1c5", "value": "ed6efa1d0c23b733e8bae5d372b5f5d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b62404-9544-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645688336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688336, "uuid": "805f6967-b26d-48b7-bd5d-11e4db1be032", "comment": "Malware payload", "value": "7efd5a6c1dd61f1876d6c5afa9fc8239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688336, "uuid": "8f096c15-632e-43e1-bf54-fe5ae0f4023b", "comment": "Malware payload", "value": "deb958a3b4a4ba6f454a2883eb33802a5e8952d943073a0f7b2fad6058e4f918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688336, "uuid": "8179d193-15e8-44d0-b143-f91dcc27d654", "comment": "Malware payload", "value": "361db18b7cd403c4289542399421f0f6d2f19b49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645688336, "uuid": "c54aca1a-0187-45d2-9de2-17605d01c533", "comment": "Malware payload", "value": "d03300808d559c6902d4c40cb273bcba2a266d7ad345634824d0e5abe04f28fed93b623c31cede4886959f15de26ebc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688336, "uuid": "75dcf807-76f7-4509-9310-83f35beadfdf", "value": "T1F09623BD71843728C06AC4349437FD95B3F5552F43EC95AAB1EBBBC06B2A920E502F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688336, "uuid": "05704bac-d774-4002-8d9b-afa4c091a894", "value": "2f084553d02ee9faa371daf024a1480c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688336, "uuid": "a0b46971-9f45-4ec5-ad9a-d8e36544a5ff", "value": "196608:By7EzlA3oHL5oyPRmLmn5aVZorLDOHjNYqtk:+B3gL5RPRpn5wZobOHjNDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645688336, "uuid": "f3725f50-d6ac-4e17-b4ad-95ec8410859b", "value": 8891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645688336, "uuid": "be71b523-ff9b-4cd4-9b00-83dfe577afaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645688336, "uuid": "fe1efaec-da22-42d8-a1fc-bf0fe700f636", "value": "7efd5a6c1dd61f1876d6c5afa9fc8239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3383078f-9596-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1645723288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723288, "uuid": "1c72ca82-ab64-4bd3-a705-c14a9799f931", "comment": "Malware payload (Formbook)", "value": "5d88ca9d8ab891bd206fe0348deaac51", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723288, "uuid": "071396dd-020d-40dd-a565-5917ba6e3963", "comment": "Malware payload (Formbook)", "value": "dedfa0f74f9f15efa510015553bc7c9a7f1c023d46725ac2960a74d08a7dadd9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723288, "uuid": "fcf58af1-a7dc-426c-aeff-f3e4ccb45463", "comment": "Malware payload (Formbook)", "value": "3c9c0cd4fab66bf1481ebecd2698c90353722679", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645723288, "uuid": "68a23417-2ec9-4988-99e9-b0c7daa1ccf4", "comment": "Malware payload (Formbook)", "value": "19b5bba38784f9a308187c2bb318ceec10063b0ce5f2180d9ea07d85e91067df4a6aeada4c5319d42f1f3d6ed7b3582f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723288, "uuid": "7a706e23-dc00-49b2-b27c-0ebb5372d399", "value": "T1581402233B0AA552D7F6E239B363D2D4F426DF53BD1294B572F2B2B8467A0E049D0161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723288, "uuid": "1870ff1e-c105-43f3-a03b-b5e2ad2eade1", "value": "3072:vNpdalRd9p4ahDTRzgE8fsFvo87uJ2tIt57gsshnXPil6n+KrjIE8Pb:lp4Jr4QRzgEcsdo2uJuo2ssxim+KrjIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645723288, "uuid": "6bee1afe-81ab-4055-929f-7549e8e83954", "value": 190648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645723288, "uuid": "c7bf1a9d-3fe5-4e4a-af3d-24ad53a18f9f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645723288, "uuid": "f38cf6ec-ffa6-40a4-bdfb-ebd124c5a9ad", "value": "DSJHFGHGFD_idbki.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cc36ed-9530-11ec-9275-42010a9c0029", "comment": "Malware payload (Worm.Soulclose)", "timestamp": 1645679426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679426, "uuid": "84b92f83-9b01-4ae8-9ae4-679f24920849", "comment": "Malware payload (Worm.Soulclose)", "value": "36e57d3111dfeace80f25619375e21b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Soulclose", "colour": "#880FFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679426, "uuid": "d321821b-7e1d-4ae3-9494-5e6b3218d8da", "comment": "Malware payload (Worm.Soulclose)", "value": "defff654451b45269440d579162da638d36c5fc949b5c93a1acf199566f9e870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Soulclose", "colour": "#880FFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679426, "uuid": "6bc3943e-82dc-4591-b172-b745cf675a07", "comment": "Malware payload (Worm.Soulclose)", "value": "aef57d477b1505b78b38dfd0cf8647ff3fefd653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Soulclose", "colour": "#880FFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645679426, "uuid": "7d15a1c4-2983-4781-a65f-ffeccebe1c69", "comment": "Malware payload (Worm.Soulclose)", "value": "7518ec122c515cd0044214b566f4b01ed089a035642b4c0b407300ba64310f24cfb14e94b37514ba3d2ad73327902968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Soulclose", "colour": "#880FFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679426, "uuid": "9c114fce-ddba-4ff5-b390-d6114fd5a1ec", "value": "T19C454A027A908076E56209304965E69DA779BD31DA538E4F33942FCEFFF16C29E24336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679426, "uuid": "0c5df6a0-8b02-4c07-a3f6-59706d5b13c2", "value": "c8d018cb37e373f39260e312242f20d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679426, "uuid": "ccc96fd7-9738-4156-bc92-5e4da7c69c86", "value": "24576:sGPiuMdwsNDS5lSs8rRoNk7BZpLc+lPYxH4HOsRgiipfW:xuusNDS5lS9rRokpLS4usuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645679426, "uuid": "af2a1da8-56f1-4957-8f67-bd84caed245d", "value": 1194252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645679426, "uuid": "2f6009cf-a37f-486a-9d77-abd9cafbb05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645679426, "uuid": "54c65ab7-7e7c-4df7-b427-847b7f918edf", "value": "defff654451b45269440d579162da638d36c5fc949b5c93a1acf199566f9e870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f03c9e1-9542-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687203, "uuid": "53fc06e0-495a-4347-95e7-deba7a99e9ae", "comment": "Malware payload (Mirai)", "value": "169a2a137a73273e9869b1832ff7803d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687203, "uuid": "222e85b5-fd76-4213-b759-33fcd3ba808a", "comment": "Malware payload (Mirai)", "value": "df30a318de722a33f0b2bb53e422cc63174ce64e2b951be146bb697d7ca230af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687203, "uuid": "51f5a0d2-0c84-44d9-83cf-2884584ec7b2", "comment": "Malware payload (Mirai)", "value": "c509a0623ba5b6c8844e05594c6cb542fbbc7746", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687203, "uuid": "a436b138-3247-4e56-9ef1-cd23d612087c", "comment": "Malware payload (Mirai)", "value": "8e9c30bd599fb7407d574f607b689ac9006504e536469891d65081790d75e087ea31daae9bc27d2210a033e50520bd1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687203, "uuid": "9f8f6e5f-e91f-42d8-9971-15d020dfcad4", "value": "T16E934BDA64018EBDFC8BD9B982234F09A91121645F934F73F6A7FD533DA21A8DD02D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687203, "uuid": "7f42f0c5-c014-433f-9864-f377f02ac0fb", "value": "1536:PGXqa2ROt+jf5Sf+eYvkKeB2MoNYjER/n1lgSUSpmTuJm88I1I6:OA5feqkKe8/YjER/1qLTMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687203, "uuid": "caad3e9b-3562-495f-a207-8d830875bfc6", "value": 89364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687203, "uuid": "aa2bb1f8-f255-4478-94ba-15ef45ca8e8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687203, "uuid": "939a3088-6f17-49e7-9780-245c3bb1c716", "value": "169a2a137a73273e9869b1832ff7803d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a188a8c5-957d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1645712735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712735, "uuid": "071ca083-d8a1-487a-b6bc-b145667dc824", "comment": "Malware payload (AgentTesla)", "value": "f3b6c7246fcb0370f934b57585d4078b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712735, "uuid": "921de474-f529-4040-9992-b4b9c92b32b6", "comment": "Malware payload (AgentTesla)", "value": "df4d37b98472aee2ba3412c014ebecba85b67813e8d75c7aba371cea8c549847", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712735, "uuid": "b2ac56fe-24e6-4551-b17f-c56a5285c46e", "comment": "Malware payload (AgentTesla)", "value": "ea5f7d0e2e3db15cda217c4e705911ad4f7a755d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645712735, "uuid": "7972f98a-a59d-4ea5-85e4-b9b8b8f1eb12", "comment": "Malware payload (AgentTesla)", "value": "427e95997f3e35578a3b7b4ee9aead31334b0619696df7f2820c352ec9c4399d1033924b9adf2ac92da78fae137e3442", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712735, "uuid": "bf240631-17fd-4b0d-96a7-b6c1f881bed9", "value": "T16674233CE184BC9278C663D79945A38C0C270D9B91CAFE2B4E2DF7FB971193A11D5A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712735, "uuid": "c0bc974b-d13d-458c-a5fd-6f09fa683a3e", "value": "6144:LFclbVG8idKApHc4XgT1FBgN4dcsq84a+IHwAG37r/vQ2dkjW:L0G8LA6T1d+A+9LL76S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645712735, "uuid": "bffba57b-9e60-4f37-b578-23a5f6759abc", "value": 340449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645712735, "uuid": "5e3e9d90-bc72-470a-9280-3dc300bed8d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645712735, "uuid": "c77697be-f8e0-43b7-8671-7ba3161bc205", "value": "Inv_7623980.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2301842b-95bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645740011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740011, "uuid": "c6e259d7-1b8d-4863-b2ee-b7180b1bf6eb", "comment": "Malware payload (Mirai)", "value": "b174b548521593377c29d29ce8ec7d3d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740011, "uuid": "d58c5a4e-79a7-4d49-bd47-9d5bf3080667", "comment": "Malware payload (Mirai)", "value": "df8f77ecc1e9baf2d29e3ad49e6d9ab8b660e092e60996d5c6dfe037c0fe3cf0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740011, "uuid": "a658c750-f014-43cd-b082-1301811447d9", "comment": "Malware payload (Mirai)", "value": "4f374d108fb4828ff23357aa9662e8a83224dd42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645740011, "uuid": "93da9172-9e2b-4e8d-a24a-d88c3c0c71b3", "comment": "Malware payload (Mirai)", "value": "cd25b8443e82af999d9537ed9c6c0638450dfc24e0d72851fffe5e8a7fa4c73522f7d43e4c998712831e77fb23960821", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740011, "uuid": "ae7b14ca-4875-45a1-ad7d-0948121f5df0", "value": "T169830785FC419626C7D11777FE6F118E3711A3C9E2EA32039D251BA43B8F81B0D27A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740011, "uuid": "de753c46-6f41-4240-a208-cc7bc178f838", "value": "1536:6mey6M1P9WiNVP3qmTUVHiabsueZt5xik0aLfjEn5+g1:8y6M1PCmwguw4aEnIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645740011, "uuid": "82006c7a-55e2-4535-967c-f7728a5f02e5", "value": 83552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645740011, "uuid": "4f124b76-ce42-413d-b845-03968c2b4be4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645740011, "uuid": "1729c208-106c-4b83-a642-169a13962855", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588ba30f-9543-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1645687702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687702, "uuid": "7ed6b62c-0cb6-4a3d-b3e3-0bdfa45420b2", "comment": "Malware payload (Mirai)", "value": "a32b5cad7e78b478bdf4092cacd3c6fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687702, "uuid": "003ddeab-f46e-4ad5-8cbd-e06098cb8144", "comment": "Malware payload (Mirai)", "value": "dfe448c831246bf5fa9324b5240cf8e8a5e216b050dbaed44738237f169b1c55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687702, "uuid": "b0eec38c-61ab-4ee2-8a16-cf0959dea15f", "comment": "Malware payload (Mirai)", "value": "6a1b7a08303dd5eec5585408a0be79076e8a4f11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645687702, "uuid": "5650c5dc-ffd7-4db2-a1e5-292b40b4c45c", "comment": "Malware payload (Mirai)", "value": "ebc80a786e0ae76f999e8930b7959a64a15b5b53de301326e1eb6cb24275be29aff2623e3b60c81056041ca30590bd22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687702, "uuid": "4fe6a9c3-bab7-48a1-b148-566b3bd4908d", "value": "T1D9933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687702, "uuid": "0086936f-509d-405d-8ec9-67066858b78b", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+81l4umXxVqDrstKfz9e:Q97vk51RcG7Arl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645687702, "uuid": "b1c58f88-9ad9-4af2-9cac-98c671d20387", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645687702, "uuid": "3f8c9d25-5f0d-4967-b655-380a768ac9c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645687702, "uuid": "edfbf600-7cef-4ad8-84c7-0674e7a9f073", "value": "a32b5cad7e78b478bdf4092cacd3c6fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1ee3a4-9505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645660941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "d07f1fd0-192c-4030-8e9e-506aab47dc3e", "comment": "Malware payload (Heodo)", "value": "633cf9bd86be49b752cf009f3c98b925", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "68be9d82-4023-4914-a2fa-b5be28904cc0", "comment": "Malware payload (Heodo)", "value": "e005c686a4355fa62ba793f71dfa501317b04132242a0dc8d7c3a328bd7d1526", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "e13e2da8-6b96-4c70-97b3-540712675386", "comment": "Malware payload (Heodo)", "value": "64a41ac6672b167b2f896c714563f4d394852d10", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645660941, "uuid": "5d513eed-fcf7-498d-b5a9-744bec9181a1", "comment": "Malware payload (Heodo)", "value": "8a64d6e1b3026b651270a2d91144037b3b398e1b70d99f1ce2c7ada96434498448ba6c002d079cf981e8262cdbc79387", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "79c7a6e5-27ba-45c8-b152-d6d5c751fdd2", "value": "T1D7E4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "037c4cf8-b4e8-4798-ac94-aef98158ec6e", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "8283681a-c4e5-47d4-af08-b8ecc1fd0ba6", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XK4e/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXK4LzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645660941, "uuid": "1319f93f-5d11-4b72-9632-bc87a6fa502c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645660941, "uuid": "dc9cf6b7-7140-4b7f-a58c-2b881dfe28b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645660941, "uuid": "f3006014-e4f8-41a1-80a9-f4476fb07892", "value": "emotet_exe_e4_e005c686a4355fa62ba793f71dfa501317b04132242a0dc8d7c3a328bd7d1526_2022-02-24__000216.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9baccac3-95c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645744508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744508, "uuid": "77ccb702-55b8-48ee-bfa4-9442db7a7ca8", "comment": "Malware payload", "value": "e0ad980b01594ef9aead69c8342eba9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744508, "uuid": "2f91ff98-a829-4a2d-b134-681d9f050c53", "comment": "Malware payload", "value": "e08b884cf79d61a147fba20140a1d22fbbd9024c7c61fbd5173bc4829e97325f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744508, "uuid": "1814608e-22eb-402e-af6e-98fb365b4ee5", "comment": "Malware payload", "value": "8b38feb07f45f8dde98449ddaebf0358a1d34e38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645744508, "uuid": "4c11bebe-f1f0-4f05-a0ed-aa5a51dec773", "comment": "Malware payload", "value": "561a68471091ed901b01365e5c7a8fff578bce778a374e32eaafefd776a810260e61f4ceb385c518bc41228bbe28e287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upxHook", "colour": "#884C41", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744508, "uuid": "791154cb-a1e7-4a25-9d8b-e88529f7dfca", "value": "T10585335CD46A063BD28D5A2134AD33219DEDF2632610F905983BFE82B9757F618873E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744508, "uuid": "0e71cd23-c615-4cbd-b89b-7a01753d2988", "value": "49152:+fyXngETCRR1aTjlJs+Yrj4f+NPbJJsvjT5mCYxEVs6mf3N:+KhCN09YrPNPbJJsxH6Ea6mf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645744508, "uuid": "0d5811ec-3b82-45cc-9f8a-cb747d002d84", "value": 1851484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645744508, "uuid": "077f1c23-c3e1-451a-9caa-5a19c722bee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645744508, "uuid": "4eb957fa-9cef-4eaa-a754-45cf3ec54a19", "value": "CrossC2-buntu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccda3a2-95b0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1645734792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734792, "uuid": "e8f68cc3-4c60-48e6-908b-c22bd5298319", "comment": "Malware payload", "value": "939fa8e5bb047d45ac622799f90fc974", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734792, "uuid": "8ee6991b-c7e4-4ac7-a8c6-377e5fa49dfd", "comment": "Malware payload", "value": "e0c2a7ef94bc23ddc6178f53ed54adcc20d0f179664e46529d74ed0b6375b97c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734792, "uuid": "78e735a6-2ae3-436f-9568-2cb3a9f6d7e8", "comment": "Malware payload", "value": "cb41961705df75c58d12c264b5c2266e7a8d2302", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645734792, "uuid": "c044613c-0163-4868-8146-5651138aaa7a", "comment": "Malware payload", "value": "e8fa582c75a2aa85461d7b7f1fb5533792d6ef6fa37ecd50d2616e330eb7cb25ef06e957d791bd2c84e174be708d1d47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734792, "uuid": "aa5a20aa-a6ae-4565-b2b4-52f46297640b", "value": "T17BE48E3932A0A479C27D30F565F9A3B645EFAC614B29465BF7F8523F2E7C0814A3850B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734792, "uuid": "3928863c-5408-4a98-b4b6-c2c0f153d979", "value": "12288:G50jfb6SGkFIPbKq1r2oKm0X+8sD12m1yMu0mPVOXNZ:Guj21kFIPT2oFW+8a1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645734792, "uuid": "dae8eb39-56ce-43cf-9f04-d805f8f5b019", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645734792, "uuid": "003829a9-0dfa-49ff-b4ee-8f984acda60e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645734792, "uuid": "0418819a-fda6-4c3d-a44d-7f4c942f6b56", "value": "emotet_exe_e5_c61dbb11c53d0572d3c952d9d3b62dbd460e7e537575722dfb2dda84935553bc_2022-02-24__203306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f735cfb-9557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645696276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696276, "uuid": "0f174978-816d-4f4f-b5f2-9d5cd3c72dcb", "comment": "Malware payload (Heodo)", "value": "8855c9b8c021b1f401155e7e4f433034", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696276, "uuid": "a8b60d3f-a1c5-4849-8b45-5c092528b8c9", "comment": "Malware payload (Heodo)", "value": "e180cf87aa27c5c12414816e84f3502db35b1e14f97a577e6933904a865d00dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696276, "uuid": "56a50a89-5424-45cb-ad68-0ed2a98e1a27", "comment": "Malware payload (Heodo)", "value": "7aa9a3688c878d6fa80dacac2b91108ab76607f3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645696276, "uuid": "2df5d92b-f576-44e6-9502-c662265e6453", "comment": "Malware payload (Heodo)", "value": "c635c0608cdffeae21bdc3355d5027ad0a284727459b31ee0c631a6dd890eceab83e3d8d0dddf39726e759984f467eb4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696276, "uuid": "883c5901-579b-4f8b-98ff-bba4871903bb", "value": "T1BDE4BE6176C2C0B6C15F017A5946E31D62E5AD609F3896C3ABD4AFBFBFB50C29D34202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696276, "uuid": "55a87766-fefc-4324-a1f6-1878de251d45", "value": "5529db874583b5635436baabaebb4b71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696276, "uuid": "84459b1c-a4ca-4bdc-b7ac-c9b27c979b49", "value": "12288:Z6ZLutvgrwV8RQc5W1yS0ezL9J6XKhe/vyzfANcN/kJhXx5y:qza8RQc5W1P0Q9sXKhLzflBkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1645696276, "uuid": "2d98ebbb-9463-40f4-9b29-468a86b013fa", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1645696276, "uuid": "b8a8630e-6f63-498a-bf20-89766710d7d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1645696276, "uuid": "17b259a6-1a9e-4379-8d94-601faa446683", "value": "Ds8oyqwmawCIBaPnL8kACN1KhbDRMZ2B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6682c0d9-9552-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1645694168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694168, "uuid": "2b23baab-5563-4fe3-a001-66632e56a1af", "comment": "Malware payload (Heodo)", "value": "954d9e5cfc5048bd4c6790ddaa4f1f7a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694168, "uuid": "acc47ad5-d53a-4595-a7f0-a70a7cf52960", "comment": "Malware payload (Heodo)", "value": "e1dd9c399b7f8151823e4a6c8397cdf2f978d49de12710181cff20fc6e6d94fb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694168, "uuid": "c8657f22-1516-43a9-a331-109453f87c53", "comment": "Malware payload (Heodo)", "value": "5dc4ee53e2901a5e22e00d0f87f83137b24b46d7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1645694168, "uuid": "b510b65e-3423-4cf5-aaf9-5c7842a83f60", "comment": "Malware payload (Heodo)", "value": "7c0d894194664fc4aa845c65a8b93e4ef210f74ee398a743d22a861c27487f276a8ca788e89b6980d9260e0f4f88e3bd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6